cerber | hxxps://github[.]com/Endermanch/MalwareDatabase/tree/master

Analysis

max time kernel
252s
max time network
251s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase/tree/master

Score

10^/10

cerber fantom wannacry defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware spyware stealer trojan worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___CQFTB_.txt

Family

cerber

Ransom Note

Hi, I'am CRBR ENCRYPTOR ;) ----- ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only one way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions how to decrypt your files. If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://xpcx6erilkjced3j.onion/12B8-FB50-246C-0098-BC6D Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://xpcx6erilkjced3j.1n5mod.top/12B8-FB50-246C-0098-BC6D 2. http://xpcx6erilkjced3j.19kdeh.top/12B8-FB50-246C-0098-BC6D 3. http://xpcx6erilkjced3j.1mpsnr.top/12B8-FB50-246C-0098-BC6D 4. http://xpcx6erilkjced3j.18ey8e.top/12B8-FB50-246C-0098-BC6D 5. http://xpcx6erilkjced3j.17gcun.top/12B8-FB50-246C-0098-BC6D ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://xpcx6erilkjced3j.onion/12B8-FB50-246C-0098-BC6D

http://xpcx6erilkjced3j.1n5mod.top/12B8-FB50-246C-0098-BC6D

http://xpcx6erilkjced3j.19kdeh.top/12B8-FB50-246C-0098-BC6D

http://xpcx6erilkjced3j.1mpsnr.top/12B8-FB50-246C-0098-BC6D

http://xpcx6erilkjced3j.18ey8e.top/12B8-FB50-246C-0098-BC6D

http://xpcx6erilkjced3j.17gcun.top/12B8-FB50-246C-0098-BC6D

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>NeY6VnUHLga3tXpEXKR+z/Me+KEzWOy8MYSxaNmAa3U7xbJp3ZFPersxUdrIjNW8ens1eK+XEtGnB/1PVw1tHLMNKfGKFmG/nJl9QnJz12wclFLRXqRJsEx38xHRqzeNYiR2eQkCz3H3286ErVzQ7JxwfPF9cr1Eu9NuQugJ+72PTDnWztOR2uQiPncyfOke33yNQimqf8qxiVlOkl5PQMNEmB1ZD+kgongB4sPlGncIyuOAZNCz5oFC/ChdZC4CGs3c4aWg9ITNc0tRV7nWT9pUuSqdCS2nhnKZBlH77runDbhd1CsHXC3visv4UgNwhkZbNTR99M+AUR/IR5V9sQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
ransomware fantom

Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (286) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Renames multiple (84) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Contacts a large (1122) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3328	netsh.exe
4712	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	ASYwgAAE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Fantom.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDD4B3.tmp	[email protected]
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDD547.tmp	[email protected]
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\	[email protected]

Executes dropped EXE 19 IoCs

pid	Process
5528	[email protected]
5020	taskdl.exe
1816	[email protected]
5828	JYIEIAAo.exe
5812	ASYwgAAE.exe
2316	[email protected]
3800	Fantom.exe
5568	[email protected]
2540	[email protected]
2752	@[email protected]
5608	@[email protected]
3844	taskhsvc.exe
5136	taskdl.exe
6000	taskse.exe
5708	@[email protected]
4928	WindowsUpdate.exe
1960	taskdl.exe
2184	taskse.exe
5976	@[email protected]

Loads dropped DLL 7 IoCs

pid	Process
3844	taskhsvc.exe
3844	taskhsvc.exe
3844	taskhsvc.exe
3844	taskhsvc.exe
3844	taskhsvc.exe
3844	taskhsvc.exe
3844	taskhsvc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2388	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JYIEIAAo.exe = "C:\\Users\\Admin\\SwQIQAAc\\JYIEIAAo.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ASYwgAAE.exe = "C:\\ProgramData\\tCogssII\\ASYwgAAE.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ASYwgAAE.exe = "C:\\ProgramData\\tCogssII\\ASYwgAAE.exe"	ASYwgAAE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JYIEIAAo.exe = "C:\\Users\\Admin\\SwQIQAAc\\JYIEIAAo.exe"	JYIEIAAo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nlillnkzulmqba902 = "\"C:\\Users\\Admin\\Downloads\\WannaCrypt0r\\tasksche.exe\""	reg.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	[email protected]
File opened (read-only)	\??\k:	[email protected]
File opened (read-only)	\??\u:	[email protected]
File opened (read-only)	\??\a:	[email protected]
File opened (read-only)	\??\b:	[email protected]
File opened (read-only)	\??\o:	[email protected]
File opened (read-only)	\??\s:	[email protected]
File opened (read-only)	\??\b:	[email protected]
File opened (read-only)	\??\s:	[email protected]
File opened (read-only)	\??\y:	[email protected]
File opened (read-only)	\??\t:	[email protected]
File opened (read-only)	\??\q:	[email protected]
File opened (read-only)	\??\v:	[email protected]
File opened (read-only)	\??\z:	[email protected]
File opened (read-only)	\??\h:	[email protected]
File opened (read-only)	\??\i:	[email protected]
File opened (read-only)	\??\k:	[email protected]
File opened (read-only)	\??\q:	[email protected]
File opened (read-only)	\??\l:	[email protected]
File opened (read-only)	\??\p:	[email protected]
File opened (read-only)	\??\l:	[email protected]
File opened (read-only)	\??\p:	[email protected]
File opened (read-only)	\??\r:	[email protected]
File opened (read-only)	\??\h:	[email protected]
File opened (read-only)	\??\m:	[email protected]
File opened (read-only)	\??\r:	[email protected]
File opened (read-only)	\??\w:	[email protected]
File opened (read-only)	\??\v:	[email protected]
File opened (read-only)	\??\w:	[email protected]
File opened (read-only)	\??\x:	[email protected]
File opened (read-only)	\??\a:	[email protected]
File opened (read-only)	\??\i:	[email protected]
File opened (read-only)	\??\x:	[email protected]
File opened (read-only)	\??\j:	[email protected]
File opened (read-only)	\??\m:	[email protected]
File opened (read-only)	\??\n:	[email protected]
File opened (read-only)	\??\u:	[email protected]
File opened (read-only)	\??\o:	[email protected]
File opened (read-only)	\??\e:	[email protected]
File opened (read-only)	\??\y:	[email protected]
File opened (read-only)	\??\z:	[email protected]
File opened (read-only)	\??\n:	[email protected]
File opened (read-only)	\??\g:	[email protected]
File opened (read-only)	\??\e:	[email protected]
File opened (read-only)	\??\g:	[email protected]
File opened (read-only)	\??\t:	[email protected]

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
77	raw.githubusercontent.com
78	raw.githubusercontent.com

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	[email protected]

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2334.bmp"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bn.pak	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\System\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md	Fantom.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Crashpad\reports\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	Fantom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\manifest.json	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\TextConv\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\uk.pak	Fantom.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml	Fantom.exe
File opened for modification	C:\Program Files\SaveSend.asf	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoBeta.png	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json	Fantom.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	Fantom.exe
File created	C:\Program Files\Common Files\DESIGNER\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml	Fantom.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md	Fantom.exe
File opened for modification	\??\c:\program files (x86)\outlook	[email protected]
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hu.pak	Fantom.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sk.pak	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml	Fantom.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\dotnet\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\desktop	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat!	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\the bat!	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\documents	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat!	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\documents	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat!	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\desktop	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\outlook	[email protected]

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
832	5608	WerFault.exe	219
6080	5608	WerFault.exe	219

System Location Discovery: System Language Discovery 1 TTPs 61 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ASYwgAAE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JYIEIAAo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fantom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1752	cmd.exe
2900	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5260	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	[email protected]

Modifies registry key 1 TTPs 13 IoCs

Modify Registry

T1112

pid	Process
5960	reg.exe
212	reg.exe
2808	reg.exe
3524	reg.exe
3476	reg.exe
2372	reg.exe
4412	reg.exe
5980	reg.exe
2564	reg.exe
808	reg.exe
5936	reg.exe
3348	reg.exe
4700	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5728	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2900	PING.EXE

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
920	msedge.exe
920	msedge.exe
940	identity_helper.exe
940	identity_helper.exe
2612	msedge.exe
2612	msedge.exe
6036	msedge.exe
6036	msedge.exe
5680	msedge.exe
5680	msedge.exe
2420	msedge.exe
2420	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
1816	[email protected]
1816	[email protected]
1816	[email protected]
1816	[email protected]
2316	[email protected]
2316	[email protected]
2316	[email protected]
2316	[email protected]
5568	[email protected]
5568	[email protected]
5568	[email protected]
5568	[email protected]
2540	[email protected]
2540	[email protected]
2540	[email protected]
2540	[email protected]
3844	taskhsvc.exe
3844	taskhsvc.exe
3844	taskhsvc.exe
3844	taskhsvc.exe
3844	taskhsvc.exe
3844	taskhsvc.exe
3800	Fantom.exe
3800	Fantom.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5812	ASYwgAAE.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3628	7zG.exe
Token: 35	3628	7zG.exe
Token: SeSecurityPrivilege	3628	7zG.exe
Token: SeSecurityPrivilege	3628	7zG.exe
Token: SeRestorePrivilege	5436	7zG.exe
Token: 35	5436	7zG.exe
Token: SeSecurityPrivilege	5436	7zG.exe
Token: SeSecurityPrivilege	5436	7zG.exe
Token: SeRestorePrivilege	916	7zG.exe
Token: 35	916	7zG.exe
Token: SeSecurityPrivilege	916	7zG.exe
Token: SeSecurityPrivilege	916	7zG.exe
Token: SeDebugPrivilege	3800	Fantom.exe
Token: SeShutdownPrivilege	5312	[email protected]
Token: SeCreatePagefilePrivilege	5312	[email protected]
Token: SeIncreaseQuotaPrivilege	3468	WMIC.exe
Token: SeSecurityPrivilege	3468	WMIC.exe
Token: SeTakeOwnershipPrivilege	3468	WMIC.exe
Token: SeLoadDriverPrivilege	3468	WMIC.exe
Token: SeSystemProfilePrivilege	3468	WMIC.exe
Token: SeSystemtimePrivilege	3468	WMIC.exe
Token: SeProfSingleProcessPrivilege	3468	WMIC.exe
Token: SeIncBasePriorityPrivilege	3468	WMIC.exe
Token: SeCreatePagefilePrivilege	3468	WMIC.exe
Token: SeBackupPrivilege	3468	WMIC.exe
Token: SeRestorePrivilege	3468	WMIC.exe
Token: SeShutdownPrivilege	3468	WMIC.exe
Token: SeDebugPrivilege	3468	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3468	WMIC.exe
Token: SeRemoteShutdownPrivilege	3468	WMIC.exe
Token: SeUndockPrivilege	3468	WMIC.exe
Token: SeManageVolumePrivilege	3468	WMIC.exe
Token: 33	3468	WMIC.exe
Token: 34	3468	WMIC.exe
Token: 35	3468	WMIC.exe
Token: 36	3468	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3468	WMIC.exe
Token: SeSecurityPrivilege	3468	WMIC.exe
Token: SeTakeOwnershipPrivilege	3468	WMIC.exe
Token: SeLoadDriverPrivilege	3468	WMIC.exe
Token: SeSystemProfilePrivilege	3468	WMIC.exe
Token: SeSystemtimePrivilege	3468	WMIC.exe
Token: SeProfSingleProcessPrivilege	3468	WMIC.exe
Token: SeIncBasePriorityPrivilege	3468	WMIC.exe
Token: SeCreatePagefilePrivilege	3468	WMIC.exe
Token: SeBackupPrivilege	3468	WMIC.exe
Token: SeRestorePrivilege	3468	WMIC.exe
Token: SeShutdownPrivilege	3468	WMIC.exe
Token: SeDebugPrivilege	3468	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3468	WMIC.exe
Token: SeRemoteShutdownPrivilege	3468	WMIC.exe
Token: SeUndockPrivilege	3468	WMIC.exe
Token: SeManageVolumePrivilege	3468	WMIC.exe
Token: 33	3468	WMIC.exe
Token: 34	3468	WMIC.exe
Token: 35	3468	WMIC.exe
Token: 36	3468	WMIC.exe
Token: SeBackupPrivilege	4104	vssvc.exe
Token: SeRestorePrivilege	4104	vssvc.exe
Token: SeAuditPrivilege	4104	vssvc.exe
Token: SeTcbPrivilege	6000	taskse.exe
Token: SeTcbPrivilege	6000	taskse.exe
Token: SeDebugPrivilege	5260	taskkill.exe
Token: SeTcbPrivilege	2184	taskse.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
3628	7zG.exe
5436	7zG.exe
916	7zG.exe
5812	ASYwgAAE.exe
5812	ASYwgAAE.exe
5812	ASYwgAAE.exe
5812	ASYwgAAE.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2752	@[email protected]
2752	@[email protected]
5608	@[email protected]
5608	@[email protected]
5708	@[email protected]
5708	@[email protected]
5976	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 1460	920	msedge.exe	83
PID 920 wrote to memory of 1460	920	msedge.exe	83
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 1888	920	msedge.exe	84
PID 920 wrote to memory of 3080	920	msedge.exe	85
PID 920 wrote to memory of 3080	920	msedge.exe	85
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86
PID 920 wrote to memory of 2872	920	msedge.exe	86

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3520	attrib.exe
2792	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase/tree/master
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9111b46f8,0x7ff9111b4708,0x7ff9111b4718
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,4800769909149854152,10977473158837004133,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4984 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4360

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5712

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Fantom\" -spe -an -ai#7zMap4592:74:7zEvent24710
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3628

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\PolyRansom\" -spe -an -ai#7zMap16194:82:7zEvent14356
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5436

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\WannaCrypt0r\" -spe -an -ai#7zMap14033:86:7zEvent7591
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:916

C:\Users\Admin\Downloads\WannaCrypt0r\[email protected]
"C:\Users\Admin\Downloads\WannaCrypt0r\[email protected]"
1⤵
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
PID:5528
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:3520
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:2388
- C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 110001723662719.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5980
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5804
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:2792
- C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2752
- - C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3844
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5912
- - C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5608
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      System Location Discovery: System Language Discovery
      PID:6112
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3468
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 468
      4⤵
      Program crash
      PID:832
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 468
      4⤵
      Program crash
      PID:6080
- C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5136
- C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:6000
- C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nlillnkzulmqba902" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCrypt0r\tasksche.exe\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5560
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nlillnkzulmqba902" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCrypt0r\tasksche.exe\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5980
- C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1960
- C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5976

C:\Users\Admin\Downloads\PolyRansom\[email protected]
"C:\Users\Admin\Downloads\PolyRansom\[email protected]"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1816
- C:\Users\Admin\SwQIQAAc\JYIEIAAo.exe
  "C:\Users\Admin\SwQIQAAc\JYIEIAAo.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5828
- C:\ProgramData\tCogssII\ASYwgAAE.exe
  "C:\ProgramData\tCogssII\ASYwgAAE.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:5812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom\Endermanch@PolyRansom"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5400
- - C:\Users\Admin\Downloads\PolyRansom\[email protected]
    C:\Users\Admin\Downloads\PolyRansom\Endermanch@PolyRansom
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2316
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom\Endermanch@PolyRansom"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5992
    - - C:\Users\Admin\Downloads\PolyRansom\[email protected]
        
        C:\Users\Admin\Downloads\PolyRansom\Endermanch@PolyRansom
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5568
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom\Endermanch@PolyRansom"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1644
        
        C:\Users\Admin\Downloads\PolyRansom\[email protected]
        
        C:\Users\Admin\Downloads\PolyRansom\Endermanch@PolyRansom
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom\Endermanch@PolyRansom"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3844
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        8⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4700
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2372
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        8⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jgYosIYs.bat" "C:\Users\Admin\Downloads\PolyRansom\[email protected]""
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2092
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1960
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3476
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3524
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2808
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sIocYIco.bat" "C:\Users\Admin\Downloads\PolyRansom\[email protected]""
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3976
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5088
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2564
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:5936
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4412
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ricIIcks.bat" "C:\Users\Admin\Downloads\PolyRansom\[email protected]""
      4⤵
      System Location Discovery: System Language Discovery
      PID:3816
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5632
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies visibility of file extensions in Explorer
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:212
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:808
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - UAC bypass
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:5960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yGMEUwcU.bat" "C:\Users\Admin\Downloads\PolyRansom\[email protected]""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5588
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4076

C:\Users\Admin\Downloads\Fantom\Fantom.exe
"C:\Users\Admin\Downloads\Fantom\Fantom.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3800
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:4928

C:\Users\Admin\Downloads\Cerber 5\[email protected]
"C:\Users\Admin\Downloads\Cerber 5\[email protected]"
1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5312
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3328
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4712
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___8S8D_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4856
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___KRHEF4S6_.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:5728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "E" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im "E"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5260
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2900

C:\Users\Admin\Downloads\Cerber 5\[email protected]
"C:\Users\Admin\Downloads\Cerber 5\[email protected]"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:5552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5608 -ip 5608
1⤵
PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5608 -ip 5608
1⤵
PID:5524

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
616e7850d89882cc82301e8e06ccc261

SHA1
ac7569d5083cdefc8b6aa9256f37b225b19385ee

SHA256
2cb39bf12939f6e0a5221fa1ec660afaf7df9339f1f85afe14f3084a4b142652

SHA512
a5448d14057de41dae158952ae3279da6e219fa04e04c35582a1e95e4022115ddfab91519e3e062ea15403b144bcccadd55b0f52a7f2caf31ffd12097a177212

Download Submit
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]

Filesize
696B

MD5
ad90cd8724466f447b17bc497c00de8b

SHA1
52d6613f8a2f8e65290e797dd54645ea910123a6

SHA256
7829e03130893f73bbb01e66f35db1e474a18536d0149bf6b3a35cd89e303b6c

SHA512
8c2e94fcf6c6682dc54fd01151ea305fb88773b368f5b1ce040962759a1130fc95154f35c5186f3657b288c12585740b4ef5b5ce90733422de7cccae9f2861e5

Download Submit
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.exe

Filesize
320KB

MD5
6dd715728be35713172229c3db73b451

SHA1
dd24091d430ee2f0c25548ba0baf23ae83cb309a

SHA256
7b7f0cccd4e3a3902e8f2877b660b45fb9eadb5e46dc694576b7cb6c6b117c72

SHA512
125237d475121eb2b1aeb6d111eda0c6fb16f9858bd843877bc264be287121af8c148b8398bd47c747f03a0828d37b91d55d88dd86777b8990d340042d198da1

Download Submit
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.exe

Filesize
240KB

MD5
ca367eab8545a7d2f99dc7f5c555c686

SHA1
1aad032999bdbb178585ee0af0e09d08da69020f

SHA256
f1e81ec8f52e3e31f7e3b4dbfb5c359ed7df77e0462855f2d7b4d9ec833496a8

SHA512
7dca000b42ad1119cf99f2da8e95d56d2a1edaa86ccc227bbc09bf8397881ef7d7c74b912ecb70ace9957cdc6ea37f49599e54d10164fdd1f734a2131e45405f

Download Submit
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.exe

Filesize
320KB

MD5
8d518bfdc3c7affcbd31169c671d5e7d

SHA1
fa3b5c2314a390d8730f65fd58b0a8ff7c3b0a94

SHA256
c152f088c5357eccfffa51a5d7abfc56e1d0883a7cbcc570f453f0d5b83750fc

SHA512
b058797997a862a9ac3f307cdfc853607996f571c8c285628e32981983457e9874823afe9e98ff4640aa6b387b05dfb080e914ad323a43e8e546db991a9ec7f5

Download Submit
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.exe

Filesize
211KB

MD5
9db420397608fa6b2ff86e5a7d1b4846

SHA1
0126969eda032223b01668ca990b39e1c9064cfe

SHA256
91110b0f0324d819587e969f609970e9ce1ee5c5bcca53e0ae21edc767a4301b

SHA512
ac677dd56e722ee6ebb918a77a70950d3219ee43a32591568ba67197d1772904fc314580e5f0f583f95994c9d14fcd5b66ad40e8ac1d17b771a76aa8ca9e0e36

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.exe

Filesize
207KB

MD5
04cf1cda6372062c4dcdaf47c8b6950f

SHA1
bb7a89cd857a433545d5e74e61915a113bc7f7a5

SHA256
7639d6bcf71ad1ebfa8fcd1a6917ef35bbf394f29f09ba9169d5678cd1d26947

SHA512
c32d7d38e67df88afb9807f6e9cb3a6e8603c15a73db4df534b3a6fee55718f3c034b36c14bf7b2ae07480365d02ee07ed577bb38f9d64e6f8efe0c29bef28b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png.exe

Filesize
207KB

MD5
5bf305e9de30efee55a5e8e28a97114b

SHA1
7bc06bf3b394cc973a2e358424ab74534284e116

SHA256
fc9c661eef1e0ebce52558f8208a185deeb0e80daa50842fad7518e77370ecaa

SHA512
1fff076701dfbc73d77231879e597e0221e3dc926158e1831a94b314e4d46403bb5d5923f4ac8f4487e4b951c892bd5954d5d30ffa0071ffa7001bfea63071ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png.exe

Filesize
187KB

MD5
cacec7123e1cd79fce8001ba90337ef3

SHA1
1cc590544059030b596add8a4c5c22a376675ee8

SHA256
8f8484c2799d8e30a451d9f086bfe2bf944757d7c921705271a45dfa87618b86

SHA512
a292afff6bebc5c26cea883ab2c4334ff18ce6995720016865e6d5469f1d888f35692fcdc5d8243ee2936095fa6de9807ce46165336732f61b2d490638bd515a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png.exe

Filesize
207KB

MD5
fb74ea5611e28ae3c698d618e1ccd464

SHA1
0c060ec1c839691b993fac64dd1df3e458153ad0

SHA256
2cae79c57d904570b8e24872fa12653c38ac6e3e91786ccc6bec4fd5d9a9753e

SHA512
a9bb5e23474cf179f84a67a963515375f7665b85065378131b5971dbed989cd494455b09b9bad0f9a55005005669c4ec799fbc90831c9de30af164c1063fc9d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png.exe

Filesize
190KB

MD5
a3e96f4fec53ac6fd8cce02c54c3c3e4

SHA1
d6d74142c18218a7b22b00441b47a7f5ac3afa24

SHA256
c571ab74ca646028fa68552ea34e0d782d292e240095031dc690fd510a38e236

SHA512
a1da13f999598302e426b6f6307ad8ca8ee7dc8f17a79b62a0ebca0a65ae9246da83dbe4d5557e4e91c1098ac82d316de72eb7ddf357d032245d50f72cfa6aba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png.exe

Filesize
207KB

MD5
53f4197735b97827ab88b059a65e05ef

SHA1
e2906e5fe329401f7d9709a1e689a2d0fbc03bfe

SHA256
ccd02e33fc6e85a191966fa6b20eec2c1dcf031e5841981a0e1866943b46b841

SHA512
0daea81226a4bb5d5c670369c7f6f888b5b6216b78712aaf9cf36c4ee6a884fe6873cb2339f36760b9937bde949266fd29f9fa7560df44df0419bd799ff77a7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png.exe

Filesize
203KB

MD5
27ac1c4ea1d5d272ed12cc97fbbab647

SHA1
08ebec68de18b5617c300700063f0b8599fd11d3

SHA256
155dcd25b335d4ec2183bc6705c439b4fccb046623358bf792be97229ef5089a

SHA512
8c7472c0e7e916ebb2ae2978476b62488fe2b946da499a9d74769218f33a31d1d33a8e2d7a99f4fb078ce0dce467c7da57ff5653c63f05d93e24a3796d5869ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
21KB

MD5
7715176f600ed5d40eaa0ca90f7c5cd7

SHA1
00fdb1d5b1421ea03d2d33542a4eaf7ac543d3d0

SHA256
154632629a0698587e95c608e6ed5f232e2ba1a33d7c07fea862a25293a9926e

SHA512
799cfee1969b6137813c98b83b90052c04527b273156f577841b64828c07c4e6a3913a6ddd49ae5021ed54a367ddbc5ab2193226960b0ffe9a618c663c8d8a1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
37KB

MD5
93acf02790e375a1148c9490557b3a1d

SHA1
78a367c8a8b672dd66a19eb823631e8990f78b48

SHA256
4f2513f353c2cdd3177e3890f216ea666e4eb99477a56a97ff490f69a9833423

SHA512
e6354f4e4d35e9b936a7ddaebdd6527c37e6248c3f2d450c428903a32d77439cab78020a45834379cf814a79149c3dddf4e1280b9d06a7f972e5f8e61c463d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
37KB

MD5
a2ade5db01e80467e87b512193e46838

SHA1
40b35ee60d5d0388a097f53a1d39261e4e94616d

SHA256
154a7cfc19fb8827601d1f8eda3788b74e2018c96779884b13da73f6b1853a15

SHA512
1c728558e68ed5c0a7d19d8f264ad3e3c83b173b3e3cd5f53f5f3b216ed243a16944dbe6b2159cfe40ee4a3813ca95a834f162073a296b72bbdedc15546be8f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
20KB

MD5
c4b8e9bc1769a58f5265bbe40f7785ef

SHA1
07ff14df16d4b882361e1a0be6c2f10711ddce50

SHA256
2786986a3139e9722e667f81b4902609a4cf458e1c16206cd11feceee0254192

SHA512
a39157460b523ee2b9e1eacccf7aed99ff002767a8f87287c1c4662b6711b97f7d4955df64a86a882417fe71e598719e3934e14f787c1e6b3348c8a4c813e3ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
57KB

MD5
919d13ecf08e3da7e9f337e7b60d6dec

SHA1
3d9bd4aa100f69cf46ad175259edd6ce9864830c

SHA256
9d4575044d2efd5e90503beda65571b5158a3f32d999191ac1f82d1a5ee62ad0

SHA512
98d8236ed1c44826b4489b9fb7b76c62502a032547374446c53dcf2eee2f5fe3548c6587fce66df9d075294bc2ab6be97c3cb21457bc899451ebd3b476715985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
53KB

MD5
cfff8fc00d16fc868cf319409948c243

SHA1
b7e2e2a6656c77a19d9819a7d782a981d9e16d44

SHA256
51266cbe2741a46507d1bb758669d6de3c2246f650829774f7433bc734688a5a

SHA512
9d127abfdf3850998fd0d2fb6bd106b5a40506398eb9c5474933ff5309cdc18c07052592281dbe1f15ea9d6cb245d08ff09873b374777d71bbbc6e0594bde39b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
137KB

MD5
a336ad7a2818eb9c1d9b7d0f4cc7d456

SHA1
d5280cb38af2010e0860b7884a23de0484d18f62

SHA256
83bdfb7d266fd8436312f6145c1707ddf0fb060825527acfe364c5db859887a3

SHA512
fa69455b3bfc162ab86a12332fe13322dfd8749be456779c93a6ab93e1d628e246a31a0a55cdba0c45adb3085acd62ba0a094b2115529d70cb9f693f3b1da327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
23KB

MD5
bc715e42e60059c3ea36cd32bfb6ebc9

SHA1
b8961b23c29b9769100116ba0da44f13a24a3dd4

SHA256
110ccd760150c6ac29c987ee2b8f7c56772036f6fe74ff2fb56c094849912745

SHA512
5c0edd336a6d892f0163aa183e5482313dd86f9f5b2d624b3c4529692d70720f4823808f10ee7870fd9368b24de752b343570419fd244c33ad2d9cc86007bedc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
73KB

MD5
0e0f3f847752487c6f77e5ade50d7bd9

SHA1
d2b5a5826e94eb9fa01a134dc892f00eb4123348

SHA256
ceeef0e430847d4c7f01c8714e869972f80215a5ccfd1bc7154fdd3648079145

SHA512
eb49ec26623f8136b18aff064b853e0fb4095dea8d7bc9e0ee096ec89ba13fe0057300392ac1131f9aa13c9b06c622e34f1e2ca176f7d92f16e81c21bf577b56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\08367b3179c4da90_0

Filesize
1KB

MD5
54e07aee6839f03de8c46cb3d433fcef

SHA1
64ff620bbf23764292b647133cb389247f81446d

SHA256
be1d1219999e8b454084898ebf7da145a81bee1fe6816cbdc0c8fec3d335cb2d

SHA512
6aed902d8703ebcb3e2d9eeaa3a43be7e02dcb0f8ae999910910a944e516e205e68ef0ec444576b9a83591046698dd2e3bf9c8909c57fd97594bda6572dfd2f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0aff8554a08780d8_0

Filesize
1KB

MD5
7d3f6f17b0054d21a38463cfabb21978

SHA1
79a2881d0ed0b8e3e1b0951665c255a825b995b6

SHA256
ee9682ece6e2d96efe38bff491bbcbd15a6d5b322bb9241945deca939719f97c

SHA512
766ee130c9c4fb802a03d2dc7842e24cfbeaf9da4ea44a01384ea21fae83cf2397492ef85dc4fc1b2673906694fa100821cadce348cd06390d537309fa70e682

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\115807c81f46d2fa_0

Filesize
4KB

MD5
6e212a64c308254fb1d44d9bf41a3ab7

SHA1
e0b56e386095fce64fcbc35cb5831838b9cfd72b

SHA256
e872d6a9c7cc154f67a980894c5e36b3ec1f8269ec501fc68fe37d18723827e8

SHA512
5cfd8106d1a26fd36701f12ad8a99670395bd9d4023e21d2d575bfe4afec611bfffa2a0b64470c363cd109361817aee3ee48aa1fb8461cd55b23cb42dd8904e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1b10c5824122b84d_0

Filesize
2KB

MD5
b55a7a5575967201d0514394600edff1

SHA1
b6fb041edffd5c1da34e8178f74e087797554c41

SHA256
31c0fe666c95299bcea44a5ea07592eedf8fbaabc3d7de164590eef7edf1158c

SHA512
d2d5f04ce0b301b90c76ce55fafbdee5a08ce4d620b3f583df2f9d6f8b4056a92fea51543794c209ce06dd09addf55388d818656a843be7b48215d88f0b8bcd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1b656fe85bc43465_0

Filesize
1KB

MD5
3beb97f4c57d100af157aeb357fc3cd5

SHA1
474666493bd4b139ee15b79e79eee28d17a4a404

SHA256
74f617e5eb61d3f2fef29f16c504a60e2c78c10d499746e7af4429c7ada166f0

SHA512
d0c5c42563fe0dced7e9394d8f27aeb3d24c93ad6d4bbb3a63fc6e77058dc3bd26f4a2d8c24573a803670c64faf240d8de56a9fbddb659cc4623dc871a1c4151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1e54725c590c3137_0

Filesize
1KB

MD5
73e0e33d56ed960b2d948b8473e68e71

SHA1
52ef14a444158c9de6419de0c26d65562c1e1b2c

SHA256
70bee069fb28ecd8b56d70f450442c3143578eb202ddf77851c09797d0e40e98

SHA512
0178de05a58cbc54fc7a16a7666ce422690e1de7d12f5fc53f20e8ada1c5032d29e6a46ac03d73b129e15dbcb310c86a7f425aa1b83e55e7e7190e0168800ff1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1f09fbf9f0dca9c4_0

Filesize
1KB

MD5
6eae33c0c0a03a911d059fe347241720

SHA1
b175490809042bd961b12de2e58754c294ac96d4

SHA256
1ac0788588c3e92062ea4752e3dbe2277fdd70e407e9e00c244a087653e31bb7

SHA512
2262ecd9106b492827b8360bd43b7b023acfad6c8b23752cb812317032cd4be176d1be6ad5596b630fa3ded051153b8e08fc1b1c4fc4300bdb56de16efa9894e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\202ee61178b3d1b4_0

Filesize
2KB

MD5
c423740b6c8c3443bf6fe19ec3924018

SHA1
d5846518da1e8026231c85d81db9c4ffd82f603c

SHA256
f8456f24596def7f3fa7fe8651d41c5d2660300d96daef89933063fe46bccc95

SHA512
b2e4f971288d12c3280a4c452609ca34d87fdbbde7c5ebd8bce0c7633f8ef9da41754053526b1beb74e1935816b2714df1eb3b7037274d761856767c1542c10a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\20dac1bd8ef32ebe_0

Filesize
1KB

MD5
8ec4e3b5d19b370bbf817b721210edf1

SHA1
1a15b3b04f9a570cbbd7c443934fee8767af9c03

SHA256
9ffdd5d8f4589b57f7b627e3f2ebf55b0c65ff7873c513f685a78ce4e89226d6

SHA512
c22bff9eecb0fd55ec843c8d596e416681b180618ec6799ced5234df83a6355234040798f82322c8172dd6e46b7d89cb8ac6487077ddedef9db766c10a0bfc1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\223785267ad804f5_0

Filesize
269B

MD5
067cf0905ef9f1302e186338b817c05d

SHA1
ab8e124ae88b551fdbe4a2ca6028624c43c736a0

SHA256
a19e0124c1c70ac144f860f82362a7442e42046a1ef6c755fa0870ebd45aa60f

SHA512
98893d2ecc0dd9273aec42284f224f57473369961441411f3b0e7f89cce63769a38c5f101e32c029db5ba0bfcfa61bbedd705ed1bd008ced9a077bf17e2e3bdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2ced246d98cd3678_0

Filesize
366B

MD5
ebdc1e1439c2a64d15102838c35f030c

SHA1
c4f9c8e2d65ad4c66185aaa15fc023da1b78fe3c

SHA256
c8337aff8f26e8e501cb4f57a5c5bd17367d8ea5149adae84bbbd257041772b0

SHA512
c38138b552549894ca2aaaf3153834f72278beba00ab56ce3aef6c8979811f1aec6a244191e3fab697e8a49311dc3e7554793d5964ad4cde77931ad1ada96e8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2d9c813a0dcdf108_0

Filesize
5KB

MD5
d2e27e4039cb65f15dfa1958850893f7

SHA1
05bc02a796982c45b02002ad837b2bb186cc184e

SHA256
c519e63b9bee06d3a1c8c2f7a69d3454d139bb13b2157af65507e5ee9bf3b81a

SHA512
d3684eabeb9f1978e93d890a003a4100ad2e0366dc0cd93db77b24a0eff55db0ee0a31456fdb9310965e957dd1d7cabd57952eaaff3f6d38e67c66e79d1cf78b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2df2c057a5731c19_0

Filesize
1KB

MD5
8935ae326e6a6773b63110d78933318d

SHA1
207b4c0b0627e340cff5bdd1a621595197cde892

SHA256
b739cca4e70e86666d696091b53afad20d8ace1378fcb6298fb72a6f627eae55

SHA512
18ac38326b238403392fa2f4f53ed7fe9dc735f33ac25c39d0bd58c918e6d8f275fec8119d45ec5fd685c3bdc3195046f83df25143bafd257677e24fb825acf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\31038a3a8184fce4_0

Filesize
146KB

MD5
704ddaf9fb28736c6b0febad533e9ce1

SHA1
1a9e34d0f0c642eb031e3314f3aee03fc92148a1

SHA256
f9b8b6106a65fc4b14e085f9d41555e9572a399ba35d8c556e9772cc767b89a5

SHA512
e6c9d261962b9f5f5f10c6b84339b69414298879ba56f4b3222581e84e310239b045facbf60df201fd937ceb5e3f4610fad2442ea1a0eb2eb019f66f582ac484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\311f97ecf058f007_0

Filesize
1KB

MD5
4d2b65b7c1cb2cb60d108571fea666a8

SHA1
4de56c6fbf66429994ab22776a472f6a94810597

SHA256
137bd230314a0a21c5e01c5ff25c61b0ce79491b87c491e12fc049d7e8eed313

SHA512
1bf312ffc2cd23cc37e0a01c8e7322f374c139a3524f46b0668730cf30c4bc5e8c843d28b4d4acadadd023141f7504cf8a1036d13e2df88b3f9070ae34fb1d3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\369eb01682225f64_0

Filesize
360B

MD5
94df4d07bf15484b8ebf041bffa48899

SHA1
42d7fbd52fd15c71ae9cbd7b3ca9e1100fcdf427

SHA256
a11ebd6f27c5067e365544696ddd41bc412a6631688986d992d36db918446717

SHA512
7e7b8dc5e9470273fad548432af17e00b97f7980f2e5373e5d2e8d08f30cd1706bdfd41292e94b4e704b8152aeb0114499b28a1a255ddce4e893f9a8fc9f17f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\37ca16582bfd954b_0

Filesize
2KB

MD5
f2ed06d62be68789aafa0aafd0abfb20

SHA1
4cfc64f044059eb8dad4ac3354b515ae6e8b107f

SHA256
5e11ff97996426ccc4e52a0ba48e0702d10aea5bf1f6de402d91e58a3487f401

SHA512
03d6b71fe7a040900b898860aefa21ac3abc2db9718deb90d86ecc417b09e5d3226a53ca6b8cd9766ef3754fd38eae43bfb0e1639e51f4d5937cea7ff42d1bfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\39f1b8ad3a7dfa7b_0

Filesize
2KB

MD5
464662ec28cb28e3693996d36cf1ff6d

SHA1
184e2884add9db428a16f39c33a04978735fbde5

SHA256
ab7af064c57f5aae8e899104647b4e1d4b89150abee149726bfcb48b6d65a71d

SHA512
4f7cd4f794171dee2ef9ee71fa0d59c3746b5ad3e8c5d3613efa0753f65aaa4eb1a9b0b7c52fa59fbb06f4556e9145c439ca7a45307915d0a405bf19c3a8b6ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3c0976e826452b12_0

Filesize
1KB

MD5
0d61e1120302458f96b5c17642beba1c

SHA1
b24bea467a45b58e0669e114785fcd863cd1e530

SHA256
b6f0e63bd4516d3759fd435ba1b2c66656b7f5a6e55b3ca4fbba5add15104d09

SHA512
8881201bea8da02954ce67a0fa06f0616239fc5bc7e772ab0df4cf8e760a542ca6219a88f273cea9768aefb758c95ee1c7e5ce00cbacd932441c1c6a9c6b276a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3e757ea85c28335f_0

Filesize
1KB

MD5
4719f8df7a944def66f788c08528fd7d

SHA1
962965d913d83a4f0a06656e04f50befa31d6e8c

SHA256
25533be77d9967a3d8bf8d36cc573093d0d760d7ad4ac6ee455076bfb93c0777

SHA512
641127d097d7b40764564b8a220f733bf3914aeb1b102e5a9c74b56824ad1c2622a9289424e0424601b17a48807e85e890a2932585a9790e5967d5a864d5d2f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f8b23cc82f2b2e7_0

Filesize
8KB

MD5
2297c7ad35e0def51f997a53f7b19af8

SHA1
39799f804251fda1f83c8f4c9e6c2a4fdc29e725

SHA256
a38b3d9c0092c606ea584d9e90d094e1270119b1afb73dc8d062b90809b33cea

SHA512
27c136325c3dda3c2ba42ad4da6d46fb4e8e0db757b6daa3ad70762f3b4dfe1f9eb423d795bee9c454281186afccbe5ad42d8be41837369b50cda61511b22bfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\427075385d94c9da_0

Filesize
3KB

MD5
5157db938d7c08458eaf817de52b67f1

SHA1
3f4592457cba5575cec16f90ed9d696b92c44d2d

SHA256
37553cc0de94e7bcfd7e582c4173fd1d3540492fc8a0477e29ae261f0a586ae0

SHA512
dbf098f739d2a4c99958cba2e4513e95cfbeeed723dea63b9a3fb69ea51266aa2a7ee8097b3c48fa2e369b1509b6d88777b13f735f046532d88d1f22f9c2669b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45ef484a783af53f_0

Filesize
1KB

MD5
2e865987d2dcf7fc31d7527d2b749ea7

SHA1
d39242f548d884c4aa8298733b835e8ba9efce2b

SHA256
9e5f61cd31d2e6deb467e7d0434ea487daf059e49813dbb7c4d7a3be83c7c64b

SHA512
fbd688c3db26fd3917c1d60c8982cb5167c1257b932738276d2f1b7736faa4e9cd933e28fa837b4e80bf3a7f2da9763853ed1da2b88f7d07fcb80a88aec4e8af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\47f1ad57edb8b6bf_0

Filesize
1KB

MD5
a1ce615e9fca7c25f1a37c8e407441a6

SHA1
6f227bae916735bfb1293fd32aecdc085b4f8692

SHA256
b82c6e1329037830540a0645dd03dd5eeb9040284620a60ab1719f367da8e335

SHA512
b362555931b2efd8fa74c0e3b5865c6637e54d3bb3af8f7a4a822abcb12b00f5a777c0cb159ea43a7e9a3272b1650382e735b0a429a80a80b529b4d8c55e4229

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\499970c64aac6bd9_0

Filesize
1KB

MD5
b079f35615702e82fd76fc6dd61336bc

SHA1
60a71c1367c5ba50186cb856eee167b09277c4dc

SHA256
a61f98d0a8c221ae91c7767f0f3fde2eec824632644789bbdfd72376e58a02f9

SHA512
3ecc13e1fd7fbf2a431fd059df91aa0fec2b394f120a7da2ba3896537b6b79e9af4dde9f8a1e11398d21b79bd94cd3cb1bfdfadf89855f31bd545cefb969405a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4d83a4223025e5a3_0

Filesize
4KB

MD5
e95fca8fc40a128db580e2c9c7f2f314

SHA1
2f8043ec641560712b708144f5606cb3b9b01570

SHA256
7da96170bd9f0f7e62da8f76638b31182ffd3679c3951b9be4ff3665dd6caba9

SHA512
fa24e9f5ee36d574b05a94d4a8c18e7a685fce25a40f05abb54b9744253c0023ec153a914bde39c482fe8fc1a223b945d18ac113b7c9c3b1fbb7052a900f556d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5096bd761e7a735a_0

Filesize
1KB

MD5
9133a1f35dc5526ccf564c10d9bd09ec

SHA1
4f4e3517360dd089ce4b79d901c2d1beac2c224a

SHA256
c66e98dcc4d07d1fe9dd009cd0aba85ae26442a2c513b6a55ca15bd2f425c7ab

SHA512
7c998e445574a3630b577ae3441e2fcd60a3653a521530b0e72dcbf567707eb7a62fb4640fd9c6a6a7d5694e4aca2082d5f104dad4b0b743e4ce624d420f7c3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\50caabce6b6e99be_0

Filesize
3KB

MD5
a649b4f1925bfd287aa157154085d1ab

SHA1
fa2c061ba44ba223f8650ce7e2aafab30f3f6fdd

SHA256
f1fc25c88dcd18a99042528657de6115b7bfa441addd4ec01e57ff5eb282033e

SHA512
8ff7cd2c65e54067e58562b2ca912e9d7968b0b563dcf3ee4d8738d5de6321844829b2a91f7671c5538159406657886450dc2b93d4906c86f51829d71a5b6b39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\51b3cd7345d9e3fb_0

Filesize
1KB

MD5
ca7a3635f26333cc37035482c6b12475

SHA1
48e45b553bf4e0dec4a7b60fe462f0046f58f4e8

SHA256
5ba96c4e3d2fb9e49660e0b5dc3dd51b79b6d395fa670b427f6c227eec326e0c

SHA512
c23f4d0d31ba4da6c215a629ca17be27eee140c93436c064eb4ceb1800e6f9b97db57d0c49a22ab7935e20b5896cffeabf4cc77cef9e2d89a16e6092b18467b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\552e9cab9e32a74c_0

Filesize
1KB

MD5
29e5ce390c1d1669b0702341b07d1105

SHA1
f9e4f35e6f1a0b952f533a6f39a1a07c7584c315

SHA256
589d1bc66b050197a461de6bf6e3b761f7e794a0e06b12b406357b564a1cf7db

SHA512
87073a802eff8331cce1935fc42282095cfe13169b9acd2beb98aaf4feb43683a66b9b82af71a7ee7e3cf8b2376bf7a746f4f3a267a8fe5d2ddf6d52eaa92869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\56858010a7af1199_0

Filesize
1KB

MD5
f55e5f41921d656fd318a4edfca1d94a

SHA1
c3b5356bd67879ba66b9018c1e355389eeec4fd2

SHA256
d599ee009d37bf7592c956704fddb4e21485cb73cf356ee880cf827af1d0b820

SHA512
793753461e01c8e5befb8c859c787f417d11e619b060ba98c0ba6eed65c18724ecd6d23699fff975c64e2b7da90156c226ad954b14f0558ecd847b65d105129c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5b044bcecece9bfb_0

Filesize
3KB

MD5
609749af0b7f4e7a302a75d817997f41

SHA1
99e8a6e57abfe0029f95f78f8c66226695fc4e32

SHA256
e1967205789338f43183140beb26b5d2defceb273e3ba20d5537500125c605e8

SHA512
e5578aca0b0c4890cd73dfed8d19389c0ed868e4d1d2402c91dd90bd5906dafe379f5b7c8fe08c925e8960219deb57f5b6d97076a1f02d7536568af58a4a043c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5df19512b232e76d_0

Filesize
1KB

MD5
926b4f4a4d92b46d66cb2133c38a7035

SHA1
5fd49fc811ac70547807e09bd47193d1f8bb3806

SHA256
6a7f8ea51280edb206b75cad817d7fc88d6abca004ebf1a7d5eaf8f05cce5fbf

SHA512
afce1480113d6a0da2d86cbd893e0a29773b82320c4fb7295782cad4913e3cd185dcf39eadce8ea36a6974b1a672d7c290a1f4e5ee7d2f98b72735c3334cf693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\65029c17e720c1c5_0

Filesize
1022B

MD5
6b6780bbc9dd982b28dde22468076686

SHA1
158cb15dfb22499bafadbff35afe9f8e0a963477

SHA256
8267f99ea0f9fbf367b58cd1765f4d84d3b903dc5e7c464cd5f1f4a4c346fef5

SHA512
6cc8de37951d68837dd15b27483e0d7bdfc972a0e0fe439869ff1e77e817310265be9875f6f78c6ba2a9f0569cca03a6266d4d4d840ba7b783c5dfc7387e9d89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6870cbb9284d54e2_0

Filesize
4KB

MD5
83b6b5536e3347e3d2a61417e7830869

SHA1
eca01f3db9d91d8c03766232452a20fe51d71cf3

SHA256
0d95edb807dfa7e125ead36ba3d9364a551061d20daa9029f8490660d9b4f47e

SHA512
221beba9b7398d226f6f3014f9a9ee65fc9aa4fd4915ba5000a5c41832482d0a41a876538212b94666a355908de8537011379c1d5ba4d962a11d30d5b084eb6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\69e2fe0a78cb50ac_0

Filesize
3KB

MD5
34d3fed8c349c32598cf09ae88a5e5f9

SHA1
ee11d9993bda6aad85ad473b564b6779544ad1a0

SHA256
ee5889e717b74d84c9fb6257917d32c05a23a9f8aefb7e5e437282dd6d750747

SHA512
c1b96e43e8cd6edd43f68ead1e1a0bb620b9a40570a1392ce1cd9a03835e21b627e4ab892d775b82c8a058f83785393422ef847a2345e930c97aca413fb5e10d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6b08cd0430bfd81b_0

Filesize
22KB

MD5
395ac4df1f14aadd7ec2c5725a0a79b8

SHA1
ede757859bd813b5cff1eb7b6fbc83a3ad1222ff

SHA256
4cf63d93ae5c2a7c8b152b88d72186646429c0cc794b068f85d5225d3808639a

SHA512
f9825a76465efdcf968f1dca1f3b285fa3d6dffc12a4e72505893b966d19174d06856ebc6b041842c60ab2455ee71be816c5f85bbf9b619e281f3f16547903bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6b335498d880125e_0

Filesize
1KB

MD5
c4be3ec67b8643d5b6a787ba13250cb5

SHA1
2ccc0761ae8409e9c325c35b34197fdb4894c113

SHA256
b02fb4d48bbd35fab28a5df0f071fca843b085bc565c5df74ad805fc16d63f6c

SHA512
82e0ed1bb28ea6383730faf56573f8f633bd2485195de6d521db6f61cb26cecb818330f8095f1fd7f783dca656edabe9e65e8e134a2d9819a5e0ce8adacdbed8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6b9f09f12238ba0d_0

Filesize
2KB

MD5
48fbaf055505027463079f981beb08b2

SHA1
074896232c1b91b4ab0859ff435c920d4e707df6

SHA256
e82bb47651be71d06045df6caba454525e9597c64b4527ac2e4fd5599ed2bc59

SHA512
4b01804f0f8e01cbedbdaa7f9f9e01bdba2e3fb436e20713b89f51dbae7d53199151c6c647a5959f2cf251044814ecd8f639ea457291a2a94a70897c7b9fbb4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6ddfad15b4cd52c1_0

Filesize
3KB

MD5
ccfad859557cae3ade21a2d771a356d8

SHA1
4392bb1db507719e70aa3e395304a6bd8e272db3

SHA256
e4384d3663306594bca7bace45650113f91ab558901e43ac206446f317564009

SHA512
9ef81c305466cc6ac4b8a912f874a8571856bcd7dbdd24a2e92f0daa5a9427a216aaa2279ce2e2cdbf1cf39fb0fb489d43bdc64529fb658377e520516238d41d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6df6d4b5c7b51ce2_0

Filesize
18KB

MD5
04d6bc69b49c9f2e468b0793a4ae30cb

SHA1
533c3fb929ebfaf6edaa56fdf4274066b5844d20

SHA256
5740b49f4167570af1796c61f85c8beaf86e398a351b18fc0aef2b2081f2e522

SHA512
ef62bc9b8e27050e1d29744d2db2d9255af559c0a54fda542717e5c66305de1a2ac2baf5750d1fe43289f30173b678a6332965c34ecee99135be4ca42e0a3a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\734ea16c8a79e2f1_0

Filesize
3KB

MD5
c9271906d80817beb3f1b5e3f28e3e68

SHA1
bbc42289e6b1fd7b1050809683746b0efffcc22e

SHA256
2a6227ddfc47d2211f7bba3a9197dc8514471bbf475378450d4fb411cb18c78f

SHA512
eeff47125ff99fda5fad3fa2fb03286cd73effe890ab33bee26a561c5ef4517c28292e7201043f5c8117de02167404abab9d1f172997eb55039f1e9a6286ecfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\794b4df9888a1693_0

Filesize
2KB

MD5
5afdf59ef5994514c2132d2312a9d1db

SHA1
2e77f6257902afdc21d93bc170978259f9240ac5

SHA256
42c9468a311f9237576268fd359ff36a6430ac3a0f279f374c9be3af34776064

SHA512
05e5a34734a71553f5f9d88b476bcf4fff9ab7a7a9819ab5c212bd8e13d39d835b8d0dad40e1517d218db952961e81a29411a43e06fca454935c01fae46d99de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7c3094013c730abf_0

Filesize
1KB

MD5
7cc68778bd6b39e547cd497726bc2d82

SHA1
026718ad32df5d8d6f8e8fdf328573ad67829b9f

SHA256
8ab08eaef5f2952e407ac8bb54b74a502f16e431bd99f5e80a48fcc683f57297

SHA512
9df573152a4ef4b1d0cc4577d29a8360f8bf38dcc9cc903d583e72ab18c2ff1914d312551d0bee445d229a6ec81ec5d454f418b19e8fc1010fec40ec4252c64b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7fe85d7249e8dc55_0

Filesize
1KB

MD5
96421ccc5d6318a4d8083dbd63fca7b8

SHA1
0c30d9ec08b1cbf5b668a4981839914bb02585ae

SHA256
2616dc04c09ddeeec6df9b383706eff4a78b537fa44a68a07fa46c8db3ebbdba

SHA512
571464dddbbb90df095f2913656ba2aa016c48e408b482cd1349be8c5176657f9a0ebb356ce433629dcd8dfd70e3ac88a351f708242feab32b96d8ee7d9fb8bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8648952d5ff5512a_0

Filesize
1KB

MD5
d7659bcc659246cbee067577d825e255

SHA1
9006eac5214e653e37908411ce8c6cbb0de9b19c

SHA256
8121b02fcd2212160813576faa6e4419d82d8f5a88d49776eecfcb4afa26de2a

SHA512
90eddd4a3d356ec9c93181f568755e9f32db3407aaebc9db846f36c4ec6a8abdac908ee7fd93f73ef09d40702fcc6a6ace754f5ea3932c45c9f2c5292da53c5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\89c00ef3bbb713fa_0

Filesize
24KB

MD5
3f7b6ea5317427fa3d220f361f798c4f

SHA1
3d625533b7d0fafeec4b57b246ebd26ebb0aa5c1

SHA256
7bebc15dfcbf338259fc88f4c058553917f491d621124c5bfa69af02a6d81c17

SHA512
0a5b1c8c84af621f55932e65becb6d9550cb4d36382542444eff788c3590c92c4aed6a575f10d3cae286a5deb75865604f21bfbf3d0f5773c66844e435883f30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8bf9a0dbc145b9e6_0

Filesize
1KB

MD5
76b5f3f4820e2cadc482eda713e5af90

SHA1
a464d2074ec8d893716a20b55e717a53a6a14abd

SHA256
3b0af33e3f2484093f00036f408df8200ee9ab2dd27e65f641e1e8487b3ab62e

SHA512
d9853102379f974ab6f5606ae53ef1db0821e060306936731f86fd6f21a514db18547b2e2fc8898691bdf35857371f616f0fe9e41f3303512817fafab87d53f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\94b6594413ce6562_0

Filesize
3KB

MD5
12f09559fd66d559b25650c4a850a069

SHA1
99ad6ebed8910ea3ea076b4a2d18e10397492965

SHA256
41f6739d348f86391cdf416c5d393d70591d8b66d2d81673d85fca9129082e0b

SHA512
5284b5a89e112b1441f8b71666f1091bd0b5d02d8b4cab00bc61ff84f4502aea11bbc5aebfc16927d122df81b490d786a6cd19f9e193633580168999cf78f55b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\951674a2601a33d9_0

Filesize
1KB

MD5
6ef06c01289521690e0555693d402abd

SHA1
7e13a4826de0637f23896dbd8e79335fefc98702

SHA256
9eebd85333870a292df2c3cf561547059d17e1cdb32cab582a6e5ae7a819176b

SHA512
1fed19fc7bba7689a736b999c7f1158821e4c4f63e8df80c11130dd3ef5d43fd8c980bc45d5a07df9ad0b8887e8a24ba0a348694f41b0a4adb8400a4871ecd8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9e9585b606ccbcd4_0

Filesize
8KB

MD5
807906ceeb30fa2af23b9e141290302b

SHA1
8b5126e5a23ff0a3c719cb7dbce1535cd59d8adc

SHA256
a3b4ed45846c310e1cfafcfc5d8b2f584d18fa0f6bdce095776869c5e7474f6c

SHA512
0f8f3c237646410597eac73f57cdf777a8550a7fec073b58dc9a79a2bf973ccd822fed4576c6022c01623108107f92e7bcff84eaa7321c9f050f2c71fe3ccf13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9f1220d60438aea8_0

Filesize
3KB

MD5
d96878068c721d81a841233a09d60387

SHA1
0a9c217a4759a894da816573c1b854a1b7c3029b

SHA256
e225206227867f293029243bde90ee1593296b0af8e35f32355998dd14cbc1b3

SHA512
b3c55a765c80762001711f723b8b31721d4faf18b34100f9d52709ae687dd9cbfb395b876b52fabc770c688537b99561e10dcea4a95463fa76d63b728f48c5f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9fb6524bd780e80c_0

Filesize
999B

MD5
2c5c97f8efd9045fc58d29f3e1dcbb07

SHA1
84ed8d068f4c089458c90a8b6bf25b5c18489575

SHA256
66084aac7b0acb98705078e1bc3b0eb5f289c6308e2c6fe119de4a9fb1c3f067

SHA512
39f2b6110a4e2c75de6168646191185b42de2959f720e8efbec771a0e9ac66bd3adbb5d15ccf68d8bda2fa644b761bd42e9fe24dd90f2e8cf48efd842702e2b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a02df7c313f59d27_0

Filesize
2KB

MD5
4ccc153f6e733c3c0f7b17b4a9686c59

SHA1
43a955f309c001ef779b62f9a530022f8b4354fd

SHA256
d2e633a25082162aed5210fa8b9dc6671c9e0f2830126f07ad66fa3149271ee0

SHA512
08bd8973f54c96f74578c4d568a3a411011798f9d938d3651acc76d4d046005da33923ae107ce8ba2f3e92e0b015fc5eadae355b167be0a3c728d5f0b0531a3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a05b0db8f454e7dc_0

Filesize
1KB

MD5
516cc22e82966e7290412970469e8a2c

SHA1
4bb680514b06f994872165e517e82790f4d11092

SHA256
5c46cc20a044ac3fb973a5960615030ef5afa1ba038dd74993ac1058a72305af

SHA512
fe07cda8baffb6f52e4389d997e0a767ce3b88c50b9a3c18b913c3d9050e89bbda13e1071191b2c4c6776684b7277f7b180f4b86d9757995bb05900e168a35d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a3beb452e1663a8d_0

Filesize
1KB

MD5
54e6f394dad4586c4bc715ba2760ec1d

SHA1
8fc860649f98e5e4ec5ab6814c2556cd6d164557

SHA256
31955155bad459425181d2d14789990d287056d52bb7c4bfe7bb33d313da7c30

SHA512
173e84bba1a029770a9305dc70d67f1e09242acce895e57231a47247c14cc641ee731dc75b18a2338547f22e695357516147b210ffe9ee0a73bb14aba29572a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a8f80380629fb5be_0

Filesize
2KB

MD5
61ecba5a91c6c9c0f378ed2a77b9f59a

SHA1
4cb8b9a7ceecf62e03efc22fc2ff90a4054d0ac0

SHA256
d37fb64f99b612b80c06f58e56257dfb25b2eec44222973790e5b5a83657f950

SHA512
296a4eb86ee0c263b678ba184ae4780885df148532ce1b48c84dd9fe06f3832df11da090a78e5e597c133cfe0189c0bafc47c6c937a83f8d97d97009ea1a383f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a9cbd0c0dfab54f6_0

Filesize
5KB

MD5
be4fa06620b220ebdc9c78c86e88f7d7

SHA1
bae9f9c1c83e7986d73aefbbbe092c6b88197917

SHA256
e0703a5789407bc1ea932cea2ddb695ff95d5febb1826505941821b557e7c907

SHA512
803bc257365ac30413523f4d5215b291042d7d16338c53af79a1995607f135c8aff43a8b3a5d7e548aa1c908aef3e995682c1a44ecf5bf46064c93197bd421e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa61758ad53dced9_0

Filesize
1KB

MD5
bfd39f43acfb8663c23712d82cc8b0be

SHA1
3f626a16ce1c8269baf53145de8a880849454f32

SHA256
6e4d72c5ad7d0495ef461164c3ccfae8a7265d3e3ef8bcf91e13c22f9d86c780

SHA512
797b2e6cc45b55be4b54c140c824bfd11b44da221006b2ff31d5b7abed54514e8c92c39f3a7fbcfa7eaf75dd9e70944a8c3c053a800ac925494902882245e504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ae6938c53190427e_0

Filesize
1KB

MD5
525691e7ab48a984a81d1de988073bd4

SHA1
1ac2b4005e9ae95e6de9b04df4f5099d6355433f

SHA256
c6c5eaaaacf7cf5f86eb9da0be800a7067a81b39e382da9bec964ec6c4b3cc45

SHA512
bad980e78119dc3903cba5889dc31f797c9dd12259aea82e45465518867bd5890a917c44159026017cfa0a60a82850a9ef57cb1969ca07ca2d90142906dfb4a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b3af26fdb0a014ec_0

Filesize
1KB

MD5
b89c9c9c40e78bebb3bc6202e0255887

SHA1
3b2bb835ba33aa98502fce4e3408c05415b10d57

SHA256
ab52bb91b42ecdaceea5da716f7d15ecb7df09bfd7a401cf3f9d1744eab50dd1

SHA512
297aab747a2013b76715adf852c37e9fa28286a80f300e361be1b6ff98728b0620f50aae5859bdd98933f67a2d588f0ebcaa1a21bd7dbf22c4dd3ae4bd61ed6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ba7773c5b11c73d9_0

Filesize
1KB

MD5
ed9d128f8c6a8ae2aacd32aa1d956a1a

SHA1
2fc6e78ac882b617ac4f8cf139b90e8253985c4f

SHA256
d898781d3bb9c1d4f0589ec6403e51f397f0ffc99624e0a3c7e5f3f2170d3154

SHA512
1b9f3993ae864a613a9f8836d97267ac7a881b40f7e716cec9bbd264f0ebfee1805e212ea050c0294f5a41050cb3e392346a6f85314ae8e066efeaac6b933e52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ba872977e7eafed0_0

Filesize
1KB

MD5
9cd8d9c8f8c7b907be9f800051c8e836

SHA1
c3f3c0111818a0913637513acef931f41cdfc53e

SHA256
113a655e352d8d32bf8fe4037d7d9950c3e0ba74c08a68b9a23947ed8807447d

SHA512
27337d7e5421582e4b1f2133ed9532d9866f9dadeda99a0139141fef3114fc864e81ce0a3625d1fa169c40d328d3f2ad4e64163f14242d20e362633220f9cf35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bd7d45d8a26ccec3_0

Filesize
2KB

MD5
36705da8b84b64ddc5a13ce03724f153

SHA1
acfb941d2e26aaa5d5e94c325751f1fc3fc43ae8

SHA256
258838b4e3113254b147d606f7ac604de7d48f29aeeb8959e138741c1bafaa59

SHA512
05fa9ce7ae5b4a470f3b7dc7f86aaf5d1cb751b769466f932b0122b2d7caf18e688cf7020dfd3f4fef0d22569568deecbea70e3abf49d7da61300e8e2d5d1fdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bf3dde9e4182dd73_0

Filesize
1KB

MD5
d7704e897bdae112176bfd504fb56111

SHA1
a9e37b3682c6c9ca61fa07f5aa3dffc6b55ac1f9

SHA256
95bfc9a70f022209910dee41949a58716bc82d12caaee22fc521b06d8ee182b1

SHA512
42aeb2ab1da9de1d0cd3ce96e63198562ef99aa15bfd78758a462c0b7075478597a6645a8b2d834ccbc1832ea553d4dd453ae0455292c090041c43d3934f52a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c2c3466a716ded51_0

Filesize
1KB

MD5
5f3dc616ac16ddf2d560cc5e60f73057

SHA1
5a75a30ce9e09dc86ea51e0097196ca579f1a7df

SHA256
7d4cce8a1813f3242e4cc0c6e3ff3ebce25ea7f6c5b97e9fbb7e494d8864bd4b

SHA512
3f600f7d4ff610c6b36b068df05c4eaa72dfe3716998f36e34d01ae65c65bf6a0a21875d2ccf940af8bfefead7b365fe8d3c0d4e3bca20d06e608cec7d72ad4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c4f2da4e4b4dba36_0

Filesize
34KB

MD5
b062c2280c33f66946fbf576105a705b

SHA1
56731e2f60c09fada6637f73ce38c3fbb79b79d5

SHA256
fd405e9ac2e32c67a8d88b18ed4bc0064221d3d1b6cc66b744d833536309329c

SHA512
6ab049bd90c17b4e2d0b52446debe998f5836a5827e79b450fda40ee964bcbb809909f7b9227718386c84a372589fe947b8efa9660d17118ef261e6458db7508

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cb307b4160083434_0

Filesize
11KB

MD5
5a19d4c18bda66993ff599c67c666390

SHA1
f4d9483572433353c8c3a59db298d3f3323846b6

SHA256
a77902c89b88186105eadca2efa30861f0be109a243fe073173153073279f4de

SHA512
4f43ec683978ee8c573a463b24d1552e2d57e14c2e96f185947c29b91d3cac08d9b2ea1dcc43fd28bb9f9af2736663659bed8fa3a42aad4793a5f703e71e39b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cf4436542c566b96_0

Filesize
5KB

MD5
97620ed18a2ab8d1d8e36bbc8059eb34

SHA1
b574a4aea9416e41ee266e764a8271c859d6bf41

SHA256
db91230827628e11f12f34ddfeab2754df47422428b5c77581bf12d95e3d68bd

SHA512
62069bb918af26b304d043557035900df6a665bc5442d6cae4fd68f0f888f57d372c444504e31ffa96d78f293849de2f857fea9954810e71308bed4cddbd5cdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d5667bf87cc6b1b8_0

Filesize
1KB

MD5
636b23dcdee91fdeacdc5b53ecf052e9

SHA1
cfe917fee71258e9e5917c57a32109b672a0032e

SHA256
ed0fe73e48599e2c33b325ddb54f482fdc93adac8c212c064abab3c41961dca7

SHA512
169f62427b506484fa45efc5b381facc553dd05ac98d22a7c8331aae20e46ee2ee11882f6b95ffe4a57bac98fe9d9155e1f9cae38957859d575e4729607e13a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d6ee81079c1cbac4_0

Filesize
2KB

MD5
016e7d8ea7954c89a5d5dbc74e6e1a43

SHA1
1651d56056ec90f34f1d853dc16089d2e4c9d76f

SHA256
fc1025637d1b320529b59dffbafc24cfb4f09a46d7c869ddc51ae503fd9ebdbb

SHA512
bd1e00fd3212ca29fe277bae5c923a3eb9c5599cc9534acbeb9203e865f7c582ee5e8af7379ee2179b695004164acaa5324cec43521c88eb7fc590cbc8722a32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dd8e97b58d81706c_0

Filesize
1KB

MD5
aec4b3be7fa7c1ba099a29fb35353777

SHA1
bda1fd18d929d36855f11b77b51ef4aa6c371ddf

SHA256
734462f71d709da1d527e6338b47ebc3144dfa91b8005868b1a0636057e45846

SHA512
5d74185d1d9714f63b1d9cba956f80a8086459870efdd25cf22749b9aff559a256764b677d2c42e3b2d252e091c3283155d9b82298e015be9224ef0065bd9efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dec34c1a55bb8797_0

Filesize
66KB

MD5
a4a55a4b4b6decc7e90463f7caa3d3d1

SHA1
4280365027660b89cd68d90000e0e28c89ff7fb3

SHA256
2ea67e0b15e1083d4e64771c8c3ccab4ff5bb7548cf0714deee7df44da1d5191

SHA512
1fec8ff97cd67b1c26e576f15937da04fa6296595fc3d05ffd567adc1926ef32763ee29bca34cc8fd3bc3d5ed698bd24c589d09553808124d332ad3b104f7ce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\df9da550ea6d3003_0

Filesize
1KB

MD5
8052d682e6b8dacd20cb500820735a92

SHA1
ae2d164834ca4b106b665ce17fca037635b7cc91

SHA256
f6e9895247fd701461e5ba137d3fc53916839131a26feb4829036e57db4acfb7

SHA512
fc1fd5c497d913661fc1e4cb62fedc6a1bf290089d2e2478deca5adb34f3e66e1d390da8bd4f2b78b31350eefb242c0087eea206f716a31e3b99a3851067db31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dfa37c3bce11c64f_0

Filesize
3KB

MD5
369bad79e56f9d1b8d9f4d3ffc2cc671

SHA1
04fa4570865c3135e1598aa406e66ac6a29f50bc

SHA256
74436f03a9d4c46362ad90d938443c500a86c48b20f51c41ae3452433f3003ec

SHA512
3c94cea26ea5b909c121d4ac9d1a2acfe7cb3d326dfdd942f394344029f643cf3f2e51acea17723f3aac272762020834cad1bc32053e549495fe159dc4bc33e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e66f4b4956b4ec3b_0

Filesize
720KB

MD5
71971b121e0b2ed2facf6c941abf6b9a

SHA1
470c61d0677f450cdb3769d6855b55f6e9959a95

SHA256
9c3834669025a25a00bb66410363f2590df8fd39390fbeb9b794c633a3407772

SHA512
6e2d501710c8d76871e87c15fe444da421878c4740d104c7b10dd1f4bd75bc497bf39026c707e982fb93d2adba8057a4eb29eec7262505ccdd0026f64b6118f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e88c26082cc48958_0

Filesize
2KB

MD5
03b69785c44416fb04a2aec067b5044e

SHA1
5ba9dca11bc837cd4ba166a791f5a6bbe10b3700

SHA256
6151cc0c2f52b6df51865200fabeeacfdec2a00bc2637a4fcbf699fa23430c63

SHA512
0262ffb6f3f46fc3986b9497c574e46d9860d55f4995616da9922dd928ffa1ac1a7143cacfdf9a80924bf1c94c4a682a602e9782e648a8fca9960417bc27b171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ef0a052acf792e71_0

Filesize
28KB

MD5
51ea68f3ef6c177d6f11cafa13a3dffd

SHA1
2bf4086cd1d4020b20514af594ae3f21af97f067

SHA256
363d125e9c5d8270e9066b8c92cb1e82bc76dcbd4481357d4fbe55b02282d034

SHA512
2a4aa09b5dd9eeb50a584cb67ff616bee187c3f55eef00ebf6d18a8bf12aa0dba8069b2e4d03925993566b5e9c65af4af96ef4a4241b501988021116a4c2897a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f27b37247deb0d3b_0

Filesize
2KB

MD5
999e96cf67255a241357c819921cc38c

SHA1
5f4817b451e748ea552c97332c9102bc71c0ee80

SHA256
7f4ec4cf022db5ddd0f76dbc21d4ad36392b64656b5e014b18a4d45c5778d8bd

SHA512
9d877a56c725c2310bc2e417940b2b99a3ebff81ca9d1a7544303ba25dc6b6a020140be5606d8c9f67cc2fb8cb22aae6ddf97400a2bba5aa541f0b4568b56bba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f98a9b53209646ee_0

Filesize
1KB

MD5
42e8c2a509afc88c0b38bad9590f184d

SHA1
b380d2b5ed6679a4da3f0169615206559dce1458

SHA256
64b499f44865e0ff227100ed5eec231ce4d3f364d207755e3200b7651ecc1974

SHA512
38382c270bc246e6a4fa2371488714052244a1cd3b932aaac3379165fce908ade89a5a972f92fa823a0439c557eefbc5193d933e86d75189c94ed39c21932c9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fad43496817469ba_0

Filesize
1KB

MD5
688617042d5d4c08275e3a678d2da760

SHA1
99c0dfdf5842c4ef7c40a14ea48ed983252900f9

SHA256
540b9e2de557c1535487eb3a0db78fdbfda116dac69b7fcc8971dcee9df31abe

SHA512
5b5f62788a600674779c12a2dc85f35f0aa619e8879f216925cec66999c8c143e8b58b084aa0bc8335b49783e9be3203e16f3c214330939d1219775f39780bd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f52fd952b740252f3b18700c3c505952

SHA1
7e2a6ad248ff46530d5907260025f1e5f7f013b4

SHA256
d06e30a9067f4472ce90b188f43d2df649f4d56a9cd8043ada43cb2dac04d98c

SHA512
ef09906e7d2b736cafdd59fb3d36e004421b7d23bb46b4e8fb1061c91b8d72a5b7aa92a48166b8b6c5393f5523b11ff2256745cea0ab55708604060342f625bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
22d93e7c9e286454ae329d5aaacedc6b

SHA1
37328dbcd38aaa846dfe88aa9b3803d0f8ceaa32

SHA256
596bebc1ec1996915f0ccb362ad67999c87aef6b117b164106504417ed30f22a

SHA512
ae1097d8d32d722b8406538674dadd4926c02648bbbbd07fb6defeb6acd643e9b5000358e2ef391a1c9b2b65d2271ed471cf66b8068be7e0b6ab0e72788ba481

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
678B

MD5
89484ce9bd8a971ecbe5cf1b2df70a3d

SHA1
47dd72c441ed97856bf84014eeba24daebf4a28e

SHA256
dcd412b0f3ca781d1813583c252e31e9a48c68d6d674d8c1a02ea7cc1f1c62bc

SHA512
954afed5e22862eff7f5a015226621b637e55599a5937aa9c7da5a9f397753b09cdb405bb32076d635cf6740c67acaa375ee1aae13ffd41a0c654c9295c39e7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0dc694feda0e7e26f5b2ddac16af9222

SHA1
3345ef85ca6a75b95f8f3d74975c7e95ee98dfc9

SHA256
5d4949be3e61a8517779fb131162509f631fbc1b58f62b964d4f83e05817aedd

SHA512
9e19dc18f36d33402c0e2bbb804350c125c4929dd8507c5cff1a5d95add1480ca767675e2afd26942c54c20d8838e47d11795bd4a3040737eeb28f625b5bc5ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
058b5081795411933be21cb91426e2f5

SHA1
a7db4e8efeec92e7c4f4c5e043d1ae6b61151e3c

SHA256
cec2de942de75386cb7dfabb3fe81f5f31185dc8877dede40ff22844205c2c98

SHA512
c14467bf52103017e94abf803fd268153e3e0ad18d14d4956c55084c0c98e53fbc298cfae9da00bd0158df2e59c8c08c1f1d0ea9eeff305c56f10e8f2b91a482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8fc1099b013dd407d8fd1ece67a43f1e

SHA1
ba3f636d044eced9ea7a3e70ffdd2b4430cde661

SHA256
61e533e931809783d1c6939efcbbd8153da833ca4eb8462459babf63c5af82c9

SHA512
1d4088deea9204e81dfcf1458b3055f24071af6233d0598f809af4af653bf2fe7727031529bf57e645051dd4a8ccf9f732029653693459162b109e7397eb75bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a4fcba1f5fb30945552ded762556acf2

SHA1
64d0bc92baeaec864ec97219d3dab1bcf3d67ac9

SHA256
44df324fdd207b8114972af3c2e45ee2093bca66ecb69233c0e00717029277de

SHA512
760165595f299dabb92cd79ef12abbe9ebd45d80215590b95b687a969d3a9dfa25f6fe38ccb562898bc3a53d9acf2dc0d762319d61ad0d25ef9e88201f507683

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
58271d9f94c3f7b62d6e70fb3bf55907

SHA1
720c57c24d441a6ab1f9192e97d2f27d40dde50a

SHA256
ad15aae24a6a5816e1f2c4eabdd5af7b2fc14e2626b85312798421819b991f57

SHA512
0164e3f08e357e020d5fcff0df4f9358c92b662be5cf18049b620b64a0a681569e72b805ca4346c6ec5ec9045682a7d3fbe123d0fa80fbdb20f53072b9f516d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
db686324044a0a0bc631ec828c9271e6

SHA1
78926ae5fa0a8b5a117be71849788deface3dbd2

SHA256
dfc0d2d5575e731b8978446ea75bfe78cb30de45563fae19c4618367f93d964e

SHA512
9a9a82e18d61d66120bfd3b76749f621a74f9f58e03e67755c4071256a651b85fa232f8ff966fffd14d8f8113d629d2f4f9d7773aa0970464522b8f2a8742398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d2ef639ce24f9a4d92f2d2e8564039b5

SHA1
06d605fdfc2ab1dbd25a2d6c63d8825a014cbda0

SHA256
27d34d517ea963719f6160bc4bfdd93b9b494ec0aba9a515fe091dfa012eaf63

SHA512
dd909a0af2140947b5901f1c2f8a54b81d05d54fa5dd98ee275e47ca8b5a2dec9f7564905ed30abdc989f108d4bc8997df8402249975257d27348e52512f6726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3594c95d30b50312bfe4761157540e75

SHA1
629070d4ff8810d143b57ec4bc53ec281c3e25c9

SHA256
3c63928dc0cb6f7f48ecf582ae74f2034821f3c4f06e938778bc0aeefe394337

SHA512
2e446abfd213e0fe3098c9bb4f4779ecac12a7e3d96a43453bcda2a76e3e0df2cce9c8af414caf9668f1a551e1f1ad66a670d4efc2286a993c41ea82084bd308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f090bc434b3d280e071f5369820862d2

SHA1
38699f954b045b6c8826bbc7156db9ac1e32cc7c

SHA256
f3ecc1103efeeab469d05b3384aec58f3d67b502465f8c86ec4c815aa31ae3e9

SHA512
0b42ee72e5bb6eb742be4072a4d7ae344fdd8091894cdaf0590c3cc3a61033e9c899f1c8c06bf81cabee996c369f12fcad6ef9a1e9fc2d427e034eefc2900c32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3a38725a59abe755fe67e365417b541c

SHA1
e8a9e8a175743c3aae952157bf8ddcce89c191ef

SHA256
a9d83d59bbb9151ab67adec19a3fd915c8d9862b489b0416a7923deb50e74da5

SHA512
644349376c610106efd2c19df4238aa6bc3aeb8ad57f57ed27f49462c3e2ac4659746ce5d012db662be18b2b5b3b3760552730406694974b8710ee8f0e572193

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5855fb.TMP

Filesize
1KB

MD5
66ea89ee4f42f72841483da766c708c6

SHA1
38a250c8a4b65238a6cce1142221fdee66a9c752

SHA256
55123864b72a56e883a0254f962ef0f277c584fed3d7ac7da3863370c84cb9f6

SHA512
2b9a1e6fd96f76fd60e5a73f06f2b447ee6753d544891a7c3351d20623740bea329235d5ce871a0123e7696722d68c5d04877977cc896fc7ea628071fb6a3d0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e63381aa27a37e68f7a5483d67083b66

SHA1
617842fe7ba9b16047f7fb665a4c3402249f4ff5

SHA256
f1c1f87b0e79311d2da44d6978c62e40dae3f8284f8e5e31c9ec73defbdc6071

SHA512
5fb5c50bc427cad752ba0c94a9f24eaa07a095b8d8080d7c356d21c778cac5cf2feeeee2ecfbd4ee4fd0c507cbd62363605e48f469f605badba29bd7f60a3aa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fd0d62362698b7b51efc0c94b4e13d79

SHA1
6d35128b910cbfd5b58396a1e900c670a3dc04b4

SHA256
d25cba6c17a95f5d007722d7d2fe0fe3c5a25841d9bacfdb1c96ef1063e2cd61

SHA512
b7437f33c26f64aafeb7093649d735e088f81ec620df4786461b0f752cebab5a9a18a28e87088a050fd7900160ed86de765d1bb9b54e97deb258142b6683e638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c5ad4430d443e4edcc608f4898582df3

SHA1
840871bc781cdda46448e8ad1fa4cadf26c843ae

SHA256
93051414af79cfdef20ef8d17b452c492e4b1714df2c6969b8ea16fdd349ff64

SHA512
590ab1f752de0c66cb32ee3a4803905109a0face26fe8d409e47dd1f39eea5b97942a1ab644649c8e80bdf76e1e3cdfec4e6bd05ed6183299e27dea35035d95a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png.exe

Filesize
199KB

MD5
5f13d0b7ff5ef7b916f50228de1d8298

SHA1
32f9cd0f365f79aa48827d1b7a76a6929dea0d70

SHA256
b1fe8a3b1232459a46858995e71cc5064c0e6013a27cc63eb410f853aead734c

SHA512
ce656d7bab0c6444502c06a637f0d65ef4b3768984d2a8d4ccb106ad036f0e13dc6365f7f023b4bd4ae4d1b876c25777dd46033af086410753672139a8c7ec07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png.exe

Filesize
196KB

MD5
8a00c0f8a460ef5aa0b72a3e2c537c87

SHA1
5899d491f71aa14db68604c99a4be2ca1cc93e28

SHA256
ead3bff7c2f715b7fbc9c35b983641d47b781918d56fcf727563c539dd04e7c5

SHA512
5dce43853ee5957ca26179c8beb8b5c42781a52c085513d06e5f5142760a3c1f2204086208c3e299dabc3170c1e8b0b763dbcdde204ced330b9b6c41d5d2cccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png.exe

Filesize
192KB

MD5
cbdc993cbebb72627e1640aa3cacc246

SHA1
d5de585f29a42192c56a16e19cf4ebbaf53286fb

SHA256
f8542421a49322699536419c6ce7797dee3cbda5bc5d4f2f6f7c83fb9fb93f88

SHA512
736801f8ba546b0ec47344aeb2e603b2c1a261704ff313417b688ce2ad60f202d8d15bb7c604f8e4e1b441873ddb9d08470d665730f2564a8ce31d4931116220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png.exe

Filesize
199KB

MD5
1a655b7e8de659322a96ceb9b0df76a5

SHA1
be022a6331b4fe7dfba89592d9fd6d401fef3c12

SHA256
aea9c8da6908c29e0baabd824ed66a5ee4e9f0863e2e33773af88ecdfa9d0079

SHA512
dcff3d6212ff9e869b5dc30ed54d245f28b2625f876c96aca75324a811eb7fbe46e08dddd5fb402789e9587661170606b0fc0cb7e65f90398d9a37a541e50c30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png.exe

Filesize
194KB

MD5
3e5b6c22e5e4933a5509867d1695d215

SHA1
48fe66ffc1208ae503f956fb9f6a57e2a09dcbc6

SHA256
258772c4220f040204a027fdcd4c6c80056312922e416f5f85dca9a517885bc9

SHA512
a0be9526c9885833d11caac0e4680cf30af6217526f441d064bb94c69104a65f0b710dafad487e754e1cf267ad97b1d23f99c9fb38eeff241c4b8c98cc73ac78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___CQFTB_.txt

Filesize
1KB

MD5
a75b28f0a410336d9e5070c67a60f951

SHA1
74ba15a37efac82e244d752c47be44ac292eab29

SHA256
cc1528e4b2f9a1767aad98903643ca7468bd5e6ee60aab65879f72a4faf2e38e

SHA512
80fa1dfd21514cc468aab07ad6158c77b08f069ca21860d31856e82981550969bd3f872ebf4cb8d2b08bd572a05f2ee0a6a5fa26a081dfa8064068ebfd139963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___VYKHK_.hta

Filesize
76KB

MD5
4e37851d42c54753144335b58f996f4c

SHA1
b0ae69dc2f5b4503a695580c37ef8cc0822e91f2

SHA256
e40876f053066c838d147f791b28694d786e1d8dcd5a207b19399d07833d242a

SHA512
a35eba6add2e354ce05737197802fa1ee5eeac9a85999e279a70d74aa49b6210fa4f52fb37ac7edf5dfebb228620fc075afbf058927c919ca0c1cf3bedd3e22d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png.exe

Filesize
179KB

MD5
7394d530fbd927035681ba027c3b43e9

SHA1
28e4ac9c7457c2e751ac0e08bf9e3b07d4c037ae

SHA256
62de09fbd6246cc32de362fecd2949b6b171a6794d743f5f94e408b4d159e04d

SHA512
97f95566f6a0f238b1862cf34014a3933857e4bfef53c4c386739b76753d34834ad4e446a072899f603cdbb81e2fd3106723dff1372e5a9d4183dc343348b22d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png.exe

Filesize
201KB

MD5
30819b5e17e58a50be04e7c0720aefbf

SHA1
bf4904d02975624fde10703dc4a544b34f676dd8

SHA256
0cea6785388509158a50d1e1e9bd295c573271c1086f0e3954e93d444ee74b6a

SHA512
5689d15f5f1b7634076c05819961b91d6512d58de9c68a13296d869beaab563ae966f047de61ed02bc6335a9e148ec8cd175c673ad91f2b2555168be4254436d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\INetCache\YOW2WNN6\th[1].jpg.exe

Filesize
783KB

MD5
2a7dcbd6384256f39fa0a7a6fcdfde66

SHA1
c964e515320a8bf6b0ea0f9ccbbad49e43b27202

SHA256
2b28adc3a9dcac224e4ad341b5de7e127fd89b087f4e5f7193cffb3b8856d148

SHA512
880f35e7db58c285acedbcf2bf121411c9b2e8b4cf708a241181445d110c1887d892bbbc0ae7f5ae55b13a6e5b9e6bce212faffa198d85535f1de9a85612b4f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
C:\Users\Admin\AppData\Local\Temp\sIocYIco.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
3517a161febfc5997763ea32a6ef1c8d

SHA1
52704f94c186c53d819cfadaee63662f1d26d550

SHA256
25fd1d423182bbca1f3815f2591d68a942aa9d6b51ef38d76aac6f2fca151cd5

SHA512
b6383746f3632a5bf9bc00aa0de686c180334fe0c6680cac733db289096be58112cf8c7a595741cc07c4dc452058051b5b289353e66e555da38144786668b86c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
6bd2f255bc0d26d2db8b6c91bb972303

SHA1
3b3c200c904d4522518d8554554f9982d9250e80

SHA256
f35bceac2f0c5a341ec69875b7d9207d919a5fb9c790a8e6d3da811706ffb1a6

SHA512
ff21c1033612b205c181e542f4e823cc2b8f5fcd177226bc4bda2cbaed6fcd58380fc7b3df368e079658ef5aef85838a514cac8e00b2482979cc21be2931b6b8

Download Submit
C:\Users\Admin\Desktop\@[email protected]

Filesize
1.6MB

MD5
b63f7e72ada8593f9abb8034c2d8c396

SHA1
fa1682ec81027d8eed748c01f0722efe10b25831

SHA256
9f950c4e75d01c131ed4f463489fad067d50c6506e8776ec8ce6b821ecb82f4e

SHA512
3490e41c443b843be4abcbe7c9cb2c34fb630806c63a4b0dddd2f10b69ff3920639c58ccf29f4690356f5d819962fd04d12979bdca225521974645d19d295f99

Download Submit
C:\Users\Admin\Documents\@[email protected]

Filesize
440KB

MD5
bddf9409395034d4368953f4e0c1996b

SHA1
3a4c8c57d6d0ee6359e560eb5da023193a3d1031

SHA256
8ce412b4d91fd7e5bb7e2aea5eb733978411cb514b85d1ccb560cae10de014bc

SHA512
0b1664be4acf7c01da9b0b3d29ed0e46de41df93618a36acd1a4a4fac6a3d488f0784755c1282d8cd06ff11e43ea00c4019741200b916dc9072acc0723467935

Download Submit
C:\Users\Admin\Downloads\Cerber 5.zip

Filesize
181KB

MD5
10d74de972a374bb9b35944901556f5f

SHA1
593f11e2aa70a1508d5e58ea65bec0ae04b68d64

SHA256
ab9f6ac4a669e6cbd9cfb7f7a53f8d2393cd9753cc1b1f0953f8655d80a4a1df

SHA512
1755be2bd1e2c9894865492903f9bf03a460fb4c952f84b748268bf050c3ece4185b612c855804c7600549170742359f694750a46e5148e00b5604aca5020218

Download Submit
C:\Users\Admin\Downloads\DenyConvertFrom.ppt.exe

Filesize
897KB

MD5
aeb3e942f05f88c2de5dd156b90e4ffa

SHA1
77dbbcbbc8b3f450b27c7083c9bc18ec2561d169

SHA256
1390893772c46eb8d0037c2c3eeb7dfe554ca2a47fc75ebb2925e23d28d39963

SHA512
848cc95c5b825d7916f1aebab3a2590d27f719066bd0296796de0340a673448a2d6d8c6487b7b9dedaa09c2a7bf99e2dea9a8fe71426e30e8723c25e395c0cd5

Download Submit
C:\Users\Admin\Downloads\Fantom.zip

Filesize
198KB

MD5
3500896b86e96031cf27527cb2bbce40

SHA1
77ad023a9ea211fa01413ecd3033773698168a9c

SHA256
7b8e6ac4d63a4d8515200807fbd3a2bd46ac77df64300e5f19508af0d54d2be6

SHA512
3aaeeb40471a639619a6022d8cfc308ee5898e7ce0646b36dd21c3946feb3476b51ed8dfdf92e836d77c8e8f7214129c3283ad05c3d868e1027cb8ce8aa01884

Download Submit
C:\Users\Admin\Downloads\Fantom.zip.exe

Filesize
389KB

MD5
58e60754b4c4b718fe41b7d2e9c96c5e

SHA1
97b117fe035dde52e9621b285134abf8f315e816

SHA256
21aa49b9031a3dab25e2c0bfe3a0e8e0222f28cc518857e40e68ae28aac89682

SHA512
d0d3c59caa386574672ae96c25a216f3b5a031f7a63b4d9df3e20d3fc76e1a3926615711e8190896b3f65709f67ccea553a940155cc97be304d91506691898ae

Download Submit
C:\Users\Admin\Downloads\HideWatch.rar.exe

Filesize
824KB

MD5
a2a8854877d8ab723c8bf2dfc06dc6a6

SHA1
07f2111ca9d36efaed2f68eb1e173701f8f94c9c

SHA256
a2a24592c56624bb1ba190bc95860969e2d3cd86257b7f2cd3cc20e521096008

SHA512
f94fba37117e07bd3b1bd6705488118fadef5c97c137f0ba70e4079d7263ce312a0df66edda686da80b67bf3933d4a8b136795c8893d9af05e3c88f5e145082f

Download Submit
C:\Users\Admin\Downloads\PolyRansom.zip

Filesize
130KB

MD5
7a5ab2552c085f01a4d3c5f9d7718b99

SHA1
e148ca4cce695c19585b7815936f8e05be22eb77

SHA256
ed8d4bb55444595fabb8172ee24fa2707ab401324f6f4d6b30a3cf04a51212d4

SHA512
33a0fe5830e669d9fafbc6dbe1c8d1bd13730552fba5798530eeb652bb37dcbc614555187e2cfd055f3520e5265fc4b1409de88dccd4ba9fe1e12d3c793ef632

Download Submit
C:\Users\Admin\Downloads\PolyRansom.zip.exe

Filesize
312KB

MD5
73bafa62c84178a9c6a4af14fcccca43

SHA1
9bcf939e73d65454d2dc9db14348efc74d96ed94

SHA256
acaa3546ae1dd1090e59a046605352e3b17086520683d20ca8bc0f3c28f87863

SHA512
440a363b5ec35cc72dc929fbe4bb0f17fb48cfae8cfd6a9252a92b164294bd452947f7c68a59d741b0b12e8d5749159818f7ce372c04a71ee20e18d32aadb8f4

Download Submit
C:\Users\Admin\Downloads\PolyRansom\AAIQ.exe

Filesize
213KB

MD5
274035bc50701fba355fb98c7b72e0fc

SHA1
5be478eda016947726c3e065cdd9f9543f8dbd28

SHA256
bc544420995a4a6e6a461cfe38660cc01a306d62f7dd7e771d12acb5ff9d3dec

SHA512
0137d6c58044fce7001401e5222edcccf48f91f14690efff6b3b654120b0e22a707999875e40d0682e369ad484d71e2e9d8c807f700a473aecdb60a2e6294c16

Download Submit
C:\Users\Admin\Downloads\PolyRansom\AIwq.exe

Filesize
188KB

MD5
af7f844f9753dc9318ad0563904133dc

SHA1
6d09c72d5efff7f41a39afefbaaa5f222be3e226

SHA256
dde598c63e04d06fd8c1668fe6299346f2f0cf3dcf467fb3f5e021ef506f200b

SHA512
df7dcd7d57018c8f056ed8c4212f8852726a9c70af71816385c95337a5b536ba217e5b4b6c6f03a93a3ef8487c291c96265599b071f8c5e69e53192ba3f22807

Download Submit
C:\Users\Admin\Downloads\PolyRansom\AMAu.exe

Filesize
320KB

MD5
97067f7396005d7ab36835eaedec761d

SHA1
73ecf6ec42283e1961feb1e131b0f10aef0f9343

SHA256
6fb138b1d42c70e262e935325cc3d5dde0fb473da556f3e31c6a8ab24ed650db

SHA512
1f5a59a617932b074b8bd229b82f634d5b1fbb7136942bd7251d8bf4722fc3c32f3cd130fd957d163263954e91337597217893bf9161fffe1426be430c22b11d

Download Submit
C:\Users\Admin\Downloads\PolyRansom\AMUK.ico

Filesize
4KB

MD5
ac4b56cc5c5e71c3bb226181418fd891

SHA1
e62149df7a7d31a7777cae68822e4d0eaba2199d

SHA256
701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3

SHA512
a8136ef9245c8a03a155d831ed9b9d5b126f160cdf3da3214850305d726d5d511145e0c83b817ca1ac7b10abccb47729624867d48fede0c46da06f4ac50cf998

Download Submit
C:\Users\Admin\Downloads\PolyRansom\AQke.exe

Filesize
3.5MB

MD5
9eaee7cd7c4615c601ec2e78b9a73b83

SHA1
103dd151b1d13840936da5afe5f48ac014d06467

SHA256
c719218847319633fb4bec75e230bae2190d5ec1bf022ae104485f1482bbdedb

SHA512
ed0aad87cd8b51f15bd99afa085f22dc5f274c106eb04fe2acaf1cda51a56ec7735b2c11a5260168eaa76664526f1e4ec78c98bd5f63d7595e646a4c1c17cdfe

Download Submit
C:\Users\Admin\Downloads\PolyRansom\AkcI.exe

Filesize
1.2MB

MD5
10b699a639b7e6716eb588aa7642d885

SHA1
0506c08a6949ed29167354d43535fcc381df47e7

SHA256
4c553990070ba9dba02a6a2b7f2365f87f8c71a154b774888c29a7e64b330c3f

SHA512
147e166527923ab067a97f7800628d0f1d6b5c195035d502d7888475a3605ecee0c6afcb48525c9c7a87130af98efe18add8866af790709ad3ef590f4d5334ba

Download Submit
C:\Users\Admin\Downloads\PolyRansom\Akcw.exe

Filesize
513KB

MD5
b28b86824dbf6c244428f2554fa24ae8

SHA1
6a3e125458d963fe58eaa88e3ffc9246da1356c7

SHA256
d6b6129f860b36223cc6a1cc8cc58ec68c291135560f7e4d08cf05d0e80663b4

SHA512
19d72a67043c0c25c0b7b6a86a6f6ca1d002e0d559cb8ae15bddb5f0f8a7dbcd9c5dfd4042c36c48e452a6238c3fcd34ec7b1d9a5277e09794d89863567db44e

Download Submit
C:\Users\Admin\Downloads\PolyRansom\CMsG.exe

Filesize
627KB

MD5
88f2fc6075ae3a2affd6c95b496e5f78

SHA1
799157a440447f93d2fb2b5d1f164afbae4afd39

SHA256
c3759a27fa14cacd1744009d8a9a85d90c66c9344073213ddbbaf7a0b3491506

SHA512
579509827d4e1b68985b369ffd6164edc8cac59d9e8bc489541fab22c27adb01dd73b7404a4c28680d2cd637d648ddec5eee319c6a2be5e90e83b40adb87fc58

Download Submit
C:\Users\Admin\Downloads\PolyRansom\CkYY.exe

Filesize
191KB

MD5
0ddcd44e96600d1369fad58c3bf44e13

SHA1
5f3a01432a1fffe8c53a61aa521849b0b20a94e9

SHA256
33d1ec0f157dcf801ab80834f3d860aa39c631e098b475256975e3af2b492fb5

SHA512
56dbcc8386a0bf9e853465989a38dfc8d017de596c15ca32d4e11b0e28084797e01e86f69781091e06ec29eacfdc7329538a7faf0691fad6f29c25f623352dd7

Download Submit
C:\Users\Admin\Downloads\PolyRansom\EQIS.exe

Filesize
200KB

MD5
d84b10c281ab7533a65b17746a75615c

SHA1
b3847072657760b0e88cbcd7ce87b202fa305e1b

SHA256
4db8ae64cfafd38ad0cb2615fc8043814b509eaac7ddd39985957708e410ed5a

SHA512
04ae6f7ad1542bd791430c46b46fc34b6f89bd537badcbebed4118ecd5e5fb6f2c2cab9725e1b9296a7d7e5a9ef71e8b55aad2e0f68596968bf4bb01c9fb9ccb

Download Submit
C:\Users\Admin\Downloads\PolyRansom\EgIq.exe

Filesize
195KB

MD5
61d89601ce1b99c1b51cf68171218870

SHA1
3662a440a8c403b9a37300e9a8aeedd123f72485

SHA256
da7d01c628d2d61996f9d0ebea266baefbf5cf61b1b48933c1baa2618edc7fc0

SHA512
4d8a0368a4e8595b7dae9610e4bc764e856ce19611e8ae28315b0afa1d1fc3c64ff2a5510bb58ae7605ef6e94b20fd849cd1604887066a08086675d5a99a651c

Download Submit
C:\Users\Admin\Downloads\PolyRansom\EgUG.exe

Filesize
1.8MB

MD5
c87d96a5fb769545dfbca6e7a2f0b2ce

SHA1
9e6a566bac1026030b8a0cf5203837a0406a44fc

SHA256
d733d399a94be0a4855d8ec8c619b8f04cf2bf726bfe7017e201ca13f2965e24

SHA512
09e3bcccef37658b410b334659eb151663a3f3590a4d3f1ba2c9debb4f5b9649dcab927f2021ed3608584cb916e50b7e6648e4d96b3e7af88a3afe383519c789

Download Submit
C:\Users\Admin\Downloads\PolyRansom\EsEc.exe

Filesize
202KB

MD5
6c085a8ff02475c7836b98f4a381837e

SHA1
7f666f05955a41a17d5b5e177e810b5eb0096b90

SHA256
b09752556fd73a76d6ed3f3140eeb9faef46fac0989184dbe5cf419216ab7ff5

SHA512
d60b70e7516d1e3a1a3d33457f474fa1f9bae4f3d64a24870121c91fc2a7b2441299fec9bd3039942f06604a64e27ea444205e79a090ce9ddcfa49b1eb334050

Download Submit
C:\Users\Admin\Downloads\PolyRansom\GIMM.exe

Filesize
430KB

MD5
8dcc30aa5f1d5cc8cbb5ac330c1e9320

SHA1
41d02cb606ce4247d1c6ef48f1e27713d3623883

SHA256
b8f1983fe80dadee51503d77d664b1f1910eabb9d20534850843c828d6d05ff0

SHA512
9305cccae2141992847d1c9803bdbec3d95dfa3cd370035c5b142110cb0b66dca7eec8c56dbe7f6affea1e77cb7e83675a389248cf5afe61e30b9ec3941df6bb

Download Submit
C:\Users\Admin\Downloads\PolyRansom\GgQi.exe

Filesize
498KB

MD5
a78491dfd50838db9895739c4055a716

SHA1
815ba3b8bd9c9ddd7c06303857c596b7d0a1ef20

SHA256
c71be7a322497022b9c916e21647552ff69cf9e133c2f8e36c40cb9767f57ffa

SHA512
e3dd53279053cad15cbbbcca1762decdbeb3179ccbc12f64bb0dd870e811d5c87d5496ee1f84126f672c8806c033ae191458ac1fa2e3c1b1b72c18f8e58dc4e2

Download Submit
C:\Users\Admin\Downloads\PolyRansom\GgUs.ico

Filesize
4KB

MD5
d4d5866fa12a7d7aeb990ba5eae60cb1

SHA1
a1fdfc36c9500844fe0c4554fd60cc95808bb9a8

SHA256
5388384511211df8aa81844cff67add9646c8196456f34bb388c2bceecf5f2b4

SHA512
7e8537da4047e751e3613bd089014d6ba3f4418a6d8f71c2cfdde146c0ef83895e74417ef19c30a63adc1d38fe0c1f8fdee3f2eb5bb0146e5043f06c73dba06d

Download Submit
C:\Users\Admin\Downloads\PolyRansom\GsIe.exe

Filesize
390KB

MD5
6e7adc9be55ad627f8f61a2790f8d089

SHA1
49d9541cd7b6c24c8e1b8b780c5000efb4821bd7

SHA256
5d49d5e03395e4289c79a8e84104dd7a043d4e5900987af2f2c29fd67be91105

SHA512
62406bd825153c9abb647347c4daaba3a4b45bd1d825fc3186d7c2f91af79a54b464d1346dc4253dcd9ce8dcc29d0b1468a5fb0a19999820f4bbf037d58afe20

Download Submit
C:\Users\Admin\Downloads\PolyRansom\IYIC.exe

Filesize
571KB

MD5
dbde0dfc8b0a28cc57617d0e74cfa7bc

SHA1
1fe1616b8785697542bec66e4b755810a2701e35

SHA256
a52c11fe48d9d61dd6ef9748ac47a6e6ac0389f60c4147f25a91987359b59783

SHA512
9c96d89ed07f0d6cfc8b3e2fd1b79d934bd1dca8d55527c49d52acaec0b80349870c121b5c5f8a6110b2a05eccad100d4aef782f86acbeef20f84be54a3f6174

Download Submit
C:\Users\Admin\Downloads\PolyRansom\IcEc.exe

Filesize
208KB

MD5
0c0b42a61f2da82a013b44b9c2f78379

SHA1
cf25a8e13741120c0a87a5923557c42849fee113

SHA256
853f2b3bd08465507c37648bdaa356b1d2192da15d3d315656f191425cd45f58

SHA512
3bec767c8b8278d8be9ac0604ff2b72e8b34eac44deacc60b10f5c90bee3f023c138dff7a45caa5b8a644f698fdd30c4b0ceaecbb57c9fd78536f23a5a6c8447

Download Submit
C:\Users\Admin\Downloads\PolyRansom\Icow.ico

Filesize
4KB

MD5
ace522945d3d0ff3b6d96abef56e1427

SHA1
d71140c9657fd1b0d6e4ab8484b6cfe544616201

SHA256
daa05353be57bb7c4de23a63af8aac3f0c45fba8c1b40acac53e33240fbc25cd

SHA512
8e9c55fa909ff0222024218ff334fd6f3115eccc05c7224f8c63aa9e6f765ff4e90c43f26a7d8855a8a3c9b4183bd9919cb854b448c4055e9b98acef1186d83e

Download Submit
C:\Users\Admin\Downloads\PolyRansom\Ikke.exe

Filesize
825KB

MD5
011a7c3b8125bada38136a14a2549886

SHA1
e0b635ec8ba1b2992a1bb2b018e85b83d3c08ec1

SHA256
93900aec034a32431fd33c455618542a7e966eb6522cdb8694cc67f722839537

SHA512
b27dfc5bf70013b589aa5b58020025fe21195e8c65f937edf56a296c07fd57398c7e8eb9b80d0218d916e096d2af1285330b550f3658c1db722d8ac3ec2f5dfb

Download Submit
C:\Users\Admin\Downloads\PolyRansom\KUEO.exe

Filesize
767KB

MD5
699333207615426239df5077371e5227

SHA1
488254b9b0880e7b12562dde8982b566598e8d6a

SHA256
9ebce65d0030c07c72b1bd7b7c029a498383ec616b936bd888a474c8083faa46

SHA512
16c4aad96b41b54558453b7f7ba6189316e44f0fa7c5c1c9dbd74cb92c926468a3525761c19371c9b5f3750e07cd9217d270ab60072b4549087619e942ae2710

Download Submit
C:\Users\Admin\Downloads\PolyRansom\KsUM.exe

Filesize
1.1MB

MD5
8c5a7bc7be4ef47933b8b6381dbde89e

SHA1
2a6f87065c1be513d3c65256c9a955b1d16544a0

SHA256
a7502b78fe71e0ef61108f185c439f8cc4ae23b13d984ffb8c9052748ad468ff

SHA512
b9e83a3a7ec45ee7c0d4a9cb9f2b1d9aed5a42b38a673ffe2ec4b633be1e6001a61f4ea1b20a5b4dfcb71cca85b64f7394cbeeea8760a137d91f858e61adee3e

Download Submit
C:\Users\Admin\Downloads\PolyRansom\KsoE.exe

Filesize
795KB

MD5
b8f531d62088a29ea6eaee9c997e2c2b

SHA1
a61fda7ff22bb1ca923e71ced0ee9bdfb1cb8f3d

SHA256
9c23a3b0d48f244784320ed3041f90a2a5782932f08a45fb58578470e1f874fc

SHA512
1b4a38aa18aaeb9b74902176f0fa24a5caa38575934e52daa065de9558751f58b2be1c87f42b4759a287a9323a9b35d17ba7131b65b79c18299e321cbb7a7e37

Download Submit
C:\Users\Admin\Downloads\PolyRansom\MEoy.exe

Filesize
642KB

MD5
904517267f312650e399b4f640dcf89f

SHA1
7f684166336f787db6136e011c4a527b91ec823c

SHA256
2473619676d0fb64fbed8a4d2889cd639a0390ff069587b419c5395c870ad36e

SHA512
c6f0309eb96c21e5760494fd3fc48ebcd5e0cf27f97d3c3e04d92e9a7242b7ebf94b68838e11cea2a75f1d6e26ca6135ff99f88107fa622124c7070449e95269

Download Submit
C:\Users\Admin\Downloads\PolyRansom\McgE.exe

Filesize
215KB

MD5
9f826c4fb21495a7533462aaa7644da3

SHA1
94e866587765a08644ca871422bf1f422dc671b4

SHA256
1f4ec9d2cb4a95c9e80a107eda26bbc49ca62d767dc4910c67e3dced35138d69

SHA512
b7d29383b6a678d2b43a9a9130961ac9c7631865babf18e63d737561f0a5c445331c93d2fb8112b6f1bcb29c9240676aa2fe6eedce8c7e70c0e8c517bb9e88c7

Download Submit
C:\Users\Admin\Downloads\PolyRansom\Mwss.exe

Filesize
374KB

MD5
bbca2fdbb39514ba17ae38b0929b84ab

SHA1
eff2328c099ccfc0420ef782e636e884ed787fa5

SHA256
c21ca2340411a387afc62fb3f41f6191b12b485199d7eb67ff52fb02aead6c73

SHA512
3d0987570a3afb1e0bd0659d8e29c0fc3b0640e4132b4763ff80a4da3d034ebda26b6846ec2be1388a7ce29ae42f7df79236beefbe2e5907fa6f37ba0956d41a

Download Submit
C:\Users\Admin\Downloads\PolyRansom\OMYg.exe

Filesize
306KB

MD5
9f4c2da78df3d96b0ec4b81ff57efa17

SHA1
2838671ca4f2b87336f92462efd6daccb279f7af

SHA256
d9d4aad15200c3d9332877b4ad82ac6eb09a41ed15f37c397c119e341f797412

SHA512
57d2aa1598e0d59534c17b538de4e9b13c5df599e11149d1a53ba2b2637eaef949c5252f86cec3b74c5afb5fcfe5eb2a253476c5725b53249ff40d4fc07fd8ae

Download Submit
C:\Users\Admin\Downloads\PolyRansom\OcEe.ico

Filesize
4KB

MD5
f31b7f660ecbc5e170657187cedd7942

SHA1
42f5efe966968c2b1f92fadd7c85863956014fb4

SHA256
684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6

SHA512
62787378cea556d2f13cd567ae8407a596139943af4405e8def302d62f64e19edb258dce44429162ac78b7cfc2260915c93ff6b114b0f910d8d64bf61bdd0462

Download Submit
C:\Users\Admin\Downloads\PolyRansom\OckG.exe

Filesize
188KB

MD5
40cc9d36266e202a7db268854660a286

SHA1
e3ebc926daa9132be70d624c46c894979da59bef

SHA256
6eb1b2fe235554660454c33fc40670c49b5e11f05e3c05ef5b0eb97b2959b1a7

SHA512
55dca178d410cfbbf0fc82826e3b9609711a8352160bbbb1910f938a266a56378eacfaf293d07d5b0f70d6f448a052b58534327e60ab9b8741637a320859a005

Download Submit
C:\Users\Admin\Downloads\PolyRansom\QEsa.exe

Filesize
433KB

MD5
d69309e3b3c207f740937fcae123b477

SHA1
940432841ad2c3656e7debf9e8dbd3af381f3b3c

SHA256
d118d6df1f9a2112eca73050e64e4dae291c771d03632e9cffae5b5ee9f0ce00

SHA512
a43dcc9096be7605b722c6ee89838951022e7da231f743c586d3db60589c0933b263bdf11eeabfd470ce1dc3c775a759c40350cefccf053f8c5afe64fe0ff079

Download Submit
C:\Users\Admin\Downloads\PolyRansom\QUsC.exe

Filesize
208KB

MD5
f65c3014e94deb9df15f4538fb098846

SHA1
0be49177f84d1c65439c08841883604acd437df4

SHA256
dcded596becc2b3f22c2e09d48e9c5fd7e93caa800b6c3775f334ca994050ac8

SHA512
ebaba4b6770690fc0c3095c4aad39f0ac90c95a7ecc21b78fc8d11199889408dcae1926773cfbdae36ecc02d06d73e9487353dc4ff158c4ba7cd00162a96e45e

Download Submit
C:\Users\Admin\Downloads\PolyRansom\QYMM.exe

Filesize
196KB

MD5
31283a01d33b9a4e1a6e7c44b2b404e9

SHA1
46f7b0ab75c01ac6ef17a72499ff496b0e04dd3e

SHA256
92e970e46f2c75c8d968c753485d81d5e514ddb990e6dda2cc3b45e7f79d8787

SHA512
b65a2d46e52f108927bb498020ea1521ea5c8072f7741ce1b0558ea15d379582d56c828247ead767b529aaef1f7dd58afae7922a09f0642e9a0cebcc564a739f

Download Submit
C:\Users\Admin\Downloads\PolyRansom\Qsog.exe

Filesize
189KB

MD5
8a818525c138734ec6238c8e226936bc

SHA1
c149908b239ea4e7fc2e0e1bc6917455360711b7

SHA256
d7208b93527225866c5b67f230355f90eb62fea767198353f27fe0b4ab4ca7a2

SHA512
8bc5d340839e58823227c9182562a30137db18d6f8edb5c17206c1854e2280a06a394b4c876f39b081d4fbb2c0f8ff91f7d3ef36ed96ef0c45b92480ed39a3d0

Download Submit
C:\Users\Admin\Downloads\PolyRansom\SIUS.exe

Filesize
187KB

MD5
85e69154f9ebf0d618474147dce2073d

SHA1
891456b7f91f02df200b84953fcdbc4067594973

SHA256
360a035d8d75b44033352791231e23da0ef840d61b9b8a2b63d27c1bde85a6de

SHA512
c0c32485172b474aabb85c49478ced44e23cc349b9b8eef828cbbd906de95ff0e65e1da15750e6e14928804ddff48e99c2d1d6fd5026924157ff3214f1dc7001

Download Submit
C:\Users\Admin\Downloads\PolyRansom\SIkK.exe

Filesize
193KB

MD5
4ad313b39de9dd5491b18ce4d419e65e

SHA1
b3382cc22d488c9ff7610473e3473787ed6141e4

SHA256
e26a19f80bbf72d639fd4a218167c8148894fb321d1a0a24a851910e5b45651a

SHA512
e349d623e095252ee4fa602cfa7da6c6c2a9fcc5da490feecea30d01a144f0a8b66522a5b14c9b38d96daf3e633e412fc9dc85e8639f6f814e4da5ca9f8991cb

Download Submit
C:\Users\Admin\Downloads\PolyRansom\SQAg.exe

Filesize
207KB

MD5
030ccd51fa29ba5293506ff994850fbc

SHA1
8b39b394f14c8990d0ee8502e533a0a25f68cfb5

SHA256
1bb2162db5ef4d3a2eab6367e6b84406a7fa607c574e9823f3f54f49fc98160b

SHA512
5a90f1daa5df938e3a03f1f7fdf71cf482efb2d3b48c4459092a09d6f832d379bfd4bab065e8c319c3ecc576f35e42c1d2817e99cb0885f2ae7be8f4dd5a3862

Download Submit
C:\Users\Admin\Downloads\PolyRansom\SQEK.exe

Filesize
196KB

MD5
920d0f2c254a3b12c87b5516d36940e2

SHA1
d3b87a289097491e2327f65d2649808c55ac9427

SHA256
ea5e1f02c0f964ca9c01756642261edb15fbf7e04015b7fcc15c8c4012f56dda

SHA512
c36563e31eda75962f132402ba40dd24bd0cfdae4aaa10e048d38295b68078605499cf64ac6ab4f8726283a055bf2981dd85022ff3df362b8f1babd64b6cc527

Download Submit
C:\Users\Admin\Downloads\PolyRansom\SQcy.exe

Filesize
205KB

MD5
bcadb972cc69a19eb7a1b51ccde91ea7

SHA1
bb3a6e2a681fef7815aa49e57a8355a5fb1a66c5

SHA256
b61c4018958e075b10d999775e69d845af39a0923ac3e8cd36c645484f9e5724

SHA512
fb39ea77a0086dd097596ad6feb07d66820329663cbed67bd589fa80f0892521ab9fde258ffcd84fcc1bc0728017229e05d08bc6b9c9d77d4b328861c1caf61c

Download Submit
C:\Users\Admin\Downloads\PolyRansom\SkQQ.exe

Filesize
190KB

MD5
a7a6e48038f633e00a74c8a0d8eeebea

SHA1
f585555ee27e35f7db90544fc106f804205b954d

SHA256
64f226fb4fcec338114b5a92da1fb86f2a3d53fc312098d7c622ed426666cb3d

SHA512
5571fb72654ac1ed7cb4c8f1e464580906721c7fb25ad823e6450facbf9a8af27b87711cecfd1a0846f7a173a9f20c3bb2f9c436f7203d74c91539a9572e2069

Download Submit
C:\Users\Admin\Downloads\PolyRansom\SkUC.exe

Filesize
195KB

MD5
784817af6ea6524328fa319db7ef336e

SHA1
b5b2a0556ff6fbbe0ab5c7f1f71ded086927ca41

SHA256
c47056e1c5e697a6f78fcd24ed500677b40d5a68dd96662c1d443af0d0afdfce

SHA512
94a68cd3982124d32db61653ab9a0bcfac33c484d40ea0c32b4bf0203213559faca4b1fbdd36af827e702e79fe309c09754940a312c7ee3c12ba43cd71a07e48

Download Submit
C:\Users\Admin\Downloads\PolyRansom\UEAS.exe

Filesize
193KB

MD5
355cb3d2d5c8263997d58e7ace92239f

SHA1
c48b4ad42bb36538254d76826a68978528afa574

SHA256
484178934cd8478904df3e3e5dbc69b16af15ea69230337c34dbe857ef42a9e3

SHA512
8cf9063aec6894fbf4edd6fdf2ce24537a7df44ee12e1876b68f6d6e82805ff4b2c08f7372bfc191a1b0050ee2a58b492e5c271294bc58821ead3140db13b297

Download Submit
C:\Users\Admin\Downloads\PolyRansom\UYwu.exe

Filesize
773KB

MD5
ec8ede756767868d90a8672034979376

SHA1
92110a423ceb158b2229af70d85ea2b15976f922

SHA256
f5d1ebc7719ea79f7be9be22549f3594d45d32bfa0ef1c504df2e41cfd020731

SHA512
10bd0327c342d4a0b5ac53621ef13de1c93eeb631fd0a8b6c9796eb2658a6e79e2d7ef870af8d6100ca033ee9169961422d1f1831efa225b35dce9a078fbd420

Download Submit
C:\Users\Admin\Downloads\PolyRansom\UkcE.exe

Filesize
201KB

MD5
1fc16b3bbe7aed4a22e21a9e06f244c6

SHA1
8cddbab98ee8635d20b71fb9ce67cbee137be99b

SHA256
68cde6f2da7f1904a7403d29ef0229d8c7ecd5678c0aa0b910985c79dccf3cd3

SHA512
e0783b7aea7539d2a1201fe52079db8c8fb43d7433623ebcd944e471b4a439e295e7aaa6cb4dc25a1350429b9e33678df907188a7aa211c178aa67c339bf1ecc

Download Submit
C:\Users\Admin\Downloads\PolyRansom\WMQO.exe

Filesize
216KB

MD5
f0307cd18b22a32824163770e5ed28b8

SHA1
fa7fd82c0cfc15eff2c0738c147ca5833446ffea

SHA256
530391ae9f69f69107fd751a679d8553712e5e853fd8803b9f13a1b942867fe1

SHA512
df330007d97949ee3515b1c4d310b1a3f76cf16966e35d9f3cb20ca50c180cb373c9764ed8de5c3b7bc999ab13c2884b3aa629e7ad9612f51e715b0a2b771a11

Download Submit
C:\Users\Admin\Downloads\PolyRansom\WUsk.exe

Filesize
184KB

MD5
c9deff69b370df505883cc4841ce9d22

SHA1
e0603f4a9f0768cad93831e263983f20ddb3b390

SHA256
c01937ea28f08f2c59910d90c0a37bdc7aaa9e7abaaf41ae053a0848cab7b9d6

SHA512
1000cb7b715fe7893226e47165249dd83da49a608842a9250bb8034e054c77d40cfdd7d146bf6d366ffa93220f2b7a59d98374dde7aa48e235c03e4ea3bf08cf

Download Submit
C:\Users\Admin\Downloads\PolyRansom\WgYc.ico

Filesize
4KB

MD5
8ff64aadbcb8620bd821390e245fa0e6

SHA1
4d03910751bff2987d165c7c43e52851ae064239

SHA256
38d6a9052a4fa9fbd656388704522cb851247c32650c387c19b15cd28ff3b6fc

SHA512
b5d4dc4bea4ca5c7238d875f2f934f5813b97100e364a16c4c6bc800e9a6df06a3075d7807d8ab42e551faa3f8a870b21abb61ae4816ef95f0e7163df5f62ecb

Download Submit
C:\Users\Admin\Downloads\PolyRansom\YAIy.exe

Filesize
198KB

MD5
35b722dd2006461200cca2346ac21fc7

SHA1
e6e4eb70d7b88750dd98710492fc1902d4d26514

SHA256
fffd1021d7f691ddc40faee4b4e231049a734746c769677bdc15a4a8064617d9

SHA512
a6d73c61dd117db798fd429a2266cbe39c5766b6848f4fea10e0608f5da2204c1e6e3c829cdea13771e94a3d244c0a18c4f7a474c5082ea03e3a609da5e24e39

Download Submit
C:\Users\Admin\Downloads\PolyRansom\YEEC.exe

Filesize
806KB

MD5
9569417d67b8c4c14a4a69f9a5ff31a8

SHA1
decf97a53c662aee0cf3364ce3a64a9cdd283889

SHA256
68ab1e78bf294b516dcfc3353253a058fd93ae6d864ee40b4cd61a6132508f66

SHA512
f28c5f552d79a794b00c903163ac4438273b6850cdcf4e3677bb22dd80eeba0ca0e4e9da0bcc7d95b709d91cbc67d1d140f7ecd0d4e1e6a7ab191f51f6e1cc7b

Download Submit
C:\Users\Admin\Downloads\PolyRansom\YQcG.ico

Filesize
4KB

MD5
ee421bd295eb1a0d8c54f8586ccb18fa

SHA1
bc06850f3112289fce374241f7e9aff0a70ecb2f

SHA256
57e72b9591e318a17feb74efa1262e9222814ad872437094734295700f669563

SHA512
dfd36dff3742f39858e4a3e781e756f6d8480caa33b715ad1a8293f6ef436cdc84c3d26428230cdac8651c1ee7947b0e5bb3ac1e32c0b7bbb2bfed81375b5897

Download Submit
C:\Users\Admin\Downloads\PolyRansom\Ykwi.exe

Filesize
634KB

MD5
7cc2a010002558f4daa76c75dbe01659

SHA1
a1e2265c5dfbc3809c88f191a00605bd240e8c92

SHA256
c722cc0f8f5fddf94562395c87f09a5644c512c92e00393ea9e7f37ac6d8fa35

SHA512
d9f8c13dfa807bc390e88e7eaa26c7deddca7197ffcc4602d8dc0b041eadc12d849e06866e0e2180990aeabfc18fb3c4bd631986ad749c99ef69a0f49a34b64f

Download Submit
C:\Users\Admin\Downloads\PolyRansom\YwsK.exe

Filesize
202KB

MD5
ef503e0d5e61b449e801af6a9ac8c41f

SHA1
94615d32b9307b37d4647e7f4dab19b75e9a4834

SHA256
5441f9f0b1f6ec3e00c0fe0db9800e89c0c09f0b830ff68354c9735175837156

SHA512
33a4673ac58b961538df16dea8ef1879e769dd8be5853b2bff1e6eaf26e1e84209a9d791687c9514773637d08772700ad6dc1e0414877959297974ba369c9375

Download Submit
C:\Users\Admin\Downloads\PolyRansom\aQcS.exe

Filesize
195KB

MD5
4d986024b53f2602f50db3a80b112bff

SHA1
88ed428e18a2a0e3165af1a2bf1f36bf6cee06e0

SHA256
2149ccc56b4bed7ee70df3f2348a23c5884ca6be6831e8ce3394247d2d5537dd

SHA512
611556dda21a3ba09e763ab41db5f326f254cfbd2f80c702f2be8a789f5e9ba4da96f38358d29d39df1196a42db5cc2dd34e1b8296cf5991996cdcef704d6850

Download Submit
C:\Users\Admin\Downloads\PolyRansom\cYIQ.exe

Filesize
247KB

MD5
f0731b0ab99db02abd1a3019edfeb9ed

SHA1
361fbbfb161c728c39abd23c1f2000e4d6b5b2de

SHA256
44ef7890d7f65f5385107967902bf9663198695592c189dcdb7967d0ccfba52a

SHA512
017b02564cac4ed2c14df4646c5daa6757eef8d321d07a2fd71ec0759c27963cb5be46da090563436fe48ce5be9943f47ff52bef1038fc406a271f3c39545a27

Download Submit
C:\Users\Admin\Downloads\PolyRansom\coAG.exe

Filesize
197KB

MD5
25afb1b893d73e73ada1b0aa5c2c0dd6

SHA1
deee6ecc3a5eeb2801c5cf2f3453ae3b32b90027

SHA256
677888d74614e3c0e8e83f85b9d4c041a67cf82758b154af3b4ddbb0c41dc17c

SHA512
77d03338b2508ec227021ad56d2a73d64aa4a31caff680028b992c9da70aaed0b81b653ed9c0af343c33177741f725826cdeeda62cb93abeeef621536ab7c6fe

Download Submit
C:\Users\Admin\Downloads\PolyRansom\eEcE.exe

Filesize
235KB

MD5
d582711c40fc29588c1439e59d678baf

SHA1
c0e8b23ad867cf46194535ce9b95283f1293c52e

SHA256
ac62202f1aaecf783a51f33a0e215b4c4c5ea733077d6f9ef31000230af6a62a

SHA512
041ef05ecb49da772762fb36c20d0bdaf92dc5a79a75cd079fe150edbb1e51b068ca5d47e16fffd26f6dd2d364307faffb7c28c2021c4fd9c9cb6b40755e0f1b

Download Submit
C:\Users\Admin\Downloads\PolyRansom\eMcw.exe

Filesize
439KB

MD5
8b8d506af244823fe43942d4ae88ab06

SHA1
a92c4f62d184c82fc6d05dae9120ed9513f937fd

SHA256
049a8077bf192bfc71c0c44978ac55d53eb370ffdebbccc1751a36ce3da69459

SHA512
3274e87cc68f0d4e0d2280b9597e3e2eb5e016e57f4d8581401cfce1d9ea3ea83e842ff08c170af92597d42bfb3001a82c34a8ca69a385c887232aba708472f5

Download Submit
C:\Users\Admin\Downloads\PolyRansom\eYku.exe

Filesize
189KB

MD5
17d939ab14af63ca277f7e0f0561e140

SHA1
b7a64592b96c64ac05063f909705d7ef8e19c7f5

SHA256
bc3b08e804313a748a4060aba8e1177fb95ef395d99ee34340d2c88f6df2ac21

SHA512
e54a2bdade2bd305dab09551cbc991f4e3190f05f51936a8be3f9a7ebc734706352b1f7ca3ba3b68f1539bd542b4a848e4b37e1c501f4b906cc69630378a62cc

Download Submit
C:\Users\Admin\Downloads\PolyRansom\ecEs.exe

Filesize
188KB

MD5
7078a59c9ce22713189cd32f880f8a89

SHA1
cd66bde5276f434761a8e72f0d7d6175faf12b4c

SHA256
585c541001538caa67123390dec91b76812506b4a126b79bc6c2e2e091110466

SHA512
73fe71bd2f8b896ddcd3bc5ef91df10e445e48aa09f5324e80499bbf9c6fc7973301b512e862c1d4ab65c144433b4e9347ee889d640c0757adcf7d1794b6557a

Download Submit
C:\Users\Admin\Downloads\PolyRansom\esAY.exe

Filesize
418KB

MD5
08925bf1e3a3b798c494aeb68aa2aa44

SHA1
9cb656431b19c73124dcd570a0bfddc03f994c74

SHA256
ae015a5ddff15fb3217e845312783be67ef4903c2bb69050389049b9cb8a3e16

SHA512
ef68424ceae1cb750f8152f84d65bf2065bb8ce9a4be301acb0fe97c1163fa647c8890a979238c06d141084f185678474ce56bccadd1492db28ca36301f6dd98

Download Submit
C:\Users\Admin\Downloads\PolyRansom\gAgk.exe

Filesize
535KB

MD5
b64b809b79a360cdfa2070e3b08ea528

SHA1
d33a62c72cf1dedfe4eb5075af3a2a9621aca0c1

SHA256
134837d39cf76bf1c5e1884d4bc76f712347467ddc04de9cf61e367a2cb63ec3

SHA512
f1105404c176d2aaebc5ab7bf85417041fd22df5ad95468c6bcc0f78c936dbdab13a92c312c8fdb01248498015370b45b37dca5a2739c2f39048efaa1464cb52

Download Submit
C:\Users\Admin\Downloads\PolyRansom\gUEQ.exe

Filesize
437KB

MD5
9278130046f4bca9a3e5308c624cde9b

SHA1
8e5f6408914a70c37f2d23b9ea0729321e88e5a3

SHA256
7544c8d50ff3c78ed22ee06047ee7e5f846d19089c9992e7e4d7978c85538a4f

SHA512
f98c1ba7b083be3111e4be9eb90fd8b9833f4de8930fb10ff80d09da96d389918bc7a582e7decc52d797bd7a70dcb3bacfb1fd89a4d7a76636a48cccad51c8cc

Download Submit
C:\Users\Admin\Downloads\PolyRansom\iIkk.exe

Filesize
211KB

MD5
143acb6bc0cace5a5e9c3dc9ace7e2e3

SHA1
6bc578b2b95a9dcc9dc508986baf3eef88ed8c96

SHA256
5aae02c159280d39d869ca0fd0e8a538a8341e743b89075a6879f4c0b63c56eb

SHA512
09917b57d7f2f9baa029e4a24e40d3b4d0a30ff6c9788c55ec376ef9eb5a0da8515ebe432de4cd67ea7f829e73f4e7e6a2566c5631500e685f1d5f77289d7627

Download Submit
C:\Users\Admin\Downloads\PolyRansom\ikge.exe

Filesize
214KB

MD5
318b5e00bcbcfb4f5433028b3eed0c33

SHA1
175ecd5750555ee80244d5e484d6d3e104aa6f6c

SHA256
1f8b6f9730381e804ce5b4b1f5c378f96323f5d8a0752efd0e213a7bf5492e02

SHA512
cae85ff48b3a7a59ba22603d9a6952f8882d9a1b596f51199aac3aa961b821ca13f1aa2ae92bf069152387d3da9b3da9bbcf29e7c8162a4536ccd45a7fd45583

Download Submit
C:\Users\Admin\Downloads\PolyRansom\iswi.exe

Filesize
816KB

MD5
bab46bf548c864d0ecaba5269b0b3d17

SHA1
a29fdb43308c88c650306bd1e24fa87e9bf087cc

SHA256
d6be2e7833517ce579df92b5eaaf5cfa5629c477bd03381b2b869b68bfbb6462

SHA512
3b2a4c747e38dc9348881563a39ccb60af659967cb694cc82e4fe3863dc0daadd3e13b8caf3e98833624a80eaf3c74cf0d96313e6a740ea2830a517d5067c444

Download Submit
C:\Users\Admin\Downloads\PolyRansom\iwkE.exe

Filesize
197KB

MD5
3a73c7043603e8514697e300671325b4

SHA1
5e8e476bbba85dccbd3285b5c20e41d5045b7de2

SHA256
b5e173389549af017d07166c51eed341a90225d50e7ad39f4cca2be5fb9a00c7

SHA512
6bba9f139c10650094cd961af709c4b5eadefd08552291390837a15392310e085c7f6dddc305f33f3223bf06b9e32d6a659f9bba548cffa1b80967d43a7a165a

Download Submit
C:\Users\Admin\Downloads\PolyRansom\kMQO.exe

Filesize
201KB

MD5
feb046ded027a3f1ab396d6b5b0669f9

SHA1
a4d9d3cc6df0ff0a2051479746fd240a14462b45

SHA256
8a39f442c5dca1e49d11c9d24be0ca6dbfd7aeb29a7973b593dc56d25c1e4e65

SHA512
72452cef8e614b55315e9725cb04a7b2301144f96761001b9381b86d46c8b5f50157a77f9c5785776e7eff20d1936a470172659d0947c568eb3fb1f19d5b2548

Download Submit
C:\Users\Admin\Downloads\PolyRansom\mQIk.exe

Filesize
198KB

MD5
2eb787139c941efe364bb00a1a478e3b

SHA1
2f3867e86c6f527656a26063b9d3eb9677f34e3e

SHA256
f4192a8cc2b4455d5e7271be454205821c59a7d575e16a74bfb498f4f7068583

SHA512
23566d8d53d976a1b71cfddef388208c0748e7109cab0dbeea5809ad7eb34d2dd66dcf3e0150152241a4883808204021862d5a346136ec343d10cc7f7a017a38

Download Submit
C:\Users\Admin\Downloads\PolyRansom\mUoc.exe

Filesize
268KB

MD5
3090dce9e6e78ab848cdb0c325d33057

SHA1
dbef83e2b5e863b822165dab22510e1157bd0a18

SHA256
4a8dd9b609417aab4dc08c382c94f8e7cf6b045e07d083591e28802f575fdcbb

SHA512
1742155983d43739bb6ad0a07321426c1faf9f738c95511a8d7f36bffda963e18ecb24e055170c3334e0f31ef067ac7731a79956b39ee840c5d10ced381c0173

Download Submit
C:\Users\Admin\Downloads\PolyRansom\mYwY.exe

Filesize
203KB

MD5
20dfc247c4f50675eeec45ef4b0b8856

SHA1
b55cfb662c3aea2925118d378ffe589835bcb585

SHA256
cd9bdd2da3afe7d830b32228dd992b1f31d5140d8c323dc32a1f2dd5f94a2856

SHA512
2ab771f83dcd1429b01933e6629303b5aa51f70cf58f758e41704f30b68fe85d30f2b67d5849b4c4cb579098545d802529ea8f5008d8450823388ac48ee918d1

Download Submit
C:\Users\Admin\Downloads\PolyRansom\msse.exe

Filesize
200KB

MD5
53a8af8e7cef4fd13e1bbda109c32d6d

SHA1
e5ecc0a2c01e0453ab4be5e2ea8a5931485d031c

SHA256
31d671c7513feda2167590ed842700b96428fec899d147bc3bcb06e09dcfb9cf

SHA512
f425614d3cec26eae92ac07e7084cf22cb98a62ec607fe19d0a576832f0785fc08ce3bf2a5daf7ad3861007d148f862833b7b3c0d061752afc721b0980d44ff6

Download Submit
C:\Users\Admin\Downloads\PolyRansom\oAgw.exe

Filesize
190KB

MD5
c3fd39fff9a9e3f488fe9b85e49d2575

SHA1
5559769c3442f08082f9ba8ac54b17ecf38e32da

SHA256
716965251dedc189339c354fbe19bcaedb7eb2c18818edaa58c1b92341080bfb

SHA512
038e3f6c5f77b147e14b9bcfbccc94954d4fc09225f4fe71b8a6a8ac7f78b5b6c56d84c316b9b79e2eacb6f7c80f5b77d8a85758f5064c7513ade2b2047ec829

Download Submit
C:\Users\Admin\Downloads\PolyRansom\oUEK.exe

Filesize
202KB

MD5
7c43a954cc042a51999878adf1a2dec9

SHA1
acaafd65e4705f75f3bbdb977135afcb73067025

SHA256
e5c5ce5d67bfb656f7a6499e688b22c647dfb0f2a986a903f709690f861e21ef

SHA512
22b9a4c36e75b0f5255892c657c0cdb5c8faa3550afcd2ca6b95508345f011eac6055b6cb520d7bdd72fde2ba3ac746fd7aa5089228ae420198299667113b6aa

Download Submit
C:\Users\Admin\Downloads\PolyRansom\ocYU.ico

Filesize
4KB

MD5
a35ccd5e8ca502cf8197c1a4d25fdce0

SHA1
a5d177f7dbffbfb75187637ae65d83e201b61b2d

SHA256
135efe6cdc9df0beb185988bd2d639db8a293dd89dcb7fc900e5ac839629c715

SHA512
b877f896dbb40a4c972c81170d8807a8a0c1af597301f5f84c47a430eceebaa9426c882e854cc33a26b06f7a4ce7d86edf0bcfbc3682b4f4aa6ea8e4691f3636

Download Submit
C:\Users\Admin\Downloads\PolyRansom\qMwy.exe

Filesize
200KB

MD5
b0638bcf92c3b5d031f0d90c4c5f5437

SHA1
daf5ab05df4b02f02fae4d376828b63665e118e0

SHA256
f85f47d82dcb63d917804be5fd5955182f64b7a4544177e11e4cc6eb6b3cc787

SHA512
f4f21ae693b251b7188085f132c35e6d4c86d07aeac5a55a2261752fda6a876728bd66e6f123e673cf8b37addf068d8f91adb90b4e451ffdfb7b319f5f55293a

Download Submit
C:\Users\Admin\Downloads\PolyRansom\qUEu.exe

Filesize
432KB

MD5
30d45cc9b4807bbfbcfa1194580e3aaf

SHA1
a32ccaa3bcc71c6ddfe10196cfd0c5e328dea11b

SHA256
f25864c28b97236ddbcb316064ce4fb9c15ef6361f67f90579bde6388099bf16

SHA512
3d1ee9e9d2a8a74a7a7def570210bcac91a39c0b8d010fc3eb220dd63f26a8b0d5d6b40afa2a815de250cc3d15365b62fdea49d0434afb1ac3257f6a65757bde

Download Submit
C:\Users\Admin\Downloads\PolyRansom\qUcy.exe

Filesize
190KB

MD5
b41f98b5ae3ad01cfdeb40e07a0b9b59

SHA1
f68e5d33532a8f37ce37763b7beea157ce4d5fc0

SHA256
ddb4131b954bea45320fa5b442b5fa2d53f7fa0e564c9f8fbbe58421aab75c00

SHA512
a4ccc0f414c2b3923093e41df87ec89d22723982638118e54518906a77ed380e577b57ec5dd457b3df961790962dd1088775136c8c61d5452057f76fd262ccac

Download Submit
C:\Users\Admin\Downloads\PolyRansom\qYoO.exe

Filesize
193KB

MD5
d28c3dcdde870ca45c8e0e93a14192c3

SHA1
79aa9dff1863ed9f7850ac1955ae2f8c868a1966

SHA256
ee430bf0b61c95ae531e00758b48404d240f50cf6bb8696e26085f5d974c12f4

SHA512
15a767b45b4581d5d0d8138e0a95f583ed30983f6aafd5a4c6da54317b44f7e30a830c611cddd83848ddeeef4152472b66dcd0e78d34868ed9d258002a54d3c3

Download Submit
C:\Users\Admin\Downloads\PolyRansom\qgkC.exe

Filesize
1.1MB

MD5
e978f1d58d1b1478b3f74010df718891

SHA1
a34dfaed345f09436257ec6f7bd05bc6e17fd672

SHA256
2ed14adeca88190b7a2a7a64a55cfdc55e5d84dde31af31544d68f43a743dd0e

SHA512
347379e7fff481d73d0ec1a1d0882cc8b10cb0725312d6c6f55ea500ca36b02b44bde133dfdccdd4cf9a988a577c458e7d2e16e2dfffdc82ea020611d052f31c

Download Submit
C:\Users\Admin\Downloads\PolyRansom\sAII.exe

Filesize
623KB

MD5
578a2c71029a7a3bd595ee216b3ed79b

SHA1
98e97b8056fbe83cf9c367925bfa425b2846f934

SHA256
e448c35fe4953c3287c5e081737c83cca9df605f437badefb1873bf58f8aedf6

SHA512
cb79e1a2dde57eff7e16fc2768b5ad626ed1c9193f37bf67a04f05d8c0c9c21fa1da851d5dbb618637666039b683d80717d2dfbfdbee555afd60e2f1f503977a

Download Submit
C:\Users\Admin\Downloads\PolyRansom\sMIC.exe

Filesize
198KB

MD5
b4b31c265577e69894d04e213cb444e1

SHA1
44deb81ef3809a3ca7476cd5c75fc4e2392670e2

SHA256
93c95320b5d0f0cd41b2f16b8a04665aca1dd72ce3adaa90345e378e61122732

SHA512
3ae521f7fa5ef9c2600d0218ce7218fc5a77be3f5e7b6f33d7a9fdbada62984dad16a65796929f0b605ffc627e6150be34c72094582e3891d891702fc39f70ba

Download Submit
C:\Users\Admin\Downloads\PolyRansom\sYwi.exe

Filesize
434KB

MD5
bb4c736dc7fcc14d2f4dc7eb1eab390a

SHA1
a59ea5513ccc1f95ec71da31b71558ac198c127a

SHA256
ae0ceb0981322e545bd63dabaa9b4193ba1fcdc54f1aa31ce2a03d201139934b

SHA512
fe77c933850feff3583cfecd2c6d0081568c662327bf9336b37db401770880b4aa0fd570741a7bf060121d61057219fdb5c71c9cbffd94500f6ad13e8cca2987

Download Submit
C:\Users\Admin\Downloads\PolyRansom\scIi.exe

Filesize
201KB

MD5
e7f6a5ab4864ef8bd414d366ce4feedc

SHA1
6aeb989b9fc1143183bb55cac49200c51ea074a3

SHA256
20cf6da6df485e6146be4349047c36d4fe420b77e74e47a020d5859b7e4ecd8e

SHA512
3cf6f9703a871b62df008c60c751510eb7a3e814269cebd2d27b349d6981530a195eda53ccba9f50a5a9f0d87c76c09ce6db0b154e5b91b57e8daa885492fd4a

Download Submit
C:\Users\Admin\Downloads\PolyRansom\uUwU.exe

Filesize
640KB

MD5
0ccc99722ee5fca95cad912f2c299373

SHA1
ca4eb66236bc469d9bf67a0ff64d4c5223c46888

SHA256
7fb0dd8780a297f0772ea99daed5c7e373bf8ae4263f9ac9ea37f074a1d6f1d2

SHA512
ff1dd3afd1fc2e2afd687d35388b9d45a50abcf1bdad132e3d721d13c24d6bf822c4fa7074b26c55a0d3a68de0b12e1fa6ee8a091b2b6fb9b9aa99c19edf347c

Download Submit
C:\Users\Admin\Downloads\PolyRansom\ugMq.exe

Filesize
203KB

MD5
6804f731adc8eae5967b771dcec0df42

SHA1
b4779caeea2404a9ab74422569b147568819c2bd

SHA256
ab2ad6c4d413a3ed88c590aacd106b94d46a156071a1ba7e4b37790902c71f54

SHA512
1bf933d5a4f410a0bf7b65b70004334912d6ebbeaca85559baa3195ae9b14affa931f67907795147875525d217f1b009d9dc9772a83898a497c5e5e91352993d

Download Submit
C:\Users\Admin\Downloads\PolyRansom\uwIm.exe

Filesize
239KB

MD5
6c30eff366a49817b2b565c60ada25c3

SHA1
186225d5f325de0153cfcfd7ded7ee00397c365a

SHA256
1cf2ee83a7887cf615392eba615019cfa9cb34d82a96ebabc080e59101eb15ac

SHA512
ce36cad7eddc383e9901880095163581c7b518e06bb01ae57a4b55b1efbc33b5ec26830eea8dfbd89dbc87049e473143351156bbfcef506d80f4f6e061194a90

Download Submit
C:\Users\Admin\Downloads\PolyRansom\wEsG.exe

Filesize
192KB

MD5
a15cfb0fba423543e1ab03ff716f3d40

SHA1
7fe34af9962766f8eac71f07ae100fd619bca242

SHA256
673b3b4cdb301b7457fd66f118322306a598ff610b006da5e97bb77c48b8ceb9

SHA512
23dec672a8398902439aee481dd189f8a7965fbca0567642a6a8cfebd3c1d55d156989cc02e8ecf83562af25e5c3e80cc5847feecd3bf506e7659e8c09d0f979

Download Submit
C:\Users\Admin\Downloads\PolyRansom\wEss.exe

Filesize
199KB

MD5
55eb592b4558dd300d1d6a774d778757

SHA1
2c4a72a973c7ab5282d55c707461fe5d6acfe52e

SHA256
9be067d23feafab63a32c2264e903466630553974f2ea69cc82cab45420f407a

SHA512
9dde8de0770610540a5bacf11c9c89da30624a480cc97b5616daaecb7f13458dd11b7beaa8bf6cca81694771760942634e09c3de40275419a92443461a721757

Download Submit
C:\Users\Admin\Downloads\PolyRansom\wQAc.exe

Filesize
429KB

MD5
1899ac3d5cf8516b78b06e130e8105c1

SHA1
dcddd72380d0e9435468692dd5d31e06c7f5f791

SHA256
89daf70ad07ea0577b9bf36fa68055659e9a8216a7513fb78f4560478f5d5973

SHA512
351f3a94dc47085c2cf5aa697ee68406d890f13d36ce70c22aa80e3efa2f6aed68a277bcee8d0dccdbb45b6701371ea4b44f0729cf0a90bf5830f3ac43aad963

Download Submit
C:\Users\Admin\Downloads\PolyRansom\wYMK.exe

Filesize
638KB

MD5
67dc44421afe089c083032ecc644e8c5

SHA1
2daec5191a21b6f3fe6c66afacf0f055846b990c

SHA256
7752dd0fbe66dea2cc383a8a2f1e0d6e7b0751da51daa8f70d321feb7d849736

SHA512
9dfc2d79edf0c28a16383319897e840617f98f0082c2749b51d590c284ecebcd7986c2085f3b0c847e92576c191287f500fcb71f0db6a41fad1f90f91ec0d2c9

Download Submit
C:\Users\Admin\Downloads\PolyRansom\wYca.exe

Filesize
201KB

MD5
a7cf574a734cc05df0228c24fd2cbdde

SHA1
0042ee8fddd15ad73081e55b5e41b4f51c60ee2c

SHA256
e12291b246798d0022121668afe7f092f7021dbb3a6c9e7f54758e714a681214

SHA512
610b67e697558f54f08ba6de5e3c7dbd5003317185efe91d8b72d35a00a23fe1f48b95e56dabbd7c7f99b32e834a2932c6fbf4bfc3696841d15dc84ebbf2c7f6

Download Submit
C:\Users\Admin\Downloads\PolyRansom\wgQe.exe

Filesize
207KB

MD5
94b13759bf6b9d5913863412a04cc3e5

SHA1
b0242ec15685e953b628aaf0c133ff377867d488

SHA256
0724d2974107b0a02e24e4b645440a8e773fd0c4839c256c7db999e0b574c39a

SHA512
4033cbf6e138ca5f596d78163252daa206f35dbe6c02bac5c9ea7a60b172f8b53207b210558e2056f16eb96b1607cffb5cef93f4062f25910fccc91c9e6b9f48

Download Submit
C:\Users\Admin\Downloads\PolyRansom\yAwa.exe

Filesize
203KB

MD5
58a1a08d3df092e24f1c8b753df14bf7

SHA1
b191646d61306637235ec4eda0ae3d0ed94136ff

SHA256
f0fb83f35b01ffe9953d7614e57a410660e22576c64907c04ab34cf69817d53d

SHA512
03ab63322443762e9ffdeee1b5695de9c73bde25798a8477e6aaf2aa82df96f656816bdd981b4000bbf0d103d99d7c89893c9236daccb38c1558064c1d21423b

Download Submit
C:\Users\Admin\Downloads\PolyRansom\yIkQ.exe

Filesize
1.6MB

MD5
8cead813e15c19b9a1e2a220fc4e0835

SHA1
18b0dae32287d2159a9fb1ff21a257000da92feb

SHA256
99d56556102a15449d74dd95e933c01a70d3704ad8ba681d70943a2442ccb23c

SHA512
7b2ba8c6f2f2b35e6cf915c4732a9518017613b70ed1f7f89c0543065feb3a83ee9b7bb710e6c28720953d88b4104edc09144111c0b75119b9ec96784c3f29b4

Download Submit
C:\Users\Admin\Downloads\PolyRansom\yQYo.exe

Filesize
434KB

MD5
6778ecd8ab78710a794d7bfa82ceae6b

SHA1
cffe77d2cde76cba5013395afb6c17df0201d87e

SHA256
856a2282baebc488593877761cff366ff33988a3b92f7d4d7812796451e1af43

SHA512
68a05d41bc6130d52ac05cf1484a50e2107407495ceadecafed6859941a2503f25345eaca6d4ffc626dbae48f1b20ed7b322fc0da4a1f63010dc3f8c7a2b03e9

Download Submit
C:\Users\Admin\Downloads\PolyRansom\ycYY.exe

Filesize
797KB

MD5
6afebbcb0026b43e04b7a441256e43eb

SHA1
535e1154bc123a8dcc4a0e6f0e9b7d7cd3a78ad8

SHA256
bab259a6e0da858384b545df08dd98b1016c4fdccc2231451d0367ac13d525e9

SHA512
1142d3e6da9f05df2675242cceb7741d1100dcd90fb0fe242a6e805f95136652b3b027691b260cc2c38f516ded13af48b6390383f0bec9e3f7a24fe661993f38

Download Submit
C:\Users\Admin\Downloads\PolyRansom\ykAa.exe

Filesize
827KB

MD5
ab7854af6b0a09d22ba0051e15d04a5a

SHA1
230e41e7327a9f6a75359a41ec922942516f52d7

SHA256
1d431b93de61ed7f2d3d36699a522381c4df3ecd242563d19e26b3df9d872e55

SHA512
08f39aed909ee3cdbed8ae6cc77fbc668460188b11ebab87d31f8aac0559dc35aff86d1589fa44246544e60923e9c80b394484914ffcad718f7dfdae5c58fe95

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r.zip

Filesize
3.3MB

MD5
e58fdd8b0ce47bcb8ffd89f4499d186d

SHA1
b7e2334ac6e1ad75e3744661bb590a2d1da98b03

SHA256
283f40e9d550833bec101a24fd6fd6fbd9937ed32a51392e818ffff662a1d30a

SHA512
95b6567b373efa6aec6a9bfd7af70ded86f8c72d3e8ba75f756024817815b830f54d18143b0be6de335dd0ca0afe722f88a4684663be5a84946bd30343d43a8c

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

Filesize
933B

MD5
7a2726bb6e6a79fb1d092b7f2b688af0

SHA1
b3effadce8b76aee8cd6ce2eccbb8701797468a2

SHA256
840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5

SHA512
4e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\[email protected]

Filesize
3.4MB

MD5
84c82835a5d21bbcf75a61706d8ab549

SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\c.wnry

Filesize
780B

MD5
8124a611153cd3aceb85a7ac58eaa25d

SHA1
c1d5cd8774261d810dca9b6a8e478d01cd4995d6

SHA256
0ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e

SHA512
b9c8dfb5d58c95628528cc729d2394367c5e205328645ca6ef78a3552d9ad9f824ae20611a43a6e01daaffeffdc9094f80d772620c731e4192eb0835b8ed0f17

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_swedish.wnry

Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_turkish.wnry

Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_vietnamese.wnry

Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\r.wnry

Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\s.wnry

Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\t.wnry

Filesize
64KB

MD5
5dcaac857e695a65f5c3ef1441a73a8f

SHA1
7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

SHA256
97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

SHA512
06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe

Filesize
20KB

MD5
4fef5e34143e646dbf9907c4374276f5

SHA1
47a9ad4125b6bd7c55e4e7da251e23f089407b8f

SHA256
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

SHA512
4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe

Filesize
20KB

MD5
8495400f199ac77853c53b5a3f278f3e

SHA1
be5d6279874da315e3080b06083757aad9b32c23

SHA256
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

SHA512
0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

Download Submit
C:\Users\Public\Desktop\@[email protected]

Filesize
1.6MB

MD5
b38018c73d1e1d2ccbbfdfc98edac024

SHA1
865efb7365006b42501ffa4ea885d068ea2afabf

SHA256
43fdb49b5bacaecfd18d2d831938a699c9911e520d16fae7d122a89115638c3d

SHA512
0fb96e798fb5e8f2bc1aaed89151967159c924f5e64b9788ce596cd48f999b3d295a9dd8caff72eecc8d0f743d5b0b68adb7c0919a969e34846a5adcd2190ac3

Download Submit
memory/1816-1385-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1816-1409-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2316-1473-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2316-1528-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2540-1748-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2540-1785-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3800-1615-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1609-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1599-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1597-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1595-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1592-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1588-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1585-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1577-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1575-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1573-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1571-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1603-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1567-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1605-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1608-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1581-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1565-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1747-0x0000000005230000-0x000000000523A000-memory.dmp

Filesize
40KB

Download
memory/3800-1741-0x0000000004FF0000-0x0000000005082000-memory.dmp

Filesize
584KB

Download
memory/3800-1740-0x0000000004A40000-0x0000000004FE4000-memory.dmp

Filesize
5.6MB

Download
memory/3800-1601-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1613-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-5052-0x0000000005630000-0x000000000563E000-memory.dmp

Filesize
56KB

Download
memory/3800-1579-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1617-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1563-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1590-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1619-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1561-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1583-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1560-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1547-0x00000000021E0000-0x0000000002212000-memory.dmp

Filesize
200KB

Download
memory/3800-1540-0x0000000002160000-0x0000000002192000-memory.dmp

Filesize
200KB

Download
memory/3800-1611-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1569-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/3800-1594-0x00000000021E0000-0x000000000220B000-memory.dmp

Filesize
172KB

Download
memory/4928-5064-0x00000000003C0000-0x00000000003CC000-memory.dmp

Filesize
48KB

Download
memory/5528-1142-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/5568-1559-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5568-1742-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5812-1399-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5828-1398-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download