Overview

overview

10

Static

static

1

RNSM00475.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    200s
  • max time network
    188s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-09-2024 16:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00475.7z

  • Size

    54.2MB

  • MD5

    8c8b6e8695bd5235c7cb7590bb1c60fc

  • SHA1

    c90a814e4061b6aca686f74f9cf1a3c5822a2b54

  • SHA256

    1fbfdf74a1a014bf68815f4efbf04acfe304b78d8cc6e2464fc25b0b56752e00

  • SHA512

    085fef245b52daca6b447e18ac0a0169d0bed23b8be7106ae188ee8b900f21c0aa6627e3759d0e39e710955ce516144a0e55187a2dff4e28bae1c92fc79aafb9

  • SSDEEP

    786432:sVgbtJA8C96CGC9ARnR8HKw4dHmWIywSF8/M6Jfnm6Y+s6uD+/uAgjpMt9enS//p:sVUr0BbFSFz/aluD+KMt9z/mWJ95rr

Score
10/10
avoslockerdharmagandcrabbackdoordiscoveryexecutionpersistenceransomwareupx

Malware Config

Signatures

  • Avoslocker Ransomware

    Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.

    ransomwareavoslocker
  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • GandCrab payload 3 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Renames multiple (56) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Renames multiple (577) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Renames multiple (88) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Adds Run key to start application 2 TTPs 15 IoCs
    persistence
  • Drops desktop.ini file(s) 5 IoCs
  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 4 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookAW 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\RNSM00475.7z
    1⤵
    • Modifies registry class
    PID:3292
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4100
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1120
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00475.7z"
      1⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4212
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5040
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1288
        • C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.MSIL.Angel.gen-5ca8470a788aef9cf8c64c8b16f913409070c0eecc68301ef5aec8cb94d0d64f.exe
          HEUR-Trojan-Ransom.MSIL.Angel.gen-5ca8470a788aef9cf8c64c8b16f913409070c0eecc68301ef5aec8cb94d0d64f.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3616
        • C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.MSIL.Blocker.gen-772698a21bcad661285d94eba61409f9a871a21bbcb8e1166fca0e32d055c114.exe
          HEUR-Trojan-Ransom.MSIL.Blocker.gen-772698a21bcad661285d94eba61409f9a871a21bbcb8e1166fca0e32d055c114.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3284
          • C:\Users\Admin\AppData\Roaming\Wallpapers.exe
            "C:\Users\Admin\AppData\Roaming\Wallpapers.exe" C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.MSIL.Blocker.gen-772698a21bcad661285d94eba61409f9a871a21bbcb8e1166fca0e32d055c114.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1448
            • C:\Users\Admin\AppData\Roaming\Windows Objects\wmiintegrator.exe
              "C:\Users\Admin\AppData\Roaming\Windows Objects\wmiintegrator.exe" unk
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:376
              • C:\Users\Admin\AppData\Roaming\Windows Objects\wmihostwin.exe
                "C:\Users\Admin\AppData\Roaming\Windows Objects\wmihostwin.exe" unk2
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5032
                • C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe
                  "C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe" unk3
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1616
                  • C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure.exe
                    "C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure.exe" execute
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2108
                  • C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure64.exe
                    "C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure64.exe" autorun
                    8⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3504
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                      9⤵
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:2060
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                      9⤵
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:6512
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                      9⤵
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:7392
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                      9⤵
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:8236
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                      9⤵
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:9024
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                      9⤵
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:1972
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                      9⤵
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:8136
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                      9⤵
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:1348
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                      9⤵
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:6832
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                      9⤵
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:7244
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                      9⤵
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:8272
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                      9⤵
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:3944
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                      9⤵
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:9440
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
                      9⤵
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:548
        • C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.MSIL.Encoder.gen-448de6e8dac16e82edffb183dfc61d43206c83b1bd7b65d93eed0f2450d11643.exe
          HEUR-Trojan-Ransom.MSIL.Encoder.gen-448de6e8dac16e82edffb183dfc61d43206c83b1bd7b65d93eed0f2450d11643.exe
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3224
          • C:\Users\Admin\AppData\ChickiMiki Design.exe
            "C:\Users\Admin\AppData\ChickiMiki Design.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6956
        • C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.MSIL.Gen.gen-eba7b6dcd4f9889f5d175d9983718316fe66eb6a6887ed0e102a96154986942a.exe
          HEUR-Trojan-Ransom.MSIL.Gen.gen-eba7b6dcd4f9889f5d175d9983718316fe66eb6a6887ed0e102a96154986942a.exe
          3⤵
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          PID:1220
        • C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.Win32.Blocker.pef-95fec41a73473b1ccf4467874e8f1833b2a852f7703c7c134e36bfc04ee436bc.exe
          HEUR-Trojan-Ransom.Win32.Blocker.pef-95fec41a73473b1ccf4467874e8f1833b2a852f7703c7c134e36bfc04ee436bc.exe
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4512
          • C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
            "C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2512
        • C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-1c64c91268249161e66b3bb7a2c3b9f62ea21b6036a13093d84bde66bc4009b8.exe
          HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-1c64c91268249161e66b3bb7a2c3b9f62ea21b6036a13093d84bde66bc4009b8.exe
          3⤵
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Drops file in Program Files directory
          PID:4340
        • C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.Win32.Cryptoff.vho-fa5300fa49f861f9d505c8887d5f4da508fca61d592adbbb4cbecc9882a85264.exe
          HEUR-Trojan-Ransom.Win32.Cryptoff.vho-fa5300fa49f861f9d505c8887d5f4da508fca61d592adbbb4cbecc9882a85264.exe
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          PID:3440
        • C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.Win32.Cryptor.gen-718810b8eeb682fc70df602d952c0c83e028c5a5bfa44c506756980caf2edebb.exe
          HEUR-Trojan-Ransom.Win32.Cryptor.gen-718810b8eeb682fc70df602d952c0c83e028c5a5bfa44c506756980caf2edebb.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4000
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "$a = [System.IO.File]::ReadAllText(\"C:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:6188
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\1927882244.png /f
              5⤵
              • Sets desktop wallpaper using registry
              • System Location Discovery: System Language Discovery
              PID:6880
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False
              5⤵
              • System Location Discovery: System Language Discovery
              PID:7068
        • C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-c66034fc4aeab446fc483db24feb82c3bf017ab4355d6dce261a7aa344d75a4b.exe
          HEUR-Trojan-Ransom.Win32.GandCrypt.gen-c66034fc4aeab446fc483db24feb82c3bf017ab4355d6dce261a7aa344d75a4b.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookAW
          PID:6140
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 6140 -s 472
            4⤵
            • Program crash
            PID:5576
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /1
        2⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3056
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6140 -ip 6140
      1⤵
        PID:5416

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\GET_YOUR_FILES_BACK.txt
        Filesize

        1011B

        MD5

        d90d05a5fea9c28b3bf2b55f808c3a45

        SHA1

        7774c79c85b4401acfc56002f9e8a3e10e8a7b60

        SHA256

        8a9b224d68a718e7cd4da069a158408d9c71fb8ecc4e4a6581982d7a35b29cec

        SHA512

        783d830a0d75911da6878ea58f7191f1438a429e232c63db86e6f09a1bb390ec7ee72f10db1ee695177686cacab24c9e58f61e7d403d75dd9c817c592131170a

        Download Submit

      • C:\Program Files\7-Zip\7-zip.chm.exe
        Filesize

        1.8MB

        MD5

        afe2174ca587707b863bf4902c9852eb

        SHA1

        2fd0c70aa2e8c462926cf5501b19ed525e88efab

        SHA256

        6573fd48947b4548e337ee26a4b142687f3e4ee37135f007de6cdd49aef1aff8

        SHA512

        8c01622fbd596933ed828cb7e55146c3af93b74819fb87fef26a7531e5befac242bf92c97ac98fbbfcda46c93b1293c6e5f834160ff10c4e940db04d383821db

        Download Submit

      • C:\Users\Admin\AppData\ChickiMiki Design.exe
        Filesize

        16KB

        MD5

        63c98db59f68e9b7fa09d35ccfb271e7

        SHA1

        d650c52ea22f0e7f93ba724de4832c3a48767c5a

        SHA256

        ccba0b2098c98d0dedaf16ae5e9ca302c25769f5a312968347ddc8b2129b0513

        SHA512

        3900af4b16c3d585b102f2950f457e4ae119dce684199e34d14a7bda516734a8debd96a061bf4e3ab9b9140d87217f32c064d9585d4ef0896404462d226fb675

        Download Submit

      • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
        Filesize

        64KB

        MD5

        d2fb266b97caff2086bf0fa74eddb6b2

        SHA1

        2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

        SHA256

        b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

        SHA512

        c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

        Download Submit

      • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
        Filesize

        4B

        MD5

        f49655f856acb8884cc0ace29216f511

        SHA1

        cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

        SHA256

        7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

        SHA512

        599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

        Download Submit

      • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
        Filesize

        944B

        MD5

        6bd369f7c74a28194c991ed1404da30f

        SHA1

        0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

        SHA256

        878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

        SHA512

        8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zE470D9A28\00475\HEUR-Trojan.Win32.Crypt.gen-c5ccdeea44050d8be9cf04b42ba6336dfd81e4a930ec6cd916f5f4e3a5f713bb.exe
        Filesize

        253KB

        MD5

        196ef716e51eb90f7ffcfd2219ce1d5e

        SHA1

        3c5d438cb3dee2b0474ea45be67069db184e26bb

        SHA256

        c5ccdeea44050d8be9cf04b42ba6336dfd81e4a930ec6cd916f5f4e3a5f713bb

        SHA512

        e303bd36a6cd409bf146b0716a52c50ab5069b3dd513303a8c63c1494013450e5a84ee0bf7eb5d7396946080f57ef08275e09326bc2bd3fc80f94f911e872759

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zE470D9A28\00475\HEUR-Trojan.Win32.Crypt.gen-e419efc94e3209360dcacc40d27f3b45983940b490e89b5085226c172016eb2b.exe
        Filesize

        516KB

        MD5

        c0600b4147dc48f8469e7f49aa2fc1b9

        SHA1

        cce3d10ca67f4c5e36f6c8234cdd80b5a034d46b

        SHA256

        e419efc94e3209360dcacc40d27f3b45983940b490e89b5085226c172016eb2b

        SHA512

        68a751e90982c9906f539c5bfde8052ec28695c01da86a54f9d7b06993924013d3f5edf8c3aadec327ce8d77a003d0d580426e60d3857a7c2e5076357879915d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k02fs3a5.3sd.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
        Filesize

        52KB

        MD5

        89af5e1c7d17991e59919008c51a96bd

        SHA1

        9642f4111f24fa06ddeff2a309958042ad55828a

        SHA256

        0d0e6f5a21f63729c8dc03d7d7f5bc69452462d5c742a7538f178e9769cfb4f9

        SHA512

        b4c17aef39f274e1a118b601003b01bd30d946b04368e794a62141a4ed7af7d7bc33737ba2fa95b2e4180ceb1971afc65af5c347adc5bd0f579520fda5732442

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Wallpapers.exe
        Filesize

        1.0MB

        MD5

        e5dfa48b05eccf2c98a22d38477c3d5e

        SHA1

        4dbc7e6940abd0ec0307f4720d8a6e54d327e527

        SHA256

        647c529f721bc1b5f57369411f57e888cd6a13bd12ddedc63ba101563aa5ac29

        SHA512

        5ae80b803b71c84e4aa90ceb2aa8b68aabcfedddc20ae65f90372176b114a411b39ecca79847f14c8f9f94c185b949b0d2ca1de237267dd33a789c3481ee71ad

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Windows Objects\wmihostwin.exe
        Filesize

        1.0MB

        MD5

        d89f8e58cf8d768223f26275c2f35e5a

        SHA1

        e570e5d715f1c97bda71aee7ceeaa8b95247beec

        SHA256

        c063f7239739aab8afdd9c57662cb682a22d96297e5ee8b14e3242f471107db6

        SHA512

        f7060f7b0a3455a30ef45609691844899bb1f2a93724658094023207044841fd07db3a6bd50523e27b0b4d6644654423c8582857b3b8f63a8c3d324939e2b4e3

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe
        Filesize

        1.0MB

        MD5

        814c969e91c36dbf6ccce8124e3bcf9d

        SHA1

        7abfd1a14c13f91a7ad021ca5ded3c2bb1c66c4f

        SHA256

        65509f6d92b38abce1195045a9e58433bed6458df16c326e5be7c5c37f5945a1

        SHA512

        5783ac9d30513222b819a1b90d7b13567cd61d6cb8bc94731971b7a2611f02170bcd0f19d39a07c9e14ad56b3df80c20a74561f7598fd919a9f712b354b5e1a3

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure64.exe
        Filesize

        1.0MB

        MD5

        0762013bab75b9f0eb6acb7203a62cab

        SHA1

        77f30e14c051a834df9fc5fc1373ae921762a5ad

        SHA256

        5e30e5e195bc74b1bc3a0e0b0cc88693d505cb8a02d57cf63ac23b044c48012f

        SHA512

        ea32e8779e7ebd64e019f1e8901de27bbac58d5ccd76d285dc340c01323447afe527eecdd83d53a2b246929857b7252be87f0839883b9ae3c02faab9bc65301e

        Download Submit

      • C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.MSIL.Angel.gen-5ca8470a788aef9cf8c64c8b16f913409070c0eecc68301ef5aec8cb94d0d64f.exe
        Filesize

        190KB

        MD5

        74ab936b5ec88d237e710ac935d60737

        SHA1

        c48ef50c560cb7f3da5b62f8710b68996493c0d9

        SHA256

        5ca8470a788aef9cf8c64c8b16f913409070c0eecc68301ef5aec8cb94d0d64f

        SHA512

        27e923abb63c2e790631ce3e1f4ced195e94a7ab92a59576916ebab5e473a85aa063e76d950366e3b877f6bab2411f93b88f66f82b11f291a474b1bb0baa70eb

        Download Submit

      • C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.MSIL.Blocker.gen-772698a21bcad661285d94eba61409f9a871a21bbcb8e1166fca0e32d055c114.exe
        Filesize

        1.0MB

        MD5

        f8fdb3c3cbe550d2c89fd8eb86da8baf

        SHA1

        7b9fa16d0ce2395447311d4e5083fe581bf3cb01

        SHA256

        772698a21bcad661285d94eba61409f9a871a21bbcb8e1166fca0e32d055c114

        SHA512

        098819cdbf4237c160e3c935977c983dfb2215927fed57c3c7379a3c6de647434983cfca40111d791a38675f0675f2e2b9bfb866472e8666272e79c9f00ef060

        Download Submit

      • C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.MSIL.Encoder.gen-448de6e8dac16e82edffb183dfc61d43206c83b1bd7b65d93eed0f2450d11643.exe
        Filesize

        179KB

        MD5

        e75a484e15eb8974b5836f57ec753b65

        SHA1

        57a4210db7527a3a42117e130fc1c4697f383c7b

        SHA256

        448de6e8dac16e82edffb183dfc61d43206c83b1bd7b65d93eed0f2450d11643

        SHA512

        7df1e73387dab3b869e92efcaf80f5e0c7d9e878c74eb0a9398ecccfb667a98edec38a7194de18d287aec1f9464b63ad33bcec7a826c69076087488a5cbac772

        Download Submit

      • C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.MSIL.Gen.gen-eba7b6dcd4f9889f5d175d9983718316fe66eb6a6887ed0e102a96154986942a.exe
        Filesize

        1.2MB

        MD5

        c0d5972cdafee17baee0e03268891783

        SHA1

        fbfef0ea258095aff9d53b819a7174ec52947ba9

        SHA256

        eba7b6dcd4f9889f5d175d9983718316fe66eb6a6887ed0e102a96154986942a

        SHA512

        8dfc287c200591ec9a03e3d3a3d3256f75687bfff747694549e64acf365ffe1695afd8da171bf20cf35cc204c58207fed6effcba962af02ae75b859aa83bc19d

        Download Submit

      • C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.Win32.Blocker.pef-95fec41a73473b1ccf4467874e8f1833b2a852f7703c7c134e36bfc04ee436bc.exe
        Filesize

        52KB

        MD5

        77aabab482c7eb162ea98fd20665ea7f

        SHA1

        50250769ee714bf2749ec428858b5e5dc8d7e037

        SHA256

        95fec41a73473b1ccf4467874e8f1833b2a852f7703c7c134e36bfc04ee436bc

        SHA512

        335ec0c8c13562216531ac68fba258132c163334f5b90aafcb98e38717e50233fd9c0883185ae06ae176afcd72712bc894767452b756d5a466f6252fd5d72987

        Download Submit

      • C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-1c64c91268249161e66b3bb7a2c3b9f62ea21b6036a13093d84bde66bc4009b8.exe
        Filesize

        1.8MB

        MD5

        81daa885db0384c76e6cbf7298c2af8b

        SHA1

        ce7ff931ca463d45ed4eaa09f4b4b9b1ecb0ccdb

        SHA256

        1c64c91268249161e66b3bb7a2c3b9f62ea21b6036a13093d84bde66bc4009b8

        SHA512

        7dd406b2cb7403b0c4d9879a4fe31d8fbebc440b1ed83716da33b4adfc17c9b3405ba6a5b014d97d79bdb34f5c484e539b5dc09b709518bb9c77b54b9567102d

        Download Submit

      • C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.Win32.Cryptoff.vho-fa5300fa49f861f9d505c8887d5f4da508fca61d592adbbb4cbecc9882a85264.exe
        Filesize

        130KB

        MD5

        73aecfe0e6fe8e5a12e76137f68c9e3f

        SHA1

        71190b042f653b5fcd04c6b5a79ae93309071120

        SHA256

        fa5300fa49f861f9d505c8887d5f4da508fca61d592adbbb4cbecc9882a85264

        SHA512

        7c0c53fb82d8bd82fbca3711283397c50e0f13415f6bfb66484128959901bd1b46b1835ab0dea4969e64f80fc64e703fba5d6b5c1a820787b6b5724c75a574ef

        Download Submit

      • C:\Users\Admin\Desktop\00475\HEUR-Trojan-Ransom.Win32.Cryptor.gen-718810b8eeb682fc70df602d952c0c83e028c5a5bfa44c506756980caf2edebb.exe
        Filesize

        921KB

        MD5

        b76d1d3d2d40366569da67620cf78a87

        SHA1

        ae23c0227afc973f11d6d08d898a6bb7516418e2

        SHA256

        718810b8eeb682fc70df602d952c0c83e028c5a5bfa44c506756980caf2edebb

        SHA512

        85991cd78c13546e3fcb9da0574000eb1ff118c05f77d603c19941f3eaab908ab65b57f82dbd20d4c7784d0892ff5ea8ab8c160338d78b5fc76f71e09cec20b5

        Download Submit

      • C:\Users\Admin\Desktop\00475\HEUR-Trojan.Win32.Crypt.gen-c5ccdeea44050d8be9cf04b42ba6336dfd81e4a930ec6cd916f5f4e3a5f713bb.exe
        Filesize

        253KB

        MD5

        6c2852882fc92bee9d4802fb6d298372

        SHA1

        90cb4e21a5610abc13473f67e5b8a4a994bc276c

        SHA256

        473885b4f2c605cec2be5a7e3343c318fced7206856bbc1ec9d55f6cf6e1bf49

        SHA512

        608a6bd20a6f6fdf3151202e5bad9cda6bab094486408e33ef0c0ce6f467d95f56042b5e99f755e85dec7c95389feb0991e06aaca4c3fd2a92fda32beabde655

        Download Submit

      • C:\Users\Admin\Desktop\00475\HEUR-Trojan.Win32.Crypt.gen-e419efc94e3209360dcacc40d27f3b45983940b490e89b5085226c172016eb2b.exe
        Filesize

        516KB

        MD5

        bbd9f4a7203b1be8d336c2a57777c9a1

        SHA1

        3408450c165214771ebc31eca944927fb435894c

        SHA256

        13ebbf96188f06e9813ebd19a6b9911794926ca83027060db4e533513c3e9dfd

        SHA512

        cfb5f52ce85d7682ad4eaba05c47b51cec45f60d3bd4088c709e0eb1a46861161050eac8558690f20fe48abedc5c63d15c3cf829e7ded4fbb85341d4b4d7a93b

        Download Submit

      • C:\Users\Admin\rw_simulation\1.rscrypter
        Filesize

        1.0MB

        MD5

        4c7c124385ca73a8fc720ce4439f31d2

        SHA1

        cf18b1c94f0ed8433892f0ac725a67133dba28fd

        SHA256

        b2df6c864bc643dcdd8bf5fc2302603c439ff1da836adf0e678ce005805b9eb1

        SHA512

        439db6facf55407029a5c4d12c603a85486a5fbaa1d4e7f6d272bdd7aafe341673c430664ae2b887064e7ca54a8a17b29b1cca6e2d13605e78b11722e5ec0f90

        Download Submit

      • C:\Users\Admin\rw_simulation\10.rscrypter
        Filesize

        1.0MB

        MD5

        a330cc42dbb2a0074e2e7f67397a65b0

        SHA1

        b086b35cec4978cdeb2126a01b33065b58741b72

        SHA256

        a9c69e0bcfc906cd48d74d2e158ca8a97ed349362eaf62cb2914ec69557befbe

        SHA512

        608599b7ce42c57616bd98199733a36bba29fa50a4221240c460a592a1cbeff881b49625824379887eb54bad6fa01dd4261c194bef73c1134e67240f995cb288

        Download Submit

      • C:\Users\Admin\rw_simulation\11.rscrypter
        Filesize

        1.0MB

        MD5

        e86d2518c8b3018317c89a49c43967a0

        SHA1

        fbcfa280758964dc642cdb91fbe5de12aee6e160

        SHA256

        e07b80a635c678b4a2227370bc512bf167876a5dc6767f6b921a5e07a84bb6fb

        SHA512

        278d1b119abc7d6678309afe1e7e5330348560ad4d40369b36f8aae4497fbf37cb67523d542e0cbfbc6ecfb8f1f71925c54a1d4a9bb7a35973ed5955ed6f5902

        Download Submit

      • C:\Users\Admin\rw_simulation\12.rscrypter
        Filesize

        1.0MB

        MD5

        b296c1fe4b2ae1bb3de2403d17d90449

        SHA1

        4c36af39e4e31cedae4c641245cc80d05888af68

        SHA256

        07b8ac22843b429a8853f30f97b751e02e47208ccabb73875282562a313d1467

        SHA512

        639f47aab221fcf8ce0774593ee8127cc96e9baae3b6a9a580ce34500aee134266c639d8c9dfeae41c11c6f906cc308814e4c744140dd80d13ca1224fa0c0f90

        Download Submit

      • C:\Users\Admin\rw_simulation\13.rscrypter
        Filesize

        1.0MB

        MD5

        e55c05511fa8dcb6134ced98ee18bc6f

        SHA1

        e24c1fe23650d605fd8216dfa7078500a4120985

        SHA256

        4671a0a7bb6ae53d436591da03c24fe83d6d7fb3dbb395ace92d1b121ece82c8

        SHA512

        4f839da8251d6c40275590d3f42f569ad33d8b5f59f932d2db93a3ac260a0cbeeaf7c546db7a3491375e1603899654cf127b5748c46fb7acc4f349c6e1243c9d

        Download Submit

      • C:\Users\Admin\rw_simulation\14.rscrypter
        Filesize

        1.0MB

        MD5

        153f007c3b4e3552ad539a055f6010e0

        SHA1

        37a6f9af3d75289fcb3e8793a3476340d991379b

        SHA256

        5ea1b29a3b17bcef046d547f4d4d5ae56f7db0fcc366598928672f9e46fd6a30

        SHA512

        302d9d7bfee654d4bfbc5de1b99c3615465bab7bd5ab6edd8af11be50ce39087495881550eeaf277eaf6c5f7174dae3ac41e0bc22fcce7d2bfb35c202d3d6253

        Download Submit

      • C:\Users\Admin\rw_simulation\15.rscrypter
        Filesize

        1.0MB

        MD5

        769ecfe6d38d3cb6d494b54a07fe379a

        SHA1

        131397f9074df3bbf870356c6b5e8f1df0df67f2

        SHA256

        0b78dc049feea0c41aa2373177c80743091dd08cf55a212dc19ded8f35f4502f

        SHA512

        b054186ce7e082bd92d2177603fdbe01973a4580b62ff919d54f11ed8454f6d9c13a529b15253ed97aa52c4cd9675a70b1356eb9fd3d9f1f548762a46929880f

        Download Submit

      • C:\Users\Admin\rw_simulation\16.rscrypter
        Filesize

        1.0MB

        MD5

        b0eff85529ad76eb573226db7a82fdd4

        SHA1

        38edc8fb2478fb46eee0ff6ae81221eaf85c3449

        SHA256

        138649676507060a2d491f86aa48db08bd9341e34e4be65b78d2bb490c0a533c

        SHA512

        ec98b8670c244e1578198e7b9dea08439d27aa27e50649a636697bb2074fb864958bea2838c3c6119137389e50422c763a3bcfe0743a8eafb175360fff8199fc

        Download Submit

      • C:\Users\Admin\rw_simulation\17.rscrypter
        Filesize

        1.0MB

        MD5

        7387cd03d052c5b292a5055f0d57ad49

        SHA1

        227839f57990ee932ad972af4f7159d2ce8b5d92

        SHA256

        35c504a386ad51414e14a5949195ab40d1b5b125da4bf847295331fb628abb4d

        SHA512

        85e2270637c7fd6087604a6e010784edcd7e0e3fcbfcdcbec0d1aaf1448681c8d84405bcba7337b2fc88008a6e72440555b607522b892c596a0013d534ee3840

        Download Submit

      • C:\Users\Admin\rw_simulation\18.rscrypter
        Filesize

        1.0MB

        MD5

        0cfc1078a90f7067e5984b18a84a5c55

        SHA1

        ad03c60da751168d499edd02e99f5a3fbabc1e6f

        SHA256

        ae8a3e18f6a07450d3656eb401d059a07f82ccd9cabc50e7a80beacc8effe444

        SHA512

        c53aeb9883ac5c38dc26e3a2eb06e9e7b13e5a148536768ebfaa042ad2022040d13a1a91c9a2552f67d9f607c1a919ae4eec6a7424add5ada315f532113ac83e

        Download Submit

      • C:\Users\Admin\rw_simulation\19.rscrypter
        Filesize

        1.0MB

        MD5

        8ee3549351b2ae0bb18d5858b4d46964

        SHA1

        ed67d8fe20fd98c201c3b9cb635725fc10429cde

        SHA256

        0dfa3f44183941985fce5888573d3e0e336890e6767be23097809d0aee795812

        SHA512

        337f07935a07037f99fcf7cce5580cbec3eaf7710257bb30070e10b2b076368c3f5c560e3b5c0680f744f0d1841ace0c83ba89122b2b510453965057a12383e5

        Download Submit

      • C:\Users\Admin\rw_simulation\2.rscrypter
        Filesize

        1.0MB

        MD5

        c36ec057e7b9cd80d9a27549ee90ea69

        SHA1

        784487adb48bb3a9168aec8dce240282f5ab2384

        SHA256

        8e42cec3f0dd08b31fc78db8f3751f840d851a3a8044c19cabc334d6e3188f24

        SHA512

        bf09930bc89f4bf7932c5a057ac3bf23eac6483ef5ec564d0e5fff21c5cede5b0328db3f30e5f07891a21183fce26529420ded2f93d4d509bd821d66cc744475

        Download Submit

      • C:\Users\Admin\rw_simulation\3.rscrypter
        Filesize

        1.0MB

        MD5

        6786d0375251ad927dc9ee2aea3b3d32

        SHA1

        94d1331f0ed512d31070f0e4e78710a9f9387c12

        SHA256

        8786739b8917d91241020184d82c3406df2672fc2b842180d2879e092f96c8c2

        SHA512

        0c6a97b1c5e9d2c61323be718e552d9c0542b857f77d16b86300eab9a934192b04fc7827322bcb865960a3c54875eeee120fc45720eb7c97b4ad6903871e8f16

        Download Submit

      • C:\Users\Admin\rw_simulation\4.rscrypter
        Filesize

        1.0MB

        MD5

        7d84f0b47a71bc235df8a4c45a5669a8

        SHA1

        6d33be77a09edb3103da4103a934d1d8bfdaae64

        SHA256

        23a46563ac84fd7ddf3d344a97060b54d7e67dd389c1d9a884e02318a2564c80

        SHA512

        48f4b41064dfce7eccf7cee8d864c5e9e24bc9854d17622a608ce37cf570b2fdd44eddec1d90310d40664bb341b57424a62f2cab398b9ff93d7623365be4f121

        Download Submit

      • C:\Users\Admin\rw_simulation\5.rscrypter
        Filesize

        1.0MB

        MD5

        68b5438fbfb90a9436d0903972f68488

        SHA1

        b63c8b1f1176befa79f0400eb549bb1a277fd26e

        SHA256

        6b7c462abe4f6d11c9076f660d1d52bdab8ed4cf5f5e7f8560d3d244303cbb4b

        SHA512

        5c76e67d2df84992df7745451e865278b5486ecc800dc36e56240d3dcdc3316af1d614a499baf9e7014ea17b553bd5391741e06c4ff89e90b1694a8433028e9b

        Download Submit

      • C:\Users\Admin\rw_simulation\6.rscrypter
        Filesize

        1.0MB

        MD5

        50a8c7ccae74e6377dd482bc297b0a91

        SHA1

        54351f4da2b5c46da8be752a34faddd3abdac932

        SHA256

        9e8a6f531b8ea0c7c685d6048d835b37e0832b2211527f888697c71eb73b7f64

        SHA512

        bf13adb7d3e0d9a5512cd3c9425e484192c0ee26cc903178d61c719ba2ec37ed9aae41279bf446c08fbc2c5537f7044389f4f44efa7f62fffda2e607300d015a

        Download Submit

      • C:\Users\Admin\rw_simulation\7.rscrypter
        Filesize

        1.0MB

        MD5

        590a8e5cecba0a6c9b2210bca73197fd

        SHA1

        8b3da937a467cf762604a55288c17e649d15c8da

        SHA256

        9abc2f0d07d89aeb77b8bc20bfa394cc22d9ef21e7eabfe42fed23ea1de5e167

        SHA512

        713eb67370f417cd07ce2594b4fca128e8fec443db541c531772698d08e9ab682f99dacb37fc638f5c0a4e04d519c115e3a8f4f6d38f691f5c1f33b074c0c188

        Download Submit

      • C:\Users\Admin\rw_simulation\8.rscrypter
        Filesize

        1.0MB

        MD5

        84d18b762da52fe3757a49aa413ebc78

        SHA1

        cdb267dd1c03fb840cb1989db405eae6409280c0

        SHA256

        db5eafbef10f05f5479afedfd2c4d9fb62c5c6c156e660560482b7d5d82335de

        SHA512

        2dd3feb951d24958a2948722957d626f03470f5b8229b717d50c2c06064da63a017ed6452c7bc1411bee0046685b335f2fa6764e0a0b49c656063304bcba53bd

        Download Submit

      • C:\Users\Admin\rw_simulation\9.rscrypter
        Filesize

        1.0MB

        MD5

        4db14910b793ba1a5f64cb30f1611685

        SHA1

        7691b6c34da5b48dd8c3ffaadb4a6d5af34c6f05

        SHA256

        f60b13768cd178f7afb0801388735e2ef5ca7713e4ced13dec3998a3f8f5925a

        SHA512

        5a2643d1c7cc550ee04a089b61dc925519090ef7d219ce041ae31f31d6302f9b0ef8fe63ea94e343f36f8b290cc8e97a0528ee1c35db63b3fe4eccee954e986c

        Download Submit

      • C:\Users\Admin\rw_simulation\rwtest.02
        Filesize

        361B

        MD5

        8d908dee235fa5e8672541305dc9b0b0

        SHA1

        54eb9a1d16d942109ffd235952be8ca4736ddc25

        SHA256

        febb4af63422f6327cb17b6e0ade4018cff17250fcda0a6c2df7f600c2eaa839

        SHA512

        f6e7b81cfd5aaeadabd231a494933f82e42c254e779f38ff65ba13eba5618f22acc40ff13f514bfa442513cc711c7e2f11605c3edefbc263e9cf9ffe89c01e0c

        Download Submit

      • C:\Users\Admin\rw_simulation\rwtest.0x0
        Filesize

        17B

        MD5

        c4f11c97075a6ce73f9be2b5d342c83f

        SHA1

        2c45fa2e5aaad8d5fc2d850b4a77c1cb3a8008d9

        SHA256

        03542ea9000a1acef8a897fa73af788f1cfbf2f08007971c4ad7553c671a1d0a

        SHA512

        10ddb6c96dd648db889a01356668aad979811d30e79f3c6687ff8762d9c297a9f5c69afe35b02f7a7357b5df0b193807c952eeb8b3c16b16494f20bf42705f1d

        Download Submit

      • C:\Users\Admin\rw_simulation\rwtest.0x0
        Filesize

        361B

        MD5

        3b66bb3f5d86aadc5ae602a854161d46

        SHA1

        140da6280d18d44daebf3ef225b1e358b7a7f9e1

        SHA256

        d8e8191890deec43bebd2ef90ecee8c1e387ed2dda9cfbc1a93550a90f830e58

        SHA512

        3f0a71a85419a79e271e79bfd359e0f153054c30c1cc866a727c742a5fba75f72b2a9ef3df6ca06e23ed7a63b7d4d31d7902fd7e3f6a3be84ebf0fd073110643

        Download Submit

      • C:\Users\Admin\rw_simulation\rwtest.1999
        Filesize

        361B

        MD5

        2949246f192dc70e58a04664663efaa6

        SHA1

        6e3fa9a3691b81f3db86cb43b020482dcfdbd5b5

        SHA256

        a2db9f813766dc3f634f17d89cca4ece7c985ab14a51ec013932293556118f74

        SHA512

        a1e87478ae9397dae2481fbe7208deb2a09a069a4b22101b3171e8d922e45598d3c8e29dca806ce2bc9d8b64b6dfa80a461c38908207573e16ba49ebed7d599f

        Download Submit

      • C:\Users\Admin\rw_simulation\rwtest.1cbu1
        Filesize

        361B

        MD5

        253a2a1ff343a700234ecd2583537c0e

        SHA1

        c2f1e81d19c2edcb90c142411b7639f886f15d8b

        SHA256

        de740c2f83a6dbfde29b8ba275ac36ecc5fca47ee3857a5b30c31914d18a0655

        SHA512

        322444a5b327510934e9d14c4a3a1aafdcad5661a5dbc7156d510e020354c64db57f27fed102fb772a1f8b1b66d93e99e459a3734010c5d67785356ee5328693

        Download Submit

      • C:\Users\Admin\rw_simulation\rwtest.1txt
        Filesize

        361B

        MD5

        aa2b1fd0b2d086d26a99555b7fff45d4

        SHA1

        6a4f909e2ac84acdb3009d83c8bf0a0afd278a0d

        SHA256

        eeb9939631b247fba19b181c717d17c0b6927964bc854c24aaf8c1fa3bb20314

        SHA512

        e56d7cd1891b290e5a28f4d08e23ca0105cb947715f268714d62df508ddb0db4590819474b416da90658b863f43bc7dc2eaace904a402d79942964628fcb2d33

        Download Submit

      • C:\Users\Admin\rw_simulation\rwtest.2ed2
        Filesize

        361B

        MD5

        b965c1941bb351d1e701b0118bcf4a7c

        SHA1

        c6b996afd74dd4e1866b3287b5e3f92eeda7e3e1

        SHA256

        e2ef8b77821a40727cbf3b2d628b5a65782226e6ef1fc626283bc34a709eccbe

        SHA512

        f61149525b13b30b1d94ba671adcf22d23370ce934e6e0d7e807b32ad5de05693fa7d9019f080379da64d648c3b781e4b77d4d244460836903702c680f074e59

        Download Submit

      • C:\Users\Admin\rw_simulation\rwtest.31392E30362E32303136_[ID-KEY]_LSBJ1
        Filesize

        361B

        MD5

        fab38b4b8afcb1c58914707a5f486ee5

        SHA1

        b13dc1a829a49f7a2e00c13865df6a0ec1a1b051

        SHA256

        612dfe6c9c5ccc02e70789e3b5a50afed1578562e173e86674655b8399d481b0

        SHA512

        956fb1def18ba52ee3d3203f35b6a7df6fb06637a9fc876cea6dd10fa46da35b7ea43ba8606f5af7f58397c4eab2b7fed3d0a9b5bc3debab734b7e957a34229e

        Download Submit

      • C:\Users\Admin\rw_simulation\rwtest.725
        Filesize

        361B

        MD5

        94727900585bf094547583088b1de2a3

        SHA1

        11fcb237a0e6629a061f44b466fa39609e7daa1a

        SHA256

        30d90a03c66f50fd19efae36609f81f0db7ae48c967f9bde22a3cdce430dc8fc

        SHA512

        bedc0a209cbb0c43206051e163bbe4a4724fdf7f6605cbee9e4e2d741d4107f3f031c2b2b95454fe65a6b8ff1bd38c90f4868959165e8fa8891c0f63ba17ee95

        Download Submit

      • C:\Users\Admin\rw_simulation\rwtest.726
        Filesize

        361B

        MD5

        6ca90b60cd2db62675738d9aea515c64

        SHA1

        d0d2cf41d69d493fdc2544fd9046c48d57b19f85

        SHA256

        6d80a32b5372cdb09f0d8f9175b9ad4f1d63fd9c9606f4bfec696ca7f6b0fc3c

        SHA512

        e2298871ebe6056a58efd9c5c7b149173aa62d3a6fa65ef803facfdda29783b122626b2550b687def3419782a86b78e2dedfc15b8f5a61f70eaa0f9147711d63

        Download Submit

      • C:\Users\Admin\rw_simulation\rwtest.73i87A
        Filesize

        361B

        MD5

        48ddb7a4cdc3e6e47a1ad3c7359cfa27

        SHA1

        27789105c0d7fda4185b8ec36df816fbe9f5c456

        SHA256

        aa4b7a12fbcd667c91aa145e28aa723036a5dfe18e114ea231b67870365ca584

        SHA512

        711483ccb67e0a9202763aa28e59bbcc9cfc1ec93bb2350c6405288293ed50777eb4c8e7f4bad90f570a38ad65a08aa56d578a2acf27eccbc830f54b5d5130ae

        Download Submit

      • C:\Users\Admin\rw_simulation\rwtest.777
        Filesize

        361B

        MD5

        d5143ab600c167ce1cbb7c35a7f8f3d2

        SHA1

        fa6255159980ae9af20773d7ac5a046ee0b2ccdc

        SHA256

        5c5eb49c565e3015086193bd250db39409fef88cb8b8e7e8dacb418f599f83aa

        SHA512

        957d892c7f29501d79a0322d996350e669a2bcf767904dcff2fac0dad5045f4a886737be9edd23ab6e7f950031fa44b4585aabbc1f861402a9a033e45795116e

        Download Submit

      • C:\Users\Admin\rw_simulation\rwtest.7h9r
        Filesize

        361B

        MD5

        7019f08a8a2637f688ad22fee5a09c63

        SHA1

        f06a917c28a3e5ba65c0386b33f141116b91f041

        SHA256

        b98b8180340d4fab2fa5a6280a2f8ce22c39a26d38884dfabbf4a3ce1df8c666

        SHA512

        df235d439af4daad9e54f351b2f201800569f4dffdc9ba0161b2d7fccaee8d2ab6b0efd52b48cb60ab87e0e3c5d37ba3aafea8881e5d4360a722e5884be48350

        Download Submit

      • memory/1220-227-0x00000000055E0000-0x0000000005672000-memory.dmp

        Filesize

        584KB

        Download

      • memory/1220-403-0x00000000054B0000-0x00000000054BA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/1220-686-0x0000000006740000-0x000000000686E000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/1220-219-0x0000000000980000-0x0000000000AB6000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/1696-180-0x0000029CCC3C0000-0x0000029CCC3C1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1696-168-0x0000029CCC3C0000-0x0000029CCC3C1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1696-169-0x0000029CCC3C0000-0x0000029CCC3C1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1696-170-0x0000029CCC3C0000-0x0000029CCC3C1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1696-179-0x0000029CCC3C0000-0x0000029CCC3C1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1696-178-0x0000029CCC3C0000-0x0000029CCC3C1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1696-177-0x0000029CCC3C0000-0x0000029CCC3C1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1696-176-0x0000029CCC3C0000-0x0000029CCC3C1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1696-174-0x0000029CCC3C0000-0x0000029CCC3C1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1696-175-0x0000029CCC3C0000-0x0000029CCC3C1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2512-2130-0x0000000000400000-0x0000000000409000-memory.dmp

        Filesize

        36KB

        Download

      • memory/2512-670-0x0000000000400000-0x0000000000409000-memory.dmp

        Filesize

        36KB

        Download

      • memory/3224-223-0x0000000006000000-0x00000000065A4000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/3224-217-0x0000000000FC0000-0x0000000000FF4000-memory.dmp

        Filesize

        208KB

        Download

      • memory/3616-228-0x0000000005310000-0x0000000005376000-memory.dmp

        Filesize

        408KB

        Download

      • memory/3616-218-0x00000000001E0000-0x0000000000216000-memory.dmp

        Filesize

        216KB

        Download

      • memory/4340-224-0x0000000000400000-0x00000000005BB000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/4340-2302-0x0000000000400000-0x00000000005BB000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/4512-672-0x0000000000400000-0x0000000000409000-memory.dmp

        Filesize

        36KB

        Download

      • memory/4512-216-0x0000000000400000-0x0000000000409000-memory.dmp

        Filesize

        36KB

        Download

      • memory/5040-156-0x000001A9D6790000-0x000001A9D67B2000-memory.dmp

        Filesize

        136KB

        Download

      • memory/5040-166-0x000001A9F0E00000-0x000001A9F0E44000-memory.dmp

        Filesize

        272KB

        Download

      • memory/5040-167-0x000001A9F0ED0000-0x000001A9F0F46000-memory.dmp

        Filesize

        472KB

        Download

      • memory/6140-2184-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

        Download

      • memory/6140-2372-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

        Download

      • memory/6140-2185-0x0000000002220000-0x0000000002237000-memory.dmp

        Filesize

        92KB

        Download

      • memory/6188-2211-0x0000000005A30000-0x0000000005D84000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/6188-2207-0x00000000058B0000-0x00000000058D2000-memory.dmp

        Filesize

        136KB

        Download

      • memory/6188-2208-0x00000000059C0000-0x0000000005A26000-memory.dmp

        Filesize

        408KB

        Download

      • memory/6188-2346-0x0000000005FA0000-0x0000000005FBE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/6188-2347-0x0000000006570000-0x00000000065BC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/6188-2161-0x0000000002AA0000-0x0000000002AD6000-memory.dmp

        Filesize

        216KB

        Download

      • memory/6188-2420-0x0000000007670000-0x0000000007CEA000-memory.dmp

        Filesize

        6.5MB

        Download

      • memory/6188-2421-0x0000000006500000-0x000000000651A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/6188-2165-0x0000000005250000-0x0000000005878000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/6956-2473-0x0000000000460000-0x000000000046A000-memory.dmp

        Filesize

        40KB

        Download