Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-05-2024 19:26

General

  • Target

    1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe

  • Size

    186KB

  • MD5

    1e039f9770017f09225e58d7759b700a

  • SHA1

    fc1e83365f05fb98b4dc94833e430a7adc055bf5

  • SHA256

    f9ab2087217beb38c3ec3dc043aad739dac202dc422f44e49c0fb5ca6db26502

  • SHA512

    ebeb10678547b0eca642645a673e9e6309c3ba961e62d83aca95aff8a351a56c07544c92688681e58dbe66cc8e0812ab01c388d0b5e463d5c97d4ea038bf26e2

  • SSDEEP

    3072:oM1BjoYNXoKDIJBXJPG45d48j8uZmXJtP4NMtGvNOilk+qNKNtmlohi8tUUB5+Qy:oMMYNXqBBG6Zj8ikJtP4SGVdHqEUGQUw

Malware Config

Extracted

Path

C:\Users\Admin\Documents\# DECRYPT MY FILES #.txt

Family

cerber

Ransom Note
C E R B E R R A N S O M W A R E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great!!! You have turned to be a part of a big community #Cerber_Ransomware. ######################################################################### !!! If you are reading this message it means the software !!! "Cerber Ransomware" has been removed from your computer. ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to get back your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://cerberhhyed5frqa.onion.to/D0E9-2FCD-7F1F-006D-F913 | | 2. http://cerberhhyed5frqa.onion.cab/D0E9-2FCD-7F1F-006D-F913 | | 3. http://cerberhhyed5frqa.onion.nu/D0E9-2FCD-7F1F-006D-F913 | | 4. http://cerberhhyed5frqa.onion.link/D0E9-2FCD-7F1F-006D-F913 | | 5. http://cerberhhyed5frqa.tor2web.org/D0E9-2FCD-7F1F-006D-F913 |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://cerberhhyed5frqa.onion.to/D0E9-2FCD-7F1F-006D-F913); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://cerberhhyed5frqa.onion.to/D0E9-2FCD-7F1F-006D-F913 appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://cerberhhyed5frqa.onion.to/D0E9-2FCD-7F1F-006D-F913); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://cerberhhyed5frqa.onion/D0E9-2FCD-7F1F-006D-F913 | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.
URLs

http://cerberhhyed5frqa.onion.to/D0E9-2FCD-7F1F-006D-F913

http://cerberhhyed5frqa.onion.cab/D0E9-2FCD-7F1F-006D-F913

http://cerberhhyed5frqa.onion.nu/D0E9-2FCD-7F1F-006D-F913

http://cerberhhyed5frqa.onion.link/D0E9-2FCD-7F1F-006D-F913

http://cerberhhyed5frqa.tor2web.org/D0E9-2FCD-7F1F-006D-F913

http://cerberhhyed5frqa.onion/D0E9-2FCD-7F1F-006D-F913

Extracted

Path

C:\Users\Admin\Documents\# DECRYPT MY FILES #.html

Ransom Note
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>&#067;erber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .tor { padding: 10px 0; text-align: center; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R&nbsp;&nbsp;&nbsp;R A N S O M W A R E</h3> <hr> <p>Cannot you find the files you need?<br>Is the content of the files that you looked for not readable?</p> <p>It is normal because the files' names, as well as the data in your files have been encrypted.</p> <p>Great!!!<br>You have turned to be a part of a big community #Cerber_Ransomware.</p> <hr> <p><span class="warning">If you are reading this message it means the software "Cerber Ransomware" has been removed from your computer.</span></p> <hr> <h3>What is encryption?</h3> <p>Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users.</p> <p>To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key.</p> <p>But not only it.</p> <p>It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data.</p> <hr> <h3>Everything is clear for me but what should I do?</h3> <p>The first step is reading these instructions to the end.</p> <p>Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you.</p> <p>After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions.</p> <p>It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them.</p> <p><span class="warning">Any attempts to get back your files with the third-party tools can be fatal for your encrypted files.</span></p> <p>The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files.</p> <p>Finally it will be impossible to decrypt your files.</p> <p>When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly.</p> <p>You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files.</p> <hr> <p><span class="warning">There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already.</span></p> <hr> <p>For your information the software to decrypt your files (as well as the private key provided together) are paid products.</p> <p>After purchase of the software package you will be able to:</p> <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> <p>If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files.</p> <hr> <div class="info"> <p>There is a list of temporary addresses to go on your personal page below:</p> <ol> <li><a href="http://cerberhhyed5frqa.onion.to/D0E9-2FCD-7F1F-006D-F913" target="_blank">http://cerberhhyed5frqa.onion.to/D0E9-2FCD-7F1F-006D-F913</a></li> <li><a href="http://cerberhhyed5frqa.onion.cab/D0E9-2FCD-7F1F-006D-F913" target="_blank">http://cerberhhyed5frqa.onion.cab/D0E9-2FCD-7F1F-006D-F913</a></li> <li><a href="http://cerberhhyed5frqa.onion.nu/D0E9-2FCD-7F1F-006D-F913" target="_blank">http://cerberhhyed5frqa.onion.nu/D0E9-2FCD-7F1F-006D-F913</a></li> <li><a href="http://cerberhhyed5frqa.onion.link/D0E9-2FCD-7F1F-006D-F913" target="_blank">http://cerberhhyed5frqa.onion.link/D0E9-2FCD-7F1F-006D-F913</a></li> <li><a href="http://cerberhhyed5frqa.tor2web.org/D0E9-2FCD-7F1F-006D-F913" target="_blank">http://cerberhhyed5frqa.tor2web.org/D0E9-2FCD-7F1F-006D-F913</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> <p>If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it):</p> <ol> <li>take a look at the first address (in this case it is <a href="http://cerberhhyed5frqa.onion.to/D0E9-2FCD-7F1F-006D-F913" target="_blank">http://cerberhhyed5frqa.onion.to/D0E9-2FCD-7F1F-006D-F913</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address <a href="http://cerberhhyed5frqa.onion.to/D0E9-2FCD-7F1F-006D-F913" target="_blank">http://cerberhhyed5frqa.onion.to/D0E9-2FCD-7F1F-006D-F913</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> <p>If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions.</p> <p>If you browse the instructions in HTML format:</p> <ol> <li>click the left mouse button on the first address (in this case it is <a href="http://cerberhhyed5frqa.onion.to/D0E9-2FCD-7F1F-006D-F913" target="_blank">http://cerberhhyed5frqa.onion.to/D0E9-2FCD-7F1F-006D-F913</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> <p>If for some reason the site cannot be opened check the connection to the Internet.</p> <hr> <p>Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products.</p> <p>Unlike them we are ready to help you always.</p> <p>If you need our help but the temporary sites are not available:</p> <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address <span class="tor">http://cerberhhyed5frqa.onion/D0E9-2FCD-7F1F-006D-F913</span> in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> <p>If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation.</p> <p>If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files.</p> <hr> <h3>Additional information:</h3> <p>You will find the instructions for restoring your files in those folders where you have your encrypted files only.</p> <p>The instructions are made in two file formats - HTML and TXT for your convenience.</p> <p>Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files.</p> <p>The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company.</p> <hr> <p>Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data.</p> <p>The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection.</p> <p>Together we make the Internet a better and safer place.</p> <hr> <p>If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support.</p> <hr> <p>Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.</p> </div> </body> </html>

Signatures

  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

  • Contacts a large (16404) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Kills process with taskkill 2 IoCs
  • Modifies Control Panel 4 IoCs
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1592
    • C:\Users\Admin\AppData\Local\Temp\1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe"
      2⤵
      • Adds policy Run key to start application
      • Drops startup file
      • Adds Run key to start application
      • Modifies Control Panel
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3616
      • C:\Users\Admin\AppData\Roaming\{8999624C-A316-9EC4-C889-0544D5B59B99}\mountvol.exe
        "C:\Users\Admin\AppData\Roaming\{8999624C-A316-9EC4-C889-0544D5B59B99}\mountvol.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4004
        • C:\Users\Admin\AppData\Roaming\{8999624C-A316-9EC4-C889-0544D5B59B99}\mountvol.exe
          "C:\Users\Admin\AppData\Roaming\{8999624C-A316-9EC4-C889-0544D5B59B99}\mountvol.exe"
          4⤵
          • Adds policy Run key to start application
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Sets desktop wallpaper using registry
          • Modifies Control Panel
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2592
          • C:\Windows\system32\vssadmin.exe
            "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
            5⤵
            • Interacts with shadow copies
            PID:2532
          • C:\Windows\system32\wbem\wmic.exe
            "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2116
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:5316
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe06a946f8,0x7ffe06a94708,0x7ffe06a94718
              6⤵
                PID:5336
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13224526070530476742,7941745126620649395,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
                6⤵
                  PID:5684
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,13224526070530476742,7941745126620649395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5692
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,13224526070530476742,7941745126620649395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
                  6⤵
                    PID:5700
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13224526070530476742,7941745126620649395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
                    6⤵
                      PID:5796
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13224526070530476742,7941745126620649395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
                      6⤵
                        PID:5820
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13224526070530476742,7941745126620649395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
                        6⤵
                          PID:4784
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13224526070530476742,7941745126620649395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
                          6⤵
                            PID:928
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13224526070530476742,7941745126620649395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
                            6⤵
                              PID:2036
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13224526070530476742,7941745126620649395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3288 /prefetch:8
                              6⤵
                                PID:4612
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13224526070530476742,7941745126620649395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3288 /prefetch:8
                                6⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:216
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13224526070530476742,7941745126620649395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4344 /prefetch:1
                                6⤵
                                  PID:1696
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13224526070530476742,7941745126620649395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
                                  6⤵
                                    PID:2888
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13224526070530476742,7941745126620649395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
                                    6⤵
                                      PID:5280
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13224526070530476742,7941745126620649395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
                                      6⤵
                                        PID:5216
                                    • C:\Windows\system32\NOTEPAD.EXE
                                      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
                                      5⤵
                                        PID:5344
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cerberhhyed5frqa.onion.to/D0E9-2FCD-7F1F-006D-F913
                                        5⤵
                                          PID:5828
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe06a946f8,0x7ffe06a94708,0x7ffe06a94718
                                            6⤵
                                              PID:6060
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
                                            5⤵
                                              PID:1316
                                            • C:\Windows\system32\cmd.exe
                                              /d /c taskkill /t /f /im "mountvol.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{8999624C-A316-9EC4-C889-0544D5B59B99}\mountvol.exe" > NUL
                                              5⤵
                                                PID:6140
                                                • C:\Windows\system32\taskkill.exe
                                                  taskkill /t /f /im "mountvol.exe"
                                                  6⤵
                                                  • Kills process with taskkill
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4336
                                                • C:\Windows\system32\PING.EXE
                                                  ping -n 1 127.0.0.1
                                                  6⤵
                                                  • Runs ping.exe
                                                  PID:3676
                                          • C:\Windows\SysWOW64\cmd.exe
                                            /d /c taskkill /t /f /im "1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe" > NUL
                                            3⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:3476
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill /t /f /im "1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe"
                                              4⤵
                                              • Kills process with taskkill
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:432
                                            • C:\Windows\SysWOW64\PING.EXE
                                              ping -n 1 127.0.0.1
                                              4⤵
                                              • Runs ping.exe
                                              PID:1012
                                      • C:\Windows\system32\vssvc.exe
                                        C:\Windows\system32\vssvc.exe
                                        1⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3056
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:6084
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:3672
                                          • C:\Windows\system32\AUDIODG.EXE
                                            C:\Windows\system32\AUDIODG.EXE 0x520 0x450
                                            1⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3832

                                          Network

                                          MITRE ATT&CK Matrix ATT&CK v13

                                          Execution

                                          Windows Management Instrumentation

                                          1
                                          T1047

                                          Persistence

                                          Boot or Logon Autostart Execution

                                          2
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          2
                                          T1547.001

                                          Privilege Escalation

                                          Boot or Logon Autostart Execution

                                          2
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          2
                                          T1547.001

                                          Defense Evasion

                                          Indicator Removal

                                          2
                                          T1070

                                          File Deletion

                                          2
                                          T1070.004

                                          Modify Registry

                                          3
                                          T1112

                                          Credential Access

                                          Unsecured Credentials

                                          1
                                          T1552

                                          Credentials In Files

                                          1
                                          T1552.001

                                          Discovery

                                          Network Service Discovery

                                          2
                                          T1046

                                          Query Registry

                                          2
                                          T1012

                                          System Information Discovery

                                          3
                                          T1082

                                          Remote System Discovery

                                          1
                                          T1018

                                          Collection

                                          Data from Local System

                                          1
                                          T1005

                                          Impact

                                          Inhibit System Recovery

                                          2
                                          T1490

                                          Defacement

                                          1
                                          T1491

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            Filesize

                                            152B

                                            MD5

                                            850f27f857369bf7fe83c613d2ec35cb

                                            SHA1

                                            7677a061c6fd2a030b44841bfb32da0abc1dbefb

                                            SHA256

                                            a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

                                            SHA512

                                            7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            Filesize

                                            152B

                                            MD5

                                            62c02dda2bf22d702a9b3a1c547c5f6a

                                            SHA1

                                            8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

                                            SHA256

                                            cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

                                            SHA512

                                            a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                            Filesize

                                            111B

                                            MD5

                                            807419ca9a4734feaf8d8563a003b048

                                            SHA1

                                            a723c7d60a65886ffa068711f1e900ccc85922a6

                                            SHA256

                                            aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                            SHA512

                                            f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            Filesize

                                            5KB

                                            MD5

                                            6567bd39d1828f313246be2193248e33

                                            SHA1

                                            88f9ba6f16fe01d3f8cebfce189edba143d6c0d4

                                            SHA256

                                            ae52dd502765b0d895df8e3b30ead570bd20bcffbf46a377e2d3a67babf1241e

                                            SHA512

                                            c1f3301d6d45ea3485983533353cdbc10f6487441b55d0d20188f6a5e6c2d189744af9a6c66c8e1b7dcb4fb6d716db2a8a2e8808a3131dd9d75d5cee3fb4de5d

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            Filesize

                                            6KB

                                            MD5

                                            eda8affdbb1ef6c34a73ef243ef6192b

                                            SHA1

                                            99b49be52abf137a028ce0594f00f75d90632aaa

                                            SHA256

                                            4bc6fb64e2519ba783a2deba819c4435ff1be8d69fdd2bf72201fa6aa363ac2b

                                            SHA512

                                            47fe16cf25b4cc515893254ca8ad9e58ba4227d6bff1a0f0ceadb13e0404114a3c300b1db931a8affde20161ee409c197e5c888b9e531d4bdbda21c3ca415354

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                            Filesize

                                            16B

                                            MD5

                                            6752a1d65b201c13b62ea44016eb221f

                                            SHA1

                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                            SHA256

                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                            SHA512

                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                            Filesize

                                            11KB

                                            MD5

                                            f7369e086a137449b1576d2824fc8b60

                                            SHA1

                                            4675e2fd9684e3e82b05e42cf251f93f0936b470

                                            SHA256

                                            d18e322ac09600a9778b8aa76069b4ec8e5c6e61d822a811aac16ab6e7e254b9

                                            SHA512

                                            c7864b2feab9e4b86d245185eda11560734bebd6cc0a13d338476e3c929e906acf0b33ae0c11b9b6018cccc4fe6222d3a390cef9f3f175002aeb1cce8cdf082e

                                          • C:\Users\Admin\AppData\Local\Temp\nsj372E.tmp\System.dll
                                            Filesize

                                            11KB

                                            MD5

                                            883eff06ac96966270731e4e22817e11

                                            SHA1

                                            523c87c98236cbc04430e87ec19b977595092ac8

                                            SHA256

                                            44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

                                            SHA512

                                            60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

                                          • C:\Users\Admin\AppData\Roaming\3BSYBS1-DCSA_Alerts_05172015040008.xml
                                            Filesize

                                            1KB

                                            MD5

                                            6b4c09a2ef0528c2998ac0bc19757af2

                                            SHA1

                                            51cdd849771499a0de0d8cce746fddd5d177d4bf

                                            SHA256

                                            d5fa42c3b71d032313cb07595432f8e177fd77cfe2ef026dc7dc114576415c5b

                                            SHA512

                                            f63f32f550d456bf2227c41be3c891f492937714309e8b91d663267bf0a2f8403c7056dad53f008acf9b34951a2bd3d800ba1187daecae9e89057786d4a7c28b

                                          • C:\Users\Admin\AppData\Roaming\3BSYBS1-DCSA_Alerts_05172015040008.xml
                                            Filesize

                                            1KB

                                            MD5

                                            9df4113be5f1c32889410e8a9e86346a

                                            SHA1

                                            2750c7b2c6b116d2ff6abb9c6dd6a6867656de4d

                                            SHA256

                                            761d16f96810371efec63c1c9195392b304d1231c252da9377cf1a59a102ac43

                                            SHA512

                                            f7202854dfcaf4971c929f952a5faa2004d0b870e75dfb3969f3a3cfea34ba1ef8e97e1f9857211210633f3658018d8733d8455fbe9282ea460bbafc4b53bba4

                                          • C:\Users\Admin\AppData\Roaming\424 bl 4.ADO
                                            Filesize

                                            524B

                                            MD5

                                            f180e85af9eea2a1d42807a6ebcb7a36

                                            SHA1

                                            5d49cde993f16d8259b10c5401280aa067c1b423

                                            SHA256

                                            4e748cbdf4437760c6f7e32b770814bba131d1d9a1e9fa887ae62114a1be22f1

                                            SHA512

                                            22ff1448e9197f5ad37b288bcad397fed8de00c2cd97178aa7b3ae766a7eef60d153db0e59293281829ea65d3c3e66ff6b7d6eb7e52a5d5c3c3f108b46d416eb

                                          • C:\Users\Admin\AppData\Roaming\Bahrain
                                            Filesize

                                            77B

                                            MD5

                                            d7a8d88e7d5b134d92542787e019e123

                                            SHA1

                                            ad633d30aa9f0bf314bba5f004060fc90a14a16d

                                            SHA256

                                            859d70658cc7502f214d9abd669c4e730e798210c372fd7020ceae470ac7756c

                                            SHA512

                                            194e553ecc8ffd376c029670ced1f2480509b072d2adebd6af22fa69945f3fafb58a3385d5a09451c85f03d891049b8123c0cd3907bce944cb4784606679ffa2

                                          • C:\Users\Admin\AppData\Roaming\Brunei
                                            Filesize

                                            77B

                                            MD5

                                            e25d4339e1f45436dc0dfbfcb96ebf3d

                                            SHA1

                                            1bfac0992a3b92e9db24f51e6cd18db2686e174f

                                            SHA256

                                            5db2a1b2a800bad6a64345b5993cf04b37818fc9679203ae93f12e46ca8bc241

                                            SHA512

                                            dcfb9a4d288c732b36fb54a3cd1e78bf50b700e917cdbedd021a1164b5d2e65ddb8debc1d26357e2cb2dc1ec04e1a9e03114225b136942c396deab1fa971c5f7

                                          • C:\Users\Admin\AppData\Roaming\Damascus
                                            Filesize

                                            1KB

                                            MD5

                                            93657662177fdc9183a0fd632790c0ae

                                            SHA1

                                            5586f64b641545aa2610b3bcd5df7750a17955de

                                            SHA256

                                            a353644ae75ca0a454a56caa9a442e361f1097ff429d035fc7ba73e87650e21e

                                            SHA512

                                            c0a0deb8e5773c783e3656084fb751847b71b2b1e6b2bf489f31f97100e4c629c0266c10d3f1a75c6811a2a195308d564d7216be8bce01b8ec5dda3a5096eb93

                                          • C:\Users\Admin\AppData\Roaming\Dushanbe
                                            Filesize

                                            261B

                                            MD5

                                            70e3f2851ad0cacb4d9f850fc7d0cd60

                                            SHA1

                                            6fbdc432df31bd7af06c619f91bf7b759788be2e

                                            SHA256

                                            caeec5309a9b777812307e423efc4112cb1eb25a00704848eb954ec4c70f174d

                                            SHA512

                                            1d484b231b9180f87af6d9d926d5faeaab0547d0600a7bd77046f71b4b2eaf62785bda462726a13fec4136d0bb20e737de819577a43a8d8f60660519b6263a74

                                          • C:\Users\Admin\AppData\Roaming\Glassine.m4T
                                            Filesize

                                            117KB

                                            MD5

                                            fdd3a4fb73e7fc0eff3d9db58f76867a

                                            SHA1

                                            e3b522cc46fa8aa55df3d2920e3656c867c0be5b

                                            SHA256

                                            78cf532835278c3baaa8ce8ebf204a470243df7baca7906403598c74a752c613

                                            SHA512

                                            9c884410c8e3b39cd0bbeec8fef2dd97d1b65d1f5d8e41ed7e58ca9119d9fcb5cc89ae33f963bbe4455cf04280d3e5ed4ffa1dc98c3ba089c9b47e097954b41e

                                          • C:\Users\Admin\AppData\Roaming\Helsinki
                                            Filesize

                                            1KB

                                            MD5

                                            f3b05d9cac6285e7ab08950275b0284a

                                            SHA1

                                            0a5d25e02a1784ff15c20c13840dbd48118360b6

                                            SHA256

                                            e87cc9499cf2ada66c2b53ff2ef96ccb2726c08b4881608ceb23790bb60b3522

                                            SHA512

                                            59d5c8ab5f09d0ccfd395510d24df8a9e4a935a6f9cc835142ac62b96416a395f8d6aa02e55a6d246f1879eb8e009e14b1ab5bad7b102ff53dfe0c3914a5b0c5

                                          • C:\Users\Admin\AppData\Roaming\KSCpc-EUC-V
                                            Filesize

                                            3KB

                                            MD5

                                            c8e708d1288dff4aba0cc066d873f187

                                            SHA1

                                            c2078d884d95b0c3bf10dd0af5faafb0d504537b

                                            SHA256

                                            d9f3be39a1777d1e3996b385b0ac90935e8fe6ab1b7a83cd9bfeca41fe7bd4ec

                                            SHA512

                                            e60af3a3ccdb60273645a86a527a8152b9a80fae286948d546c53835b016cc31c686c2d3b22414e0b058fe3c56aba7761ceea817e9f73537f4ac4ccdb8a970e1

                                          • C:\Users\Admin\AppData\Roaming\LF_Disabled.png
                                            Filesize

                                            4KB

                                            MD5

                                            01988d409db3c319ec87721581b1ab9e

                                            SHA1

                                            4228ef415b1fa2256d57c7bc3fe4700c79bc02f0

                                            SHA256

                                            39d37b9507fe014a62da954bfc126d17be3aab1b5e827b4dddcbe11f0f864f67

                                            SHA512

                                            c02afd0ecf3b1b3d3fd8ba4c79f12c8415f83ab08fc527694d8b9e058201428e3eeec1f791f166f2a3c9c2685271d33b8e47886c45f16435748166d1829a14a2

                                          • C:\Users\Admin\AppData\Roaming\LF_Disabled.png
                                            Filesize

                                            4KB

                                            MD5

                                            595512e1911d0549a46ed96f1b9fcf5a

                                            SHA1

                                            0144f01c7fde24550226bf994f3bcbda382c3942

                                            SHA256

                                            4ada755850bdab968adb27e1b280cd84def9c4f8895d4d6430c66262c45562ff

                                            SHA512

                                            e02eb3cf92ec04779ea8618b3f07673c43b6103268f60f2e74e212aabdd2a108e5277b1381b2afedd4f43d7a05593f00a18845d372122cf58ff3e4a84479ab8d

                                          • C:\Users\Admin\AppData\Roaming\Makefile.docParam
                                            Filesize

                                            1KB

                                            MD5

                                            4fa5ebe8c3bebd54be9eded49c1c8c27

                                            SHA1

                                            b320a0a0add161ee971a26aa54ed2db48c6020e9

                                            SHA256

                                            a24237defa96897c3b553f4f81d6609f9bddb1c191e6eed69b35abecf56be9d6

                                            SHA512

                                            1b7cbfa09367b8c12ab54b3766bd9f450736efe1dacc91c6c6acdd68ca53d434699074b386f57f5e64a0c5ef71429065556782f6d9e87cda55550e1d89a32024

                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\mountvol.lnk
                                            Filesize

                                            1KB

                                            MD5

                                            98b43e16fe14d06d875ca3675f57d274

                                            SHA1

                                            6f909c464003b7cf57848bbed9d30587378cef69

                                            SHA256

                                            ad1dd2b960e08525bfc6a41b4a3e0de7a508bb5baca942b0d2127dd0f805eb17

                                            SHA512

                                            a4c67a37c53abef27f6be67b8bf92c5cb4763fbee5c5f679fc323f6766e6742cb7e60aa3786ffc0c271a1fa6fc51f770889bd7f97ac53830717d38594776e22a

                                          • C:\Users\Admin\AppData\Roaming\Monochromatic Low Contrast.hdt
                                            Filesize

                                            112B

                                            MD5

                                            53ca81c9d2f8bde4285415e29568f19b

                                            SHA1

                                            759eeba53e63000efb6b39ce5d61ed71ba5cfb7a

                                            SHA256

                                            303b07b6f9d35762ebca5b5496f7910b42f54ed0eab5000e2324f08aab28e57e

                                            SHA512

                                            80f197fc63b9d441b6387f193efb8f273e04e72121f2580f4709941cba4b7a513acbb8453e04db8e7575bd16f8eb4ac22e3556cee18c173c928c7f18c1589614

                                          • C:\Users\Admin\AppData\Roaming\Nwiz.dll
                                            Filesize

                                            40KB

                                            MD5

                                            7f5859cddce6d27bf5ee5a0e5abf80f7

                                            SHA1

                                            3fdb34f8c461031de871716f913b6414d71e5f8b

                                            SHA256

                                            9be59c18fa3c74fda8d6bbab8ce3b0ac980872261688c62c4ea3a89e7aaf3766

                                            SHA512

                                            d4dd6c85edc84b77f3ec96071e6cd3ac29ea62d59852a0707616fb8b70f25fee6ede59818a2c3e9e69d260cee31ade339ea80b9838eb38498d33319dd41ab4b0

                                          • C:\Users\Admin\AppData\Roaming\VSFlat.hlsl
                                            Filesize

                                            148B

                                            MD5

                                            387995a1ad77f6a492c6f16ce887b7f1

                                            SHA1

                                            e2f22e55d1b10d877514d9adee20d0c244d7bc62

                                            SHA256

                                            c5381ca7bbd13cb11c2d2e543ee12e9c4d080e77a765743574eaef6fff96c6e6

                                            SHA512

                                            8010388b6444f09d2ace5a31a3910746c42dcade8cda487c9d9f6f90397803ec05c79efbd3ac6e227478d2a1e82bf3d862cb53a719ec10581a9c0de44bc327eb

                                          • C:\Users\Admin\AppData\Roaming\Vestibule.X
                                            MD5

                                            d41d8cd98f00b204e9800998ecf8427e

                                            SHA1

                                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                                            SHA256

                                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                            SHA512

                                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                          • C:\Users\Admin\AppData\Roaming\appupdater.exe.manifest
                                            Filesize

                                            1KB

                                            MD5

                                            d223bb3f5c46425dcb13e41022d6986f

                                            SHA1

                                            923f55318f52283afa03994b20073b2578fa8f57

                                            SHA256

                                            0bc634dd83708546cc2d2f094a153dc7dcfedb9577ee00f5c591a755c44a5ca8

                                            SHA512

                                            d9f804b86f701d2db4d490f84c36fa32bdfcbc9ce236a33de2304fa045af79369cac76ac30fa0f85d26a157d9f6d54833874d898bb69c0718a87bd30426dedc0

                                          • C:\Users\Admin\AppData\Roaming\body.bg.color.xml
                                            Filesize

                                            891B

                                            MD5

                                            c8f0d3c03c5696181ae7aafd8789bce8

                                            SHA1

                                            5ec888513c60fefb2a42027333cd1cffbff0b44a

                                            SHA256

                                            5e78efc7d4505f63d57951859a336551904a546f55a1f7564e12494012fdef83

                                            SHA512

                                            3a31d227a986aeca2863f8732e382a9ee3405869ff86c43bec6d3ff3bcacdaa72b9edaa5ae683c8084cd71a4eac7318f80bfc3a2e129fc66f920baed9b4eaa4c

                                          • C:\Users\Admin\AppData\Roaming\data.png
                                            Filesize

                                            1KB

                                            MD5

                                            99794a31ae4ff2284d1183f5699c2d5e

                                            SHA1

                                            2297ae201904d17bff6f270bf732ff19636f496a

                                            SHA256

                                            ea2022a289b2c2d1426b85ea2b26bec26c30e796698ea2d62eff4ed82a4b3c78

                                            SHA512

                                            ec0dce0622b116849694a88451cea438424f97f846f83571d82a331e7a191a0e76266f9046082eb7f184622cd710528fde93a2d180fb10feffbbcb4d25a0e34a

                                          • C:\Users\Admin\AppData\Roaming\data.png
                                            Filesize

                                            1KB

                                            MD5

                                            f8f9db79b3c6f4034f64a8bc279686d3

                                            SHA1

                                            a50d737610dfff2ee80359784edd0b284d7e80d8

                                            SHA256

                                            6ac78a9ad24cd69b70af427b0573709888067276f193123d592ece6690dcbbb6

                                            SHA512

                                            991845d4e4cb308540e4af4fd7afa44ec276dc625e48725f33b13716a34b31a6c7101e6052784120c5720e2e20c740c2dbf3602dd544562f2817923e1fa721f3

                                          • C:\Users\Admin\AppData\Roaming\default_hash.js
                                            Filesize

                                            136B

                                            MD5

                                            06a09bda9d5dd7dba611b2dd460d545e

                                            SHA1

                                            73946d0150e298464b8a55a107bb22be6368029c

                                            SHA256

                                            c062646586359c92950920a9e5a51bcec73afeb863dc01337a88adadc789f05e

                                            SHA512

                                            b104418ebc3eabf7a3d4aae3a23bdeea63d0118f56397e3763318397baa0b59ed5756a354a922c2c6206636ab761197e379e6fa5b4aa7cf2a60c24416a2ad459

                                          • C:\Users\Admin\AppData\Roaming\default_hash.js
                                            Filesize

                                            528B

                                            MD5

                                            704b7256ef3bb022ea04ac869331a748

                                            SHA1

                                            b7021f098a986f07b916d4ac8f32cfd4ff0373a7

                                            SHA256

                                            04fbd58a50239383832d00971797a70f16c7e8780c0285befc699b66b02e3e78

                                            SHA512

                                            71b4cf81a2ff0c1c5b91d8b7ecdda40d9044c72b0a964ddb4d43bb03fd5d410a983da8990f074d6c5226974d8d154d59921532f0f38daf4626e9306656656bd7

                                          • C:\Users\Admin\AppData\Roaming\diagnostics_na.png
                                            Filesize

                                            808B

                                            MD5

                                            deb72596c68e9b6f16b59f5de8ff901c

                                            SHA1

                                            3e22a0f4eb128a7648711f8da091a5c46b3bdb60

                                            SHA256

                                            b0c0d834193f54df5535625d9481f0539974537b1fe4c8951ef684114af33610

                                            SHA512

                                            49de31a2e43816398998fbe69a183dcb51539eb8b842f164c0546e5289a4f37ffe9e77b7d1d9e361a1112957b14a356040bfd3d5aa96aaa8364b9780ca85a6f7

                                          • C:\Users\Admin\AppData\Roaming\diagnostics_na.png
                                            Filesize

                                            410B

                                            MD5

                                            1b509acbb124eda9d7a1f722941096cc

                                            SHA1

                                            9ed8ce338f74a57365546c4e112cc25564b7c971

                                            SHA256

                                            b6eaa77c7f3cc6efa96fc6f7f555477d7ba9226206cc954212d52d2e2dd90ebc

                                            SHA512

                                            61ec6ef8e4697456261b9d49b883f40a75f50f5c4c6bcdd4a88809724608fa6645803ec30b687b7d8a07eb6ff088e3eeb5bd46b55e0d916ad4a2fcaeec173d2f

                                          • C:\Users\Admin\AppData\Roaming\externalhelp.xsd
                                            Filesize

                                            805B

                                            MD5

                                            4e78ba21399fe6c949c163ebc779bf60

                                            SHA1

                                            d20b6e7d854a53394eb68d653b2eea32963fc96c

                                            SHA256

                                            984afa83853bb983601491fc923fb957e523084c670745ee1d0ea6f6edfc5f6c

                                            SHA512

                                            97f4440beabce2d6bb8783cd157ba3cab159dc6f0659a4315a65c4e1716350d2a03641465c1297ecd14332724d8ad2801f815667331dbd449cfa9765c2674b32

                                          • C:\Users\Admin\AppData\Roaming\f2.png
                                            Filesize

                                            1KB

                                            MD5

                                            776bd82891e52f9430b3891103e8bd1c

                                            SHA1

                                            00a4de0a6fe8067fa41202f6312e1e85c0cf9126

                                            SHA256

                                            a08812bfa0464d79d082d2e2ad8d2cc4aa2c941fd3deb2e8e0c5fd015d9901ec

                                            SHA512

                                            d4f1adec624a79645d22c6c3901df2a91efa62399f4143384e47a5ab75fdd69a9373ef9cece6f51439fb2029782474f77ac18348e6c9f09848cdaf5cd73ae4cb

                                          • C:\Users\Admin\AppData\Roaming\f2.png
                                            Filesize

                                            1KB

                                            MD5

                                            4517d0c4dcc010004b44670274a99294

                                            SHA1

                                            7266f50e4fb28b881dbb4546e90ceed8259acf0b

                                            SHA256

                                            73ebb47d85164fc1666f4fbd66cfec90fdd0154eca449cae10614f56a209f432

                                            SHA512

                                            d85e1f8bdc46566656073310b6d58dc977feb3a18ebd5739716925ad97ab71776ca0e7144b7d74d662c32baf5a5b7e088bf76530affa9c223ee1781fc923d3a3

                                          • C:\Users\Admin\AppData\Roaming\f6.png
                                            Filesize

                                            1KB

                                            MD5

                                            d22a8dd33f23c84c07902f656d27de60

                                            SHA1

                                            b9bf1655ebb3738813fdd5132bb89a39173e580b

                                            SHA256

                                            573619b3cb3cf6ebf2a675790a26a2c2dcf5218d99ef45036519fecccba77bcd

                                            SHA512

                                            4789f9eea04ee23a5aed6d3da4b896220c72efabfca85996e581e25beee495069e70cde517605abd34b5065491bf0ae56f5194f46a87b9614752be3f5f65bebe

                                          • C:\Users\Admin\AppData\Roaming\f6.png
                                            Filesize

                                            1KB

                                            MD5

                                            e1cc4228bf8efcffeab59fb645c9832c

                                            SHA1

                                            a4994becf0cd8c5f2924e4365e064f1a34fbdfec

                                            SHA256

                                            5ece16429710ff94c832ebac8eb48614e547fdd7d94067bc5ddd64367776b961

                                            SHA512

                                            4ea6bf172a002bf51408bdb0d4e6ea096209512465d3772e022b4db911be8c699a024c0d9f7d6f1af9f9d25a401a8cbc34b45a9526c0390dc0ab990ff4f75e00

                                          • C:\Users\Admin\AppData\Roaming\file_sig_verification.png
                                            Filesize

                                            543B

                                            MD5

                                            1315745b828d02838c8f3a8954bfe1c7

                                            SHA1

                                            57fb2c41320bdee698d75b59fd7ce5b337deba93

                                            SHA256

                                            738bb684c612de4553ea636325846acc0b8661659ad5495ae79d08a31997d184

                                            SHA512

                                            6e30b24b345c2b4a70d6444799fc5e87fc489bbcf9038a551a7406e7f4ec5dce9c51a5a6b77241f5bf2a60af346b4ac36fa099306cc0050380a9adf4e094ec3c

                                          • C:\Users\Admin\AppData\Roaming\file_sig_verification.png
                                            Filesize

                                            955B

                                            MD5

                                            91031b74b714ccbc552e8b5e596e75eb

                                            SHA1

                                            0699ca79e4c60c49d94b11d0238ee0e255a51194

                                            SHA256

                                            3042396935fa41b5671c4b4323a7263364db975f70c5e99222938dabdcf3efb9

                                            SHA512

                                            818d1f2545fbe293e6d551b5794a8f157ab75b4690140142e5fd014ee69b86614b5ed3a9c5ee527ad370c970759bc3464b338f349e930a71ecb81cfdf2d7e95a

                                          • C:\Users\Admin\AppData\Roaming\hammer.png
                                            Filesize

                                            3KB

                                            MD5

                                            ac484fe0bfd59e00631ff9651d7dec65

                                            SHA1

                                            0ff105a95028919f6d192b11c32c636adc7160e8

                                            SHA256

                                            39a3e70707a3461478ed2b58a743f4aaee978b7f38c6e4b0d29751f7a4d4fb84

                                            SHA512

                                            08850f7a2207f2bfb2af32a6b52ce012d7725790b609b06a0a31fa3b0aab731c905af8bfddf10471a6623e454ea269ff419f5d148ffc72ce2cdc58b92ab6ee9e

                                          • C:\Users\Admin\AppData\Roaming\hammer.png
                                            Filesize

                                            3KB

                                            MD5

                                            10566dd922ce3766715d5950adef767c

                                            SHA1

                                            81afeabcb35828f71bff053ab342983e5cbec847

                                            SHA256

                                            d1cdcf57ae3fc07e2d51c74be1be3df32557b11eafdf5c78a2fdd77426ec46b1

                                            SHA512

                                            dcd842aba0bd34a7cd44353e4a0c2ae04e3e382a24de43ba36b0f146ef10abd887d88141e8a7432080e1324578c1ede199201ecd09521a7615cf45d7c8d08a23

                                          • C:\Users\Admin\AppData\Roaming\html.cellpadding.xml
                                            Filesize

                                            1KB

                                            MD5

                                            3f1a1ae17d17d712b0260d3bc4639935

                                            SHA1

                                            259124fb4fd23f2a4869a08eb029aca73ae77acf

                                            SHA256

                                            912547a16d7e1d873417f1c5dceaf9a02bf79a7dbc173e6a8f2fdfa8d0fd170c

                                            SHA512

                                            7a73b8344a76e81bcace4bff336a9da7c969d9468a447adff5759b1bc7e4f754665eeb30d9c775b06e4ae94f9d879efc6f4f52832731c1f4a9f46727a9eee52c

                                          • C:\Users\Admin\AppData\Roaming\html.cellpadding.xml
                                            Filesize

                                            983B

                                            MD5

                                            5b626b6f01e073a639410a00ba394414

                                            SHA1

                                            c500c25c5976cc9b20c0bbb65a2869651dff50fd

                                            SHA256

                                            4156be6502ba6daa517e5cff65e2792dd12e98f9ddcb439eda287080c461892c

                                            SHA512

                                            a79ddfe1ec9085d42b0a1b6561a7a85b6d44880c893e0004060ed45e2bd1a16627c8cf1311e56ef81d4b61466015cda316cab7fadbab70075d7fa9a3e02f8849

                                          • C:\Users\Admin\AppData\Roaming\isoamsc.ent
                                            Filesize

                                            2KB

                                            MD5

                                            da706f14a76714c7e9ad2590c264df8f

                                            SHA1

                                            c85afb023638c54941dec1e0ccef2e54ed619725

                                            SHA256

                                            d24f46dd70139e3eeaab2e3e24e15cd46a3e6a6f3b2cc207e528717bba9a37fd

                                            SHA512

                                            8870f62ec63ad7bdf129d2e9c0ae133d240d001f5bb73ec50651df3651d3b57e4b5456d46cba8f2b9a833932c46a6348c0477b62becabc3612bc9b7222d2a5aa

                                          • C:\Users\Admin\AppData\Roaming\itemizedlist.properties.xml
                                            Filesize

                                            1KB

                                            MD5

                                            41e5c9ebfc019a38e094c4868c9a1b10

                                            SHA1

                                            88d34e80beab2e1b4e9ff8baa963e47ea35e53db

                                            SHA256

                                            b515a1b4f21354daa641ca0794cffa1007731ac8a08df5ff39171d180373d000

                                            SHA512

                                            bb2538e88341d456f9d66c8ca6f756139d23bfa0c0aa03a9b30612863124ee04839572dfeab99f142849525f95f83b2d6a22a7a1b619c252a781a43c8422a291

                                          • C:\Users\Admin\AppData\Roaming\libimalloc.dll
                                            Filesize

                                            3KB

                                            MD5

                                            5a9d61592a64ed8d0df13ce430d3bf6a

                                            SHA1

                                            d19862c6125595440865cb2b6049572902980101

                                            SHA256

                                            fd135a296d34e7b707343d703e05fcefdf08bc2e3be6f554daf765a04710e1f1

                                            SHA512

                                            7df008f55f6c3c7cdc862086264e2db571e19a9e6e198e8f7e9505984a7867ac63fb92d49f6c592ef1167e7e7e75f554756b1438d53c899a463c2a3fcc167688

                                          • C:\Users\Admin\AppData\Roaming\man.output.base.dir.xml
                                            Filesize

                                            1KB

                                            MD5

                                            601499ed95bf6c937209ebbdae1b33ab

                                            SHA1

                                            3d0d6d945668498cce4f8d09d08920647fa08684

                                            SHA256

                                            f808da08ad1b8e5ab75bcc7d8d2dcaf2fa51cdf47e693b212d2a893fe301d31c

                                            SHA512

                                            eb3e95902d91c015f803270eed9046524a3943cff49845071ab90d99bb92b5f98a630153f1448da8466eabde7dc1693129a5f77ed15029a7c4f7ef68744743d7

                                          • C:\Users\Admin\AppData\Roaming\msconfig.png
                                            Filesize

                                            2KB

                                            MD5

                                            ecbc5e3d8c0314a1671441ad66422581

                                            SHA1

                                            356b6245df4dae2ec2d5312031438834171c94fb

                                            SHA256

                                            4a9a8b1aa036980f933053221d996f69070c32410cd7467b7a8653c523ac7a43

                                            SHA512

                                            c0b131bfbdcf6ece718e2b3b345327a2e9492e6bc3c3e8f63ee0d67c8ec32945971232df8e90bc617e32181e51899a1c67c74349aa44dd908a4a265523194964

                                          • C:\Users\Admin\AppData\Roaming\msconfig.png
                                            Filesize

                                            2KB

                                            MD5

                                            a5256008f2bcc58048b0fe953ab2264d

                                            SHA1

                                            c9b96b8dad778b744fed04e49e92b93dbda7e605

                                            SHA256

                                            cea67b0d84f75d4acac0b067c5a46bc56cb77ec230565c165f9c45b9f51cada9

                                            SHA512

                                            898658ded34281ab89342949bdbc8ad4f194b19b293a5a462600594d875c4e49ca794c0f91595dc8f86b6cbaf0467c790aa810b4f6dde666bfd3ce950df983b5

                                          • C:\Users\Admin\AppData\Roaming\no.next.image.xml
                                            Filesize

                                            901B

                                            MD5

                                            6a6b2829a4fe85a75e98d3a3fd9187a1

                                            SHA1

                                            57dce22eb765b7ca603ea680481145cdab969b08

                                            SHA256

                                            50af1f6c515ba759e7ccd92c9bd7bd3e6535003a09024b3d5053df40600e7c27

                                            SHA512

                                            231ad2c2781b58641710bafba0dc759f5f40e4f45bd34e5917b9a06e90fe72c825b054b06ea0417a36693652aad1bab28f056b60ef490416d2c12ea09bdec941

                                          • C:\Users\Admin\AppData\Roaming\pointer.png
                                            Filesize

                                            556B

                                            MD5

                                            2b99d906fd310712f4e5f94e99c023b7

                                            SHA1

                                            746df05eee14cf531e41afb8c3092f9b64f7f4a5

                                            SHA256

                                            c00708b8023dc2575bf60930161e099e723cb4c25146ecd1be8a1142c43fe540

                                            SHA512

                                            30929817b511d3659592eec4324a3fbd09c7a5bcc617a89829b870da35f580f1734debf744acede528f571037514dc58b1852360614083843c0ab748905d981b

                                          • C:\Users\Admin\AppData\Roaming\pointer.png
                                            Filesize

                                            172B

                                            MD5

                                            328d207b3e601381d79377b86409b71d

                                            SHA1

                                            0597db362867ca8801d079fcd5d6b8f35d5b5f74

                                            SHA256

                                            8eb2920d9a36ecbc931f5992f88808f818c3c7a6c16119f30c34aaa9a3707b30

                                            SHA512

                                            abb38613947cb751e03da36f474d3bc956203d6fdd9a6ef5e978e187866d638ae28c5048d0bad374f4574d4e9fe456995ba594d86f75d709833961d1a39ae7b4

                                          • C:\Users\Admin\AppData\Roaming\prev.svg
                                            Filesize

                                            1KB

                                            MD5

                                            d5e5cc502e3b6a10d8c0624758a5400b

                                            SHA1

                                            75591b459ef8a37b85949fdca298723d637e26a2

                                            SHA256

                                            327ecfd3afe06fc4379baa3a47face1f09b64d92c2c57bea9257446781e50c0e

                                            SHA512

                                            d5fbeca06b89fd395a6e1d3a56a9e897c2c912775365fde9131642d753b4795d6ade8a000db5be9a899e550d06d7cac7362b76378fb8395b442314f008be3c0a

                                          • C:\Users\Admin\AppData\Roaming\smartcard_reader.png
                                            Filesize

                                            4KB

                                            MD5

                                            8ad63bce5bbb3a69ffcc1cc5eb065cae

                                            SHA1

                                            baff947cb368dddf86df3c74d89f44fe16f46872

                                            SHA256

                                            38a51458fba9b2bbd6060d95c483959dd343453cf9e0cf970698236d4b58d23d

                                            SHA512

                                            a1e70d333a929d99ee1368bb318e7d9d32d4f82e5d7cb867dc5c75a91be2da25f4fe02e42f2e2a64d3350bd8726d7cba0a80fd41cb148719da7d345deaa07f7b

                                          • C:\Users\Admin\AppData\Roaming\smartcard_reader.png
                                            Filesize

                                            4KB

                                            MD5

                                            49b7d0dc3d2ae0ba1d405e665954d15a

                                            SHA1

                                            4611c1a33041fa9d704078f9ad6927612e60a881

                                            SHA256

                                            3381ad52a015d00e222032f6d18d70f1cc66114a540bb1ce82e9fd850ca6ad31

                                            SHA512

                                            76e47c2ce710181b871814c5acd261f24979e5c7de0395a0b6a20ad0cc46843fd9381c9b04e786616ae6747cd05dec43c3bd6f02f726ccda9e0f32df6c4b4722

                                          • C:\Users\Admin\AppData\Roaming\tweakDiskCleanup_pt.p5p
                                            Filesize

                                            95B

                                            MD5

                                            7d8b84bd6edbe7c4176f5fd20ec99b40

                                            SHA1

                                            8064e8a2f16fa0d6f1e4e56ab9fd5b169f9f7f57

                                            SHA256

                                            7e6932c2bad825efae22c8723764b6ce1f897b28d0251ab25a2f490400d1a2a5

                                            SHA512

                                            701ef1fc001a01f1cb81d2f18e3e60394a89b0024b14d5c4f1a6c263af2a3a7d58c1eb234cab51a8151baeb8fac061a45fa2a2a0d60f7b40de2e1571aa4d4a4c

                                          • C:\Users\Admin\AppData\Roaming\tweakNetworkingManual_es.p5p
                                            Filesize

                                            1KB

                                            MD5

                                            f815309cb6953d1a573e2bc721287053

                                            SHA1

                                            2e2284639a82b38fe6cb5d4e278ecdb4ce145370

                                            SHA256

                                            cc0fe9c375dee9d1c548c506865cc086ab8914945156cb818db5d928622943fd

                                            SHA512

                                            cc07f98f280ba81b32cc2490f3274aa60be379ba465cba3e15237396c8fc59cb41c12fad0135f8fbbacf232a5979782a8971d9008b934c936dd8f4d8f0ca98e0

                                          • C:\Users\Admin\AppData\Roaming\vcss.png
                                            Filesize

                                            1KB

                                            MD5

                                            35986567c8c46ef7fe2fd6f769f8eab3

                                            SHA1

                                            7110e627fe61db1e73bccc8ec7ec55ef6f410d99

                                            SHA256

                                            c602e65680851b379c5e6aec9e528dfb98e42427fcacfc2462434e55d8bcc83d

                                            SHA512

                                            a8bfe6a92cf4652ec6377ea583cd42248f8754af10ed10c4bcdcb27e3e2479f316dfae92080dfdfc5e3cda4b4ea9e83079e6bf0969c22f18204cc2242002e7df

                                          • C:\Users\Admin\AppData\Roaming\video_card.png
                                            Filesize

                                            3KB

                                            MD5

                                            8f76de212a59bcffc6613e3365cc9871

                                            SHA1

                                            5565c6f389b5c1ca190567b3d1055eba1be29ca6

                                            SHA256

                                            c9b169107fca20ca721ad2dc03b065ae546093348ec5ebf9107b2c745f47cae1

                                            SHA512

                                            571e12113723c076075cdceb1b9f6aaa9dc805b7700b1e624e0118a16d264f0c9b5c5b5414101fb2b80301112bbfddcbbbc0a4e960d7ba8107429b8666a96676

                                          • C:\Users\Admin\AppData\Roaming\video_card.png
                                            Filesize

                                            4KB

                                            MD5

                                            5fa443fc614ac8473b0e48a7b1000bf0

                                            SHA1

                                            c403b8fe7ff7938a0cdcc9d12db803d5a87249e0

                                            SHA256

                                            7009938e6809dce1c85b213313bb10d19714d53c50866b9e03437b3c9afb1dbd

                                            SHA512

                                            77053557b732a02edb656ce2c85ffd732715517a8fc075571fc1f20b009d329d40294c54bcb40ed2d233e0748ffd92971724da1b14f5bad67d9936438871f64e

                                          • C:\Users\Admin\AppData\Roaming\yellow bl 4.ADO
                                            Filesize

                                            524B

                                            MD5

                                            9f92ff064f3910a5199c60109ab20d42

                                            SHA1

                                            6949e2728d371d57d446c46d648a086849825656

                                            SHA256

                                            586c1646484e700c6c80aa5f5031286119d97767f5cf7217758890439007738d

                                            SHA512

                                            e48294ec60f229f9d59a5a251a0b9c2ab852a4b4c3c5b781476c5fb3844048c63fd91eb1866ebae956fbf4bfcb3bf950fb6ad4832f44b48bffd5415481553d7e

                                          • C:\Users\Admin\AppData\Roaming\{8999624C-A316-9EC4-C889-0544D5B59B99}\mountvol.exe
                                            Filesize

                                            186KB

                                            MD5

                                            1e039f9770017f09225e58d7759b700a

                                            SHA1

                                            fc1e83365f05fb98b4dc94833e430a7adc055bf5

                                            SHA256

                                            f9ab2087217beb38c3ec3dc043aad739dac202dc422f44e49c0fb5ca6db26502

                                            SHA512

                                            ebeb10678547b0eca642645a673e9e6309c3ba961e62d83aca95aff8a351a56c07544c92688681e58dbe66cc8e0812ab01c388d0b5e463d5c97d4ea038bf26e2

                                          • C:\Users\Admin\Documents\# DECRYPT MY FILES #.html
                                            Filesize

                                            12KB

                                            MD5

                                            14b4e40a01dd72f4d96b112a74326585

                                            SHA1

                                            477106ba46e4acfea5d5cf9d284722a048b1c5ff

                                            SHA256

                                            617837727bc1019e215132986f0db588ff1b3427610bea1a5e7400702edb6f74

                                            SHA512

                                            f41f92bcd6ede2a522838ef53d000e43d6409ee695963631f5d80996cb30f4dd3b3f355398a1c6100a44f48d2d3357f780c3350b05782dfa144f6e9dcffb357a

                                          • C:\Users\Admin\Documents\# DECRYPT MY FILES #.txt
                                            Filesize

                                            10KB

                                            MD5

                                            6c39080c2b6ec41dfdfcf1b82fdd1746

                                            SHA1

                                            624e89651562228ee361f03d61d26cb595248b11

                                            SHA256

                                            b233e88fb1aa6dc25ac96910106391d7ef8c94cd0ef7be69f10e04b42cdbbce6

                                            SHA512

                                            0b46b11280ea5547cac880472c5593a1673441198ff83ea0f39591b2e87660e7b2d265eded58109b0e4db080ecac037ee59c9558e80ea8166422e27ccaf3951b

                                          • C:\Users\Admin\Documents\# DECRYPT MY FILES #.url
                                            Filesize

                                            83B

                                            MD5

                                            c521a62bc53ac991acb8b55c916a8abe

                                            SHA1

                                            6ba08d5f6631bc2984504503ee29cd5b5a142a82

                                            SHA256

                                            9c1e0e4df7a81e501646da8ef0c8ec961aa89097a22fbb87f0129abc858618d0

                                            SHA512

                                            606747ecb073c6e5764bc4237be5e3266ad60d20877cda5ded3892c171fa044c05e81d1edd5d6edee492e148e1ad5eb13b60989c1454b1760ce1d66f02293528

                                          • C:\Users\Admin\Documents\# DECRYPT MY FILES #.vbs
                                            Filesize

                                            219B

                                            MD5

                                            35a3e3b45dcfc1e6c4fd4a160873a0d1

                                            SHA1

                                            a0bcc855f2b75d82cbaae3a8710f816956e94b37

                                            SHA256

                                            8ad5e0f423ce1ff13f45a79746813f0f1d56993d7f125ab96f3d93fb54bdc934

                                            SHA512

                                            6d8e68b969ef67903aff526e983b0fb496678e4c819139e560a11f754a36c4b5770ac2ecf3fc1d9cb5aaa84f80363b4f55553255569503893192911b80d9d853

                                          • memory/1592-48-0x0000000002270000-0x000000000227A000-memory.dmp
                                            Filesize

                                            40KB

                                          • memory/2592-161-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-173-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-499-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-496-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-493-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-490-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-528-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-505-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-508-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-513-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-519-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-520-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-525-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-531-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-521-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-175-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-176-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-503-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-168-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-167-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-166-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-164-0x0000000003B20000-0x0000000003B21000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/2592-162-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-160-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-612-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/2592-589-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/3616-56-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/3616-55-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/3616-69-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/3616-54-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/3616-53-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/3616-51-0x0000000000400000-0x0000000000420000-memory.dmp
                                            Filesize

                                            128KB

                                          • memory/4004-155-0x00000000020B0000-0x00000000020BA000-memory.dmp
                                            Filesize

                                            40KB