7f65b5d7be7a9e563e1b577ff1d95c891b16fa9871dc748c7640e6589e6902db

Resubmissions

07/05/2024, 19:29

240507-x7rbdsed93 9

07/05/2024, 18:20

240507-wyy47she2x 9

07/05/2024, 17:15

240507-vs3prsac54 9

07/05/2024, 08:54

240507-ktxvsshc9s 9

Analysis

max time kernel
173s
max time network
191s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
07/05/2024, 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ByteVault.exe
Size

9.8MB
MD5

25a7375d3a6597707493a0841e878bce
SHA1

173a8e00b00d84830e06b1f3d63988fe895fa001
SHA256

7f65b5d7be7a9e563e1b577ff1d95c891b16fa9871dc748c7640e6589e6902db
SHA512

110518ee80839dcf0e826bfdb41c16591deac371865b3635ef08b005a823e53c296d9de0be9eeba3d6e1c5413905f4d4d8ef175748c2c6e48801b9149668cee9
SSDEEP

196608:fhfefIk7AHkPkRJW9GNZA1HeT39IigaeE9TFa0Z8DOjCdylwo1nz8QW7tx:0QFG8S1+TtIiEY9Z8D8CclPdoPx

Score

9^/10

evasion execution ransomware

Malware Config

Signatures

Renames multiple (153) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2232	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\International\Geo\Nation	ByteVault.exe

Loads dropped DLL 10 IoCs

pid	Process
2452	ByteVault.exe
2452	ByteVault.exe
2452	ByteVault.exe
2452	ByteVault.exe
2452	ByteVault.exe
2452	ByteVault.exe
2452	ByteVault.exe
2452	ByteVault.exe
2452	ByteVault.exe
2452	ByteVault.exe

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	ByteVault.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	ByteVault.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	ByteVault.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	ByteVault.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	ByteVault.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	ByteVault.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	ByteVault.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	ByteVault.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
652	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c10a3b63a2a0da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4eb7f466a2a0da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 245e68a0a2a0da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = d06d5575a2a0da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ca25298ca2a0da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 35882b8ca2a0da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5e970663a2a0da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ff95c57da2a0da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4624	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
652	powershell.exe
652	powershell.exe
652	powershell.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
4224	MicrosoftEdgeCP.exe
4224	MicrosoftEdgeCP.exe
4224	MicrosoftEdgeCP.exe
4224	MicrosoftEdgeCP.exe
4224	MicrosoftEdgeCP.exe
4224	MicrosoftEdgeCP.exe
4224	MicrosoftEdgeCP.exe
4224	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	652	powershell.exe
Token: SeIncreaseQuotaPrivilege	652	powershell.exe
Token: SeSecurityPrivilege	652	powershell.exe
Token: SeTakeOwnershipPrivilege	652	powershell.exe
Token: SeLoadDriverPrivilege	652	powershell.exe
Token: SeSystemProfilePrivilege	652	powershell.exe
Token: SeSystemtimePrivilege	652	powershell.exe
Token: SeProfSingleProcessPrivilege	652	powershell.exe
Token: SeIncBasePriorityPrivilege	652	powershell.exe
Token: SeCreatePagefilePrivilege	652	powershell.exe
Token: SeBackupPrivilege	652	powershell.exe
Token: SeRestorePrivilege	652	powershell.exe
Token: SeShutdownPrivilege	652	powershell.exe
Token: SeDebugPrivilege	652	powershell.exe
Token: SeSystemEnvironmentPrivilege	652	powershell.exe
Token: SeRemoteShutdownPrivilege	652	powershell.exe
Token: SeUndockPrivilege	652	powershell.exe
Token: SeManageVolumePrivilege	652	powershell.exe
Token: 33	652	powershell.exe
Token: 34	652	powershell.exe
Token: 35	652	powershell.exe
Token: 36	652	powershell.exe
Token: SeDebugPrivilege	4316	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4316	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4316	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4316	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3912	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3912	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3912	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3912	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3024	MicrosoftEdge.exe
4224	MicrosoftEdgeCP.exe
4316	MicrosoftEdgeCP.exe
4224	MicrosoftEdgeCP.exe
2744	OpenWith.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 2452	4924	ByteVault.exe	74
PID 4924 wrote to memory of 2452	4924	ByteVault.exe	74
PID 2452 wrote to memory of 652	2452	ByteVault.exe	75
PID 2452 wrote to memory of 652	2452	ByteVault.exe	75
PID 2452 wrote to memory of 2232	2452	ByteVault.exe	78
PID 2452 wrote to memory of 2232	2452	ByteVault.exe	78
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3344	4224	MicrosoftEdgeCP.exe	91
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84
PID 4224 wrote to memory of 3912	4224	MicrosoftEdgeCP.exe	84

C:\Users\Admin\AppData\Local\Temp\ByteVault.exe
"C:\Users\Admin\AppData\Local\Temp\ByteVault.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\ByteVault.exe
  "C:\Users\Admin\AppData\Local\Temp\ByteVault.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:652
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:2232

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3024

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4904

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4316

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3912

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1448

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2272

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1620

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3344

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2010_x64.log-MSI_vc_red.msi.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4624

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s fdPHost
1⤵
PID:3700

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Encrypt\encrypt.html

Filesize
1KB

MD5
0b8e6e89d7ea9193b4c2b2a1fc84c22c

SHA1
9574d0561e2ec4276adb0e5e18e217344af09519

SHA256
c8d8c17a0a38fa7031794f4180903d628d04266cfd273fc1fa82222f3b958abf

SHA512
91fe291c4648ccaf10eaf01fb5e33ce5132dc03ee31b577bbc3a8d00fb115b2e8f3e9616f4b11b9f728302cca5fad7dbfbb2e09502c3e3d0fcb03384f7e280b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VSH5XF98\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\ZZV07RIF\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!121\Microsoft\Windows\3720402701\1568373884.pri

Filesize
218KB

MD5
13e8857c11c103c86af5a010ba171f66

SHA1
dd8f6ee3cd8b1ac01c480e0843c323805c3cf2ae

SHA256
8b69fd5d6b540b3080b438f3cf0d42f3266654e786ce7dc5e85855d309e962ac

SHA512
8454d4a02c15e12428628aaf9df2f5ec48d261e692a8b4f2e7e81d83c3acd6921bfb2d3ebc76f78f124fd0065852af348bec56a91e7ba9c54525615d6b7804b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49242\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49242\_bz2.pyd

Filesize
83KB

MD5
223fd6748cae86e8c2d5618085c768ac

SHA1
dcb589f2265728fe97156814cbe6ff3303cd05d3

SHA256
f81dc49eac5ecc528e628175add2ff6bda695a93ea76671d7187155aa6326abb

SHA512
9c22c178417b82e68f71e5b7fe7c0c0a77184ee12bd0dc049373eace7fa66c89458164d124a9167ae760ff9d384b78ca91001e5c151a51ad80c824066b8ecce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49242\_cffi_backend.cp312-win_amd64.pyd

Filesize
178KB

MD5
0572b13646141d0b1a5718e35549577c

SHA1
eeb40363c1f456c1c612d3c7e4923210eae4cdf7

SHA256
d8a76d1e31bbd62a482dea9115fc1a109cb39af4cf6d1323409175f3c93113a7

SHA512
67c28432ca8b389acc26e47eb8c4977fddd4af9214819f89df07fecbc8ed750d5f35807a1b195508dd1d77e2a7a9d7265049dcfbfe7665a7fd1ba45da1e4e842

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49242\_decimal.pyd

Filesize
245KB

MD5
3055edf761508190b576e9bf904003aa

SHA1
f0dc8d882b5cd7955cc6dfc8f9834f70a83c7890

SHA256
e4104e47399d3f635a14d649f61250e9fd37f7e65c81ffe11f099923f8532577

SHA512
87538fe20bd2c1150a8fefd0478ffd32e2a9c59d22290464bf5dfb917f6ac7ec874f8b1c70d643a4dc3dd32cbe17e7ea40c0be3ea9dd07039d94ab316f752248

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49242\_hashlib.pyd

Filesize
64KB

MD5
eedb6d834d96a3dffffb1f65b5f7e5be

SHA1
ed6735cfdd0d1ec21c7568a9923eb377e54b308d

SHA256
79c4cde23397b9a35b54a3c2298b3c7a844454f4387cb0693f15e4facd227dd2

SHA512
527bd7bb2f4031416762595f4ce24cbc6254a50eaf2cc160b930950c4f2b3f5e245a486972148c535f8cd80c78ec6fa8c9a062085d60db8f23d4b21e8ae4c0ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49242\_lzma.pyd

Filesize
156KB

MD5
05e8b2c429aff98b3ae6adc842fb56a3

SHA1
834ddbced68db4fe17c283ab63b2faa2e4163824

SHA256
a6e2a5bb7a33ad9054f178786a031a46ea560faeef1fb96259331500aae9154c

SHA512
badeb99795b89bc7c1f0c36becc7a0b2ce99ecfd6f6bb493bda24b8e57e6712e23f4c509c96a28bc05200910beddc9f1536416bbc922331cae698e813cbb50b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49242\_socket.pyd

Filesize
81KB

MD5
dc06f8d5508be059eae9e29d5ba7e9ec

SHA1
d666c88979075d3b0c6fd3be7c595e83e0cb4e82

SHA256
7daff6aa3851a913ed97995702a5dfb8a27cb7cf00fb496597be777228d7564a

SHA512
57eb36bc1e9be20c85c34b0a535b2349cb13405d60e752016e23603c4648939f1150e4dbebc01ec7b43eb1a6947c182ccb8a806e7e72167ad2e9d98d1fd94ab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49242\base_library.zip

Filesize
1.3MB

MD5
08332a62eb782d03b959ba64013ac5bc

SHA1
b70b6ae91f1bded398ca3f62e883ae75e9966041

SHA256
8584f0eb44456a275e3bc69626e3acad595546fd78de21a946b2eb7d6ba02288

SHA512
a58e4a096d3ce738f6f93477c9a73ddbfcb4b82d212c0a19c0cf9e07f1e62b2f477a5dd468cd31cc5a13a73b93fa17f64d6b516afef2c56d38ede1ace35cf087

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49242\cryptography\hazmat\bindings\_rust.pyd

Filesize
6.9MB

MD5
61d63fbd7dd1871392997dd3cef6cc8e

SHA1
45a0a7f26f51ce77aa1d89f8bedb4af90e755fa9

SHA256
ae3a2936b138a2faa4d0cd6445fae97e441b23f6fdafb1a30e60fd80c37d7df5

SHA512
c31f1f281d354acb424a510d54790ee809364b55425b1d39429e1bb7c379126578260c6f197834339a34833c90e748483aabd426295731f78fcde9580fcd8f9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49242\libcrypto-3.dll

Filesize
5.0MB

MD5
e547cf6d296a88f5b1c352c116df7c0c

SHA1
cafa14e0367f7c13ad140fd556f10f320a039783

SHA256
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

SHA512
9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49242\python3.dll

Filesize
66KB

MD5
79b02450d6ca4852165036c8d4eaed1f

SHA1
ce9ff1b302426d4c94a2d3ea81531d3cb9e583e4

SHA256
d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123

SHA512
47044d18db3a4dd58a93b43034f4fafa66821d157dcfefb85fca2122795f4591dc69a82eb2e0ebd9183075184368850e4caf9c9fea0cfe6f766c73a60ffdf416

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49242\python312.dll

Filesize
6.6MB

MD5
3c388ce47c0d9117d2a50b3fa5ac981d

SHA1
038484ff7460d03d1d36c23f0de4874cbaea2c48

SHA256
c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

SHA512
e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49242\select.pyd

Filesize
29KB

MD5
92b440ca45447ec33e884752e4c65b07

SHA1
5477e21bb511cc33c988140521a4f8c11a427bcc

SHA256
680df34fb908c49410ac5f68a8c05d92858acd111e62d1194d15bdce520bd6c3

SHA512
40e60e1d1445592c5e8eb352a4052db28b1739a29e16b884b0ba15917b058e66196988214ce473ba158704837b101a13195d5e48cb1dc2f07262dfecfe8d8191

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49242\unicodedata.pyd

Filesize
1.1MB

MD5
16be9a6f941f1a2cb6b5fca766309b2c

SHA1
17b23ae0e6a11d5b8159c748073e36a936f3316a

SHA256
10ffd5207eeff5a836b330b237d766365d746c30e01abf0fd01f78548d1f1b04

SHA512
64b7ecc58ae7cf128f03a0d5d5428aaa0d4ad4ae7e7d19be0ea819bbbf99503836bfe4946df8ee3ab8a92331fdd002ab9a9de5146af3e86fef789ce46810796b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_foluyztg.kak.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\Desktop\LockRestart.reg.ByteX

Filesize
1.2MB

MD5
132dbd2a40ebeffe800f3ddca529b3e5

SHA1
012e362349f50740a7bdc588119f9d5a2df21df1

SHA256
1199112cc19ff12152bb37b7ef7e0e6127dd41c4f244f011f59587abc7f5df9a

SHA512
238e6d9a5231bad58a524ed0c4268924e156b9f6e94e23bf8f96edacce850d184198f512d99afc8dcb51ae455434cde19635d9f4bfa782ba6c20154ae62fa4eb

Download Submit
C:\Users\Admin\Desktop\MountDisable.tiff.ByteX

Filesize
1.0MB

MD5
4de5e3caa8628a74f36e4c4f428e313f

SHA1
2d104dc63b7bc69a0ef88f99ad12a8a6c2dd0f88

SHA256
f9882b7d13d7c16af23b10934e85f805df43aaca1a27388a1f3ce39cae1d4ea3

SHA512
914ba06271e07a9e89021b69eba532dafd29b2d9f1e4db296426395720e27c41bf4d3c4445f85c6627b2510d7bfea608ba29eb7d933ca99cc05a314fd18e0e33

Download Submit
C:\Users\Admin\Desktop\OptimizeWait.ADTS.ByteX

Filesize
1.1MB

MD5
46e2bf13839ad29751ec9cf79199d572

SHA1
cae430ecf656581ba5576f266615ad964e53a8d2

SHA256
66ceb23510b3670007f36230a58e41834732034451d1ffa43ebad3a5e762d355

SHA512
5934bf02623b9798742f9a87997cab9f63b923823a101a95429f8f7c46bce80541489c5e787c851c4b6a867dc0db1efd6609fb2554d0aabba1a7b56737161a16

Download Submit
C:\Users\Admin\Desktop\ReadWait.wmv.ByteX

Filesize
716KB

MD5
601e33065889d43e90ec1c3e8b6b89d2

SHA1
0d91a377f026cbdbc6dc3be79ea6012df67777ae

SHA256
659e38d039dd1d3f0d243084c6afd14ee1e74bbfe8b0927a66a36dac87df115f

SHA512
9d338485d9c03e39ba6d4e8c902bb5dddea24f6a68951d5af79a95b19dc87870f259113520cd859ff5e66e401fc2440cfd4414bc589ad6339618854e60d39566

Download Submit
C:\Users\Admin\Downloads\AddClose.rtf.ByteX

Filesize
616KB

MD5
a0d23609fb17abd7fee2383af35f3bae

SHA1
ba29fd582cd0e2fedbce01f4033c255432bcd57d

SHA256
2c608beff91ea2c428baf4aba34447f221e120df3b9728ca38d9d1e060bbfd46

SHA512
32cc635ab6c7bb0c3653bcf1c90260076b4cb9fe6a07d1230bc22809d7eac69d773f744e322ff2c94c374d6237f47d70b93d2606d1eebe4171884dad285a75fc

Download Submit
C:\Users\Admin\Downloads\AddOptimize.TS.ByteX

Filesize
526KB

MD5
e7a4a47be3f95de4124c4ee1bd1437f8

SHA1
70e8adb22ceed8eaf29708eb74e3135b7c99b5b5

SHA256
4c8667c9a0f71d0640ba807b311351c5db679e8616cf1bff4f12384d55294233

SHA512
81fe4de1b4f1d091d8cb2a002d00fa255a58f14442a3e5eefa3bd2a83d1f53115210091f8e49428d08577167e97fbcda750ee080d3db803c800c941687bdd67f

Download Submit
C:\Users\Admin\Downloads\AssertGet.dotm.ByteX

Filesize
1.1MB

MD5
c96dee887a4760f9ff182eae66c5f835

SHA1
0dfdf336353f77902905524f5d1de019eeb47853

SHA256
76d284cf71a4631732180aa2e231a50e7f985aaff7637a3b912aa87fb107f269

SHA512
769c2c7a9a335ec9c06f0beb1f5b3d3c02856e87da83a57f1efa3f183b897db5a51049f38f1381c5f8611bca9415566a3a22d4b77f2f9382c2ac0ef1e182a19f

Download Submit
C:\Users\Admin\Downloads\AssertStart.vssx.ByteX

Filesize
586KB

MD5
ebc64e5e22841d555caf3e9130e2ce10

SHA1
225a6b38107f4be499772b633d08e8afd6f8eab6

SHA256
4db9996b2ad2ae2758c1d828ac2452e6e3521a1cfe8c1d214fd02be68981282c

SHA512
2dc523a436b708488d24e8bfb4a1dda43abe62eca5dbe642b88753904c0ac2839fd95f4d9e8adccd5d249cd20157ba20194ca36477a029ff663f6986a1ee7107

Download Submit
C:\Users\Admin\Downloads\CompleteSwitch.m4v.ByteX

Filesize
797KB

MD5
a9a86aa7a05104c6ca6ad8d75ede7d10

SHA1
d5130509e6eb5479c82e72d091276801e5888869

SHA256
d71bb5d01d1015d9fa75a266bbdb8b70789b65cc3b153b73390e7b03f122e050

SHA512
7ec721195171c55de80c284a6398a86629e325d28efd9ab041944801a938f077e34ec430a5327661ec1e6b7dbbc34e2df8028c8aebd9dcaa28a0d238c670fcea

Download Submit
C:\Users\Admin\Downloads\ConvertConvertTo.vbe.ByteX

Filesize
887KB

MD5
7e7d8fb0b54d87b7c7ac8dc17a4caab6

SHA1
ec3959d500479aef1704be39edef1ab22399140d

SHA256
a88aa8cce45529979698af0c2c7553197ab52600a32589318f802ffe7aa89214

SHA512
ee20a373fa58479e31d84615136cb9ef43baedaea6b036ef462300763a6a60c3cb48665e25ca47a6bb332740ff06f057c398d130a9e1b04f69b0ec5b84657fdd

Download Submit
C:\Users\Admin\Downloads\ConvertToExpand.mp4v.ByteX

Filesize
857KB

MD5
a2f7f3d478fcd40889d16d85116fb4f8

SHA1
90601215d0d58a960c06a774e0a23df39a28d5f8

SHA256
365e11d59f6409919c2c170895c11873c9a567220e2b8e1b4597112303e750e1

SHA512
cdf36c39e0496d3c98331a1f31368f74527329ff0d79449e001ed0e727c660cc81100a9e32e40bdb7cd082fc828b2548035a6a460f2682cfe745b6f7175ecc33

Download Submit
C:\Users\Admin\Downloads\CopySave.inf.ByteX

Filesize
707KB

MD5
79b2b6a976a4a0be2a0f396e9942060f

SHA1
9e3fc2aef391f2736e6143c8b1442fe767c0783d

SHA256
ef4e18e7f9ac2e9127234726c5cd7637e56a65c786f8984b74871510d6882622

SHA512
db6dcec184a3afc187e9ec8289af0452f8f32c2a7bacde006221d41db6610201c6d62b8680f19b35d6ee494a96c6c1fdd0bcf2190e89756f7a2ca63723b2c1bf

Download Submit
C:\Users\Admin\Downloads\DenyAdd.avi.ByteX

Filesize
1.1MB

MD5
05d1498053e25b4dda7aead9412e901f

SHA1
bc7b194d2696eb5cbaa2d4a573b9c9972aaaa15f

SHA256
66f09618a1f6667bbe23d9eb11fd06348192b77c1d7b12c1af7e2197bb6ea84d

SHA512
7f65efb41eb4fdd23446d5ec7e094b2b535f3cdf7d048ee576f8b51f9062736d11dc1dd86b92a72f7f4d8a32ae822e22be24614268115f993382bb07f67d85fd

Download Submit
C:\Users\Admin\Downloads\DismountRepair.i64.ByteX

Filesize
767KB

MD5
2691e1df6fcf000b7af7817a82f83faa

SHA1
d4b0d4d44120a4c8f28563d2ba80a80ee78d7c10

SHA256
04b0649a64b1b3bc311b3638eea31909c563e03fa425c32b7961c2ea088889df

SHA512
34e37e0069c689fc414360bbd1d46ba321cb5e42d121418318a9b9c59fe8281201edd1b4a9bce8e3fb1f88a4014ad2eb052eb92442d44dff56295940c11b754d

Download Submit
C:\Users\Admin\Downloads\EnableOpen.xhtml.ByteX

Filesize
647KB

MD5
28547dfb9a2368f0366b38cf0f8b88f2

SHA1
96c9a94c08bcd4352dc594857ce0811b5d5e8f69

SHA256
73fbd65619dcf55d708e2ea623ca9a1d586340666f3cd67867006343f4be3528

SHA512
242c7d44eb6ee8e4389f544bbd0c9ccc63c8eabcd4ca6d2e8f51679b37bc6ea783b190ee615241f3bd0385d92cf2e2659865d4ada8f219cafb1c7b5d9116fe35

Download Submit
C:\Users\Admin\Downloads\EnterApprove.ram.ByteX

Filesize
1.9MB

MD5
df83463ab5a4a6b9569bf6b61d551bca

SHA1
c1a4321445d77975fdd550f4b86b3b3d357b0905

SHA256
07915e6709f66cc012b85990c6047e1add7cbdf1bb79f1dc71fadcc49d87a3a7

SHA512
2d4369be6cf9920589d2c0b0f6c5b7b0e3725e76e1d242f0b16bff6bd2543979e9d467a37d09b650cd47ab6dbe94898260aaa3a03b31f408591fd38fd2d1a629

Download Submit
C:\Users\Admin\Downloads\ExitComplete.edrwx.ByteX

Filesize
1.0MB

MD5
caea7fd8be25bcde864e08868b2f3ea4

SHA1
1aed0f8af90dd1b05b2c822defaa70bdcc2016a6

SHA256
1236cb11db21ced9a7f57b5a790c608266c92b592cafcbc11cf05e420d9769b5

SHA512
de26f4c28fbb8e783bb4134e59a9a11e4148f12047c1da74e8f17485652e18de234f547a8c021c7b90d4f6c1a4d251a6e4d8ac1e3f5e919bef27d239b1164a8f

Download Submit
C:\Users\Admin\Downloads\ExitOut.xlsm.ByteX

Filesize
1.2MB

MD5
b2b9e8ea947bbe83402a24d5adf9dda1

SHA1
edc96b5c6b53d7af4c6630150db7171801eef167

SHA256
f326c57bc99bc014fa5a9045a69fdd6673e97c1ad2625fccd90916a8bef28aeb

SHA512
155b9fdc2023dffdeba4e3e721b602cd3b36ced3d1520720df42af2260f8127227e096e868bb619c8d9d1b93a92ca3f63a14f901969bd6bf08dd2cdb56bbf34b

Download Submit
C:\Users\Admin\Downloads\FindUndo.bin.ByteX

Filesize
677KB

MD5
bf1dd25c4ac64143dcdf34dbcf40f9a0

SHA1
eeb950817bec05f6fd473ec937c61e55d723a2d9

SHA256
046a31cddc6dc2a8ec566c95332a0311c6a2c62d481dab1ffca14bbb51bf543a

SHA512
c08c72e291b9bdcbcf75765cf6a009c88bd0c6beac6611a4d538755c87ffcba6774feded65bde7352affe1cb084ca88d50eaea079826f544c7b0c4a4f2bc2d8e

Download Submit
C:\Users\Admin\Downloads\FindUpdate.js.ByteX

Filesize
1.4MB

MD5
8f29c3c7fa69219b5721fa26b6d21710

SHA1
65cbf3175b532b9272e584dc73bc30b4baba1352

SHA256
cae1f2c70e107d65974997087f20280d2025d0faaa6fc007e1422a8ea4b95e19

SHA512
6750f17ce8a3d9902ad6b6787e742825d7e17219b93346af94660ca4bf23274e31a26fb04166be3c254f8bea8eb9cba99b438f8e51766560e3436cb2a6b5b54d

Download Submit
C:\Users\Admin\Downloads\InvokeMount.vbe.ByteX

Filesize
1008KB

MD5
312ac21901c0687fd7c2c0d959c92839

SHA1
df3f5292d7a4d1c7d9a4fa98348445c4bfbe8ff4

SHA256
aa3a90ce39c94a3463cd340bc045a5251e54093797f6ef9e665655c7c62b9b13

SHA512
296c91a2bd8d15700685e2b1490f555fdada2805218aaaedfead1a15fc930171d1abc737f69f5c72c5c092cc2c5995cb0a84da6122c13671d5a84d54cd15fdb8

Download Submit
C:\Users\Admin\Downloads\MergeGroup.M2TS.ByteX

Filesize
1.3MB

MD5
7483a052c2361a6aec2ad84667639a54

SHA1
57b64f01eab665f47d7ed6948bffa0eb8da0efbd

SHA256
2895f63d8df874d4423d9ab1b5dc29b2e42d642acce91ab97e6bdd20caf1f448

SHA512
a39129cc33ec041a7eb087a61ab080f6929431a7a3f68cbf576dbef4f257954f009f23c31f9cac1e6a206e0dd25f3d225a79d3be0f78cd727e643c50539f018f

Download Submit
C:\Users\Admin\Downloads\PingHide.xls.ByteX

Filesize
1.2MB

MD5
a64afd2b5cca0d70d2c72448d0dcf094

SHA1
555a48cd7078ff69ff4b77d20cb507cb15fb2c4e

SHA256
6e44bc033f6a5794af850aea9e6e2376028f8152c0e00eee0dae8719e380a961

SHA512
44f2e55f794173d6224b7bbfd02fae53511c9025d6ead2a8acc6886118ff0ea8afffc184a5e774e40bf96e9a22ac5fd2e56414b35fdcc2c589ef4952cbaf8ba0

Download Submit
C:\Users\Admin\Downloads\PublishDeny.ex_.ByteX

Filesize
1.2MB

MD5
be5a50b9c9c2bdf8a9aaf9d174a23ec7

SHA1
07561827ab9c83e506647e3a8c6033f830367723

SHA256
bc5861aaf30f129bf6f622c021b259500b0568ed718088a9e4e6fc1dc5315b96

SHA512
6b48b391a344cc22c90e9be437ee80a11ed62a06cbd496572f8c3059af4ce6dc18b9e1298592f468582649ea137ca161fcb88cd219588d027067cf947c53dc71

Download Submit
C:\Users\Admin\Downloads\ReadShow.asp.ByteX

Filesize
917KB

MD5
96833ccb1db4ffd09031c592240a177c

SHA1
ee8d02ef0e303496197a926f18360ce38cba8cd3

SHA256
41e6436dff9bf2dc230133b4ad30e3874fe72269602db79766d20e291dc51336

SHA512
4f933a7c1164a36e71fecc2803e7cebbaf30b73c0a6bf680f00e61f5a0d1081cca44339ae6b4777bf07407dd3c1d40a59ed24798368175421010046aaf27cf0f

Download Submit
C:\Users\Admin\Downloads\ReceiveLock.jfif.ByteX

Filesize
947KB

MD5
b4360e617c6d62bb671ea45ff2d7960a

SHA1
5ee6e1dd506e9f32f5a2d7bc0cb79aec32880927

SHA256
19bfd37def99fa2c99ad2377ad42a97a0d8d3d56d065df02bf655dda2afbbad2

SHA512
b9d116ed3705a1b339dfd4fcbf169e00cc32f32e67144eb41abfc1f3e32876dee1294dcda3b58d76f7e3286fab53d7745ac650980f59bcb5eb3737c19f6c823d

Download Submit
C:\Users\Admin\Downloads\RenameSend.xlsb.ByteX

Filesize
978KB

MD5
27133aec7d5ae67bf725baa87a60c66c

SHA1
24be0468e33dc6eeaba4308e16f8f007505bfd00

SHA256
11beccda70a6726b4cc588500ec19a882c2d2db6b76c2e8ebad62b21cbd5268f

SHA512
81258e6ab540adbf5a7b6f0194e612b1fa22eb74ef986346e4ae09ad302d9c1b9fc94bff4a732d19d1ad53ec9738db6258923bea59731a729d0ff80e5e272ec6

Download Submit
C:\Users\Admin\Downloads\ResetResolve.odp.ByteX

Filesize
1.4MB

MD5
b82189e54a32ba3e37f85b1bf6806636

SHA1
8ea3ccab82c0869fc8cc283a7243614f0ab3f84a

SHA256
a66cbd433e396300f030f581c8b71d716c4c8d3cc57ed6d0f6a4159412c07e23

SHA512
7418b965a9ebf2195ab17e7f5f6a4f6e4f991f3beaf835f76bdc174a60397f690f093294031bf9685498fc01394ecc12f9398e2fb983e048fafb35227a9d85d2

Download Submit
C:\Users\Admin\Downloads\ResetStop.3g2.ByteX

Filesize
556KB

MD5
144971ac44e4479531aebe54b2cb3aa1

SHA1
d222634a599590de7802a64b5b7d9f51ebd8481a

SHA256
ec361ec215da2d5f9222fc23ed77bb950c35cf7a484f0a76dc5a7d135a7e6931

SHA512
bf706eee2f29bb396b52a76242f3b54fa6fc36adfa39aed78ff2c8197070378c5623bf43f503a7ed09288173d00c8ac2aa5c9a896c1b001ca2c1095130c6af73

Download Submit
C:\Users\Admin\Downloads\RestartUnregister.wmx.ByteX

Filesize
496KB

MD5
78b3e47e89e46eb4e24df4929f5c1e73

SHA1
dd47ab52b4370cef5b3a9d71d3058acf619cd33e

SHA256
dbdd215fa3fdfeda6e337ec63c4200da666848006f71ac6cede7e2ba084b75b3

SHA512
1deb7425c9f3b4aeed6ab4edcc8d312feb6a566c08526c55cbb2cf83c4ee24b4727747beabf0b79e49082e985bd81c1aef429250e05cc63219ccfa8e51642b90

Download Submit
C:\Users\Admin\Downloads\SaveOptimize.htm.ByteX

Filesize
827KB

MD5
2e160c9ebeab9cf863ae254fa3295e85

SHA1
23975004728c2beb0dcfaac8d5f6f96f0f1c7187

SHA256
ef34bf156c6f7178921f1eb3772034bd39e4a342d0d7b7b9985c7d5dedf2900c

SHA512
19f18f1010ef587be5a57e6892be7e27171547bc0015a7ef51f03e3be4f24bcb67f16c0f89a12213ea294fa1138ef353aaec8b0458c24cf3674a42d0c798e1c5

Download Submit
C:\Users\Admin\Downloads\SubmitExpand.contact.ByteX

Filesize
1.1MB

MD5
7e3c45cfbb711f33a54007f7daf15f9a

SHA1
71d25aa83de5300bbb213e94ea814f46e3e9a8bb

SHA256
b4ee150c813a689086ae9297397bfff3e4ef48981181c9df9a3a888f38c4622b

SHA512
efafd9dc551af5f89227b0d09b9ddd674827532dd3f7a33496d764656c74897ed2e1fcc4964eb003d1deefbfbaa173cd465a88c25ee4fb770b24e70773ef3942

Download Submit
C:\Users\Admin\Downloads\SuspendComplete.3gp2.ByteX

Filesize
737KB

MD5
ca8f4fe3f582269df3a4cb631f21272f

SHA1
875018019c939ab28be1a643f0817ac0ff83b3f4

SHA256
1cc02e523d6cfa3841d64d872680d9ff886f9d2777813da19c0138c760bd4026

SHA512
a7f76734ba19316d69701b1cc2e0bc269927e9ee75ab9410d46346a69e5f23788e739b4d65b6100a221b324aafc38e046d95f022b42694f14feb9776f88ee52b

Download Submit
C:\Users\Admin\Downloads\SyncFormat.css.ByteX

Filesize
1.3MB

MD5
cfa3ce4b6a9b0b54fbfcfcc65ee74707

SHA1
d147b70777b9735c94adb0488eff9646744ae3ec

SHA256
8e56d207ea89025f53fb835145dede0df52afe4ad1fdde38b661c1d5eeb75d27

SHA512
7016974a4514d8fd24ab05262856c993d70c911826876d6582e09a791bc49b2e1a29f4c64dcccf6ea879d6caa9177f8917a39fa5d1392a5b4368714f197d9f4d

Download Submit
C:\Users\Admin\Downloads\UnprotectRename.mhtml.ByteX

Filesize
1.2MB

MD5
fed6f051ba0c67e499abf44088237e5f

SHA1
d4f7a3a38e8692df622aabc240c0787b795698a5

SHA256
a03c3562db01d4e0c7b650bfc2136e9027a7d43e84c37c223fd0d210759beaa5

SHA512
39c12b575ecb0d86de8fb398baf431e16eab968760b7526edabdfbaa58359349d2183ae3c899539d3277091f2c8d16b7192419d366ca3f0d97c41193762d3798

Download Submit
C:\Users\Admin\Downloads\UpdateWatch.raw.ByteX

Filesize
1.3MB

MD5
328f21ee4001e5bf0f37736b64679e46

SHA1
d7cf683a0f2d911cc6837c80fdc316105ced713a

SHA256
ad8367016af2fcf182a575a5e92b52827ec095acd55fa4c99d1e2d1f74c8b38c

SHA512
40a9e2c5ae63b8b9dd0b3c4a4c00ec4de2ed5654a303a9232622cc361ad5dfb534a1bbbbcc5f272027259f07256033befe16da4bed9c11dee70f683d25fd627f

Download Submit
C:\Users\Admin\Downloads\UseRename.vbs.ByteX

Filesize
1.0MB

MD5
1f9ed0adc234bb0ec0edf651a784ce32

SHA1
2904648d8ff55caef988f6744e17c1a78a101a60

SHA256
5f450ef000fa1afe456150f4e55af3699c6aa1801fddec02cc75472d3ac938b1

SHA512
32e36d556662f7648f1f779bfdad40174777c38ec635c73e347737d57d5532b8c239bb1e84d8e276aaca33413fa66cde895b9fcf49bc0c95ea8eb74f998ed9b0

Download Submit
C:\Users\Admin\Downloads\desktop.ini.ByteX

Filesize
460B

MD5
d16ff65e61ae3f6160615702045cc153

SHA1
3e64e65b83dd0ef5e3d52eb23ef050d865bb8d65

SHA256
c79744dd0f230dc3ff7fccdb7d34a78b786a3b6ec1a501880ca0fd829eb77711

SHA512
7cf1d9012dd0123035a279472589404e2b8a397678b6c6fc1d45b59846cd497bc97fc166da9a058ccae0b7f48a39baf0308e26b36ff5a36d5a9ca9feac711c6c

Download Submit
memory/652-86-0x00007FFFAAC90000-0x00007FFFAB67C000-memory.dmp

Filesize
9.9MB

Download
memory/652-91-0x00007FFFAAC90000-0x00007FFFAB67C000-memory.dmp

Filesize
9.9MB

Download
memory/652-95-0x00007FFFAAC90000-0x00007FFFAB67C000-memory.dmp

Filesize
9.9MB

Download
memory/652-50-0x00007FFFAAC93000-0x00007FFFAAC94000-memory.dmp

Filesize
4KB

Download
memory/652-52-0x0000011D5FB90000-0x0000011D5FBB2000-memory.dmp

Filesize
136KB

Download
memory/652-56-0x00007FFFAAC90000-0x00007FFFAB67C000-memory.dmp

Filesize
9.9MB

Download
memory/652-55-0x0000011D5FD40000-0x0000011D5FDB6000-memory.dmp

Filesize
472KB

Download
memory/652-65-0x00007FFFAAC90000-0x00007FFFAB67C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-255-0x000001C87AF20000-0x000001C87AF30000-memory.dmp

Filesize
64KB

Download
memory/3024-271-0x000001C87B020000-0x000001C87B030000-memory.dmp

Filesize
64KB

Download
memory/3024-290-0x000001C8784F0000-0x000001C8784F2000-memory.dmp

Filesize
8KB

Download
memory/3344-355-0x00000264D2400000-0x00000264D2500000-memory.dmp

Filesize
1024KB

Download
memory/3344-356-0x00000264D2400000-0x00000264D2500000-memory.dmp

Filesize
1024KB

Download
memory/3912-317-0x0000020B43D20000-0x0000020B43D22000-memory.dmp

Filesize
8KB

Download
memory/3912-314-0x0000020B33800000-0x0000020B33900000-memory.dmp

Filesize
1024KB

Download
memory/3912-324-0x0000020B43E30000-0x0000020B43E32000-memory.dmp

Filesize
8KB

Download
memory/3912-322-0x0000020B43E10000-0x0000020B43E12000-memory.dmp

Filesize
8KB

Download
memory/3912-320-0x0000020B43D50000-0x0000020B43D52000-memory.dmp

Filesize
8KB

Download
memory/4316-306-0x00000270B1300000-0x00000270B1400000-memory.dmp

Filesize
1024KB

Download