Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-10-2024 21:53

General

  • Target

    445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe

  • Size

    211KB

  • MD5

    445ccd39adf264dd422cd181f7bfa915

  • SHA1

    85f9e892fd3a6b396868d2f06f33fcd7ffbe9eab

  • SHA256

    f1790d16765d15529243d326719330b7d0ad989f6fa452108e11646cc9328873

  • SHA512

    9ce007c002a25dd6b0261cf2def6c3b1c486c72324d952c74754c2785d7273d23bc5ae8cb1097a482b2d4496e0ce97f7c2df03b4691a7cda04899a1e093069de

  • SSDEEP

    3072:uyAaQqe90u5DdXJP45JxrpjTo2/G08XcK+fQM8X7Y79eUHnXALNODNvOz55E:uyAge9RNOxrF/GBXcKUQYMUHXLD52E

Malware Config

Extracted

Path

C:\Users\Admin\# DECRYPT MY FILES #.txt

Family

cerber

Ransom Note
C E R B E R R A N S O M W A R E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great!!! You have turned to be a part of a big community #Cerber_Ransomware. ######################################################################### !!! If you are reading this message it means the software !!! "Cerber Ransomware" has been removed from your computer. ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to get back your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://cerberhhyed5frqa.xmfir0.win/D8B0-1C91-7EDB-0063-700C | | 2. http://cerberhhyed5frqa.gkfit9.win/D8B0-1C91-7EDB-0063-700C | | 3. http://cerberhhyed5frqa.305iot.win/D8B0-1C91-7EDB-0063-700C | | 4. http://cerberhhyed5frqa.dkrti5.win/D8B0-1C91-7EDB-0063-700C | | 5. http://cerberhhyed5frqa.vmfu48.win/D8B0-1C91-7EDB-0063-700C |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://cerberhhyed5frqa.xmfir0.win/D8B0-1C91-7EDB-0063-700C); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://cerberhhyed5frqa.xmfir0.win/D8B0-1C91-7EDB-0063-700C appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://cerberhhyed5frqa.xmfir0.win/D8B0-1C91-7EDB-0063-700C); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://cerberhhyed5frqa.onion/D8B0-1C91-7EDB-0063-700C | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.
URLs

http://cerberhhyed5frqa.xmfir0.win/D8B0-1C91-7EDB-0063-700C

http://cerberhhyed5frqa.gkfit9.win/D8B0-1C91-7EDB-0063-700C

http://cerberhhyed5frqa.305iot.win/D8B0-1C91-7EDB-0063-700C

http://cerberhhyed5frqa.dkrti5.win/D8B0-1C91-7EDB-0063-700C

http://cerberhhyed5frqa.vmfu48.win/D8B0-1C91-7EDB-0063-700C

http://cerberhhyed5frqa.onion/D8B0-1C91-7EDB-0063-700C

Extracted

Path

C:\Users\Admin\# DECRYPT MY FILES #.html

Ransom Note
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>&#067;erber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .tor { padding: 10px 0; text-align: center; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R&nbsp;&nbsp;&nbsp;R A N S O M W A R E</h3> <hr> <p>Cannot you find the files you need?<br>Is the content of the files that you looked for not readable?</p> <p>It is normal because the files' names, as well as the data in your files have been encrypted.</p> <p>Great!!!<br>You have turned to be a part of a big community #Cerber_Ransomware.</p> <hr> <p><span class="warning">If you are reading this message it means the software "Cerber Ransomware" has been removed from your computer.</span></p> <hr> <h3>What is encryption?</h3> <p>Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users.</p> <p>To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key.</p> <p>But not only it.</p> <p>It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data.</p> <hr> <h3>Everything is clear for me but what should I do?</h3> <p>The first step is reading these instructions to the end.</p> <p>Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you.</p> <p>After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions.</p> <p>It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them.</p> <p><span class="warning">Any attempts to get back your files with the third-party tools can be fatal for your encrypted files.</span></p> <p>The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files.</p> <p>Finally it will be impossible to decrypt your files.</p> <p>When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly.</p> <p>You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files.</p> <hr> <p><span class="warning">There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already.</span></p> <hr> <p>For your information the software to decrypt your files (as well as the private key provided together) are paid products.</p> <p>After purchase of the software package you will be able to:</p> <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> <p>If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files.</p> <hr> <div class="info"> <p>There is a list of temporary addresses to go on your personal page below:</p> <ol> <li><a href="http://cerberhhyed5frqa.xmfir0.win/D8B0-1C91-7EDB-0063-700C" target="_blank">http://cerberhhyed5frqa.xmfir0.win/D8B0-1C91-7EDB-0063-700C</a></li> <li><a href="http://cerberhhyed5frqa.gkfit9.win/D8B0-1C91-7EDB-0063-700C" target="_blank">http://cerberhhyed5frqa.gkfit9.win/D8B0-1C91-7EDB-0063-700C</a></li> <li><a href="http://cerberhhyed5frqa.305iot.win/D8B0-1C91-7EDB-0063-700C" target="_blank">http://cerberhhyed5frqa.305iot.win/D8B0-1C91-7EDB-0063-700C</a></li> <li><a href="http://cerberhhyed5frqa.dkrti5.win/D8B0-1C91-7EDB-0063-700C" target="_blank">http://cerberhhyed5frqa.dkrti5.win/D8B0-1C91-7EDB-0063-700C</a></li> <li><a href="http://cerberhhyed5frqa.vmfu48.win/D8B0-1C91-7EDB-0063-700C" target="_blank">http://cerberhhyed5frqa.vmfu48.win/D8B0-1C91-7EDB-0063-700C</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> <p>If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it):</p> <ol> <li>take a look at the first address (in this case it is <a href="http://cerberhhyed5frqa.xmfir0.win/D8B0-1C91-7EDB-0063-700C" target="_blank">http://cerberhhyed5frqa.xmfir0.win/D8B0-1C91-7EDB-0063-700C</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address <a href="http://cerberhhyed5frqa.xmfir0.win/D8B0-1C91-7EDB-0063-700C" target="_blank">http://cerberhhyed5frqa.xmfir0.win/D8B0-1C91-7EDB-0063-700C</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> <p>If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions.</p> <p>If you browse the instructions in HTML format:</p> <ol> <li>click the left mouse button on the first address (in this case it is <a href="http://cerberhhyed5frqa.xmfir0.win/D8B0-1C91-7EDB-0063-700C" target="_blank">http://cerberhhyed5frqa.xmfir0.win/D8B0-1C91-7EDB-0063-700C</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> <p>If for some reason the site cannot be opened check the connection to the Internet.</p> <hr> <p>Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products.</p> <p>Unlike them we are ready to help you always.</p> <p>If you need our help but the temporary sites are not available:</p> <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address <span class="tor">http://cerberhhyed5frqa.onion/D8B0-1C91-7EDB-0063-700C</span> in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> <p>If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation.</p> <p>If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files.</p> <hr> <h3>Additional information:</h3> <p>You will find the instructions for restoring your files in those folders where you have your encrypted files only.</p> <p>The instructions are made in two file formats - HTML and TXT for your convenience.</p> <p>Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files.</p> <p>The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company.</p> <hr> <p>Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data.</p> <p>The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection.</p> <p>Together we make the Internet a better and safer place.</p> <hr> <p>If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support.</p> <hr> <p>Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.</p> </div> </body> </html>

Signatures

  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

  • Contacts a large (16400) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • NSIS installer 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Kills process with taskkill 2 IoCs
  • Modifies Control Panel 4 IoCs
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Users\Admin\AppData\Local\Temp\445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe"
      2⤵
      • Adds policy Run key to start application
      • Drops startup file
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4652
      • C:\Users\Admin\AppData\Roaming\{73E2C040-E79E-C111-12FC-85EE17911C8A}\raserver.exe
        "C:\Users\Admin\AppData\Roaming\{73E2C040-E79E-C111-12FC-85EE17911C8A}\raserver.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4436
        • C:\Users\Admin\AppData\Roaming\{73E2C040-E79E-C111-12FC-85EE17911C8A}\raserver.exe
          "C:\Users\Admin\AppData\Roaming\{73E2C040-E79E-C111-12FC-85EE17911C8A}\raserver.exe"
          4⤵
          • Adds policy Run key to start application
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Sets desktop wallpaper using registry
          • System Location Discovery: System Language Discovery
          • Modifies Control Panel
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1072
          • C:\Windows\system32\vssadmin.exe
            "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
            5⤵
            • Interacts with shadow copies
            PID:2316
          • C:\Windows\system32\wbem\wmic.exe
            "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4564
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3364
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe643546f8,0x7ffe64354708,0x7ffe64354718
              6⤵
                PID:644
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                6⤵
                  PID:5088
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
                  6⤵
                    PID:1080
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
                    6⤵
                      PID:4136
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
                      6⤵
                        PID:2528
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
                        6⤵
                          PID:3812
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
                          6⤵
                            PID:2640
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
                            6⤵
                              PID:4164
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                              6⤵
                                PID:3440
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
                                6⤵
                                  PID:1444
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
                                  6⤵
                                    PID:4164
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
                                    6⤵
                                      PID:4396
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
                                      6⤵
                                        PID:4476
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
                                        6⤵
                                          PID:408
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
                                          6⤵
                                            PID:5200
                                        • C:\Windows\system32\NOTEPAD.EXE
                                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
                                          5⤵
                                            PID:3048
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cerberhhyed5frqa.xmfir0.win/D8B0-1C91-7EDB-0063-700C
                                            5⤵
                                              PID:2012
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe643546f8,0x7ffe64354708,0x7ffe64354718
                                                6⤵
                                                  PID:1760
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
                                                5⤵
                                                  PID:4000
                                                • C:\Windows\system32\cmd.exe
                                                  /d /c taskkill /t /f /im "raserver.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{73E2C040-E79E-C111-12FC-85EE17911C8A}\raserver.exe" > NUL
                                                  5⤵
                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                  PID:5560
                                                  • C:\Windows\system32\taskkill.exe
                                                    taskkill /t /f /im "raserver.exe"
                                                    6⤵
                                                    • Kills process with taskkill
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:5616
                                                  • C:\Windows\system32\PING.EXE
                                                    ping -n 1 127.0.0.1
                                                    6⤵
                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                    • Runs ping.exe
                                                    PID:5732
                                            • C:\Windows\SysWOW64\cmd.exe
                                              /d /c taskkill /t /f /im "445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe" > NUL
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              • System Network Configuration Discovery: Internet Connection Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:5000
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /t /f /im "445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe"
                                                4⤵
                                                • System Location Discovery: System Language Discovery
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1844
                                              • C:\Windows\SysWOW64\PING.EXE
                                                ping -n 1 127.0.0.1
                                                4⤵
                                                • System Location Discovery: System Language Discovery
                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                • Runs ping.exe
                                                PID:5060
                                        • C:\Windows\system32\vssvc.exe
                                          C:\Windows\system32\vssvc.exe
                                          1⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2356
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:1724
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:4808
                                            • C:\Windows\system32\AUDIODG.EXE
                                              C:\Windows\system32\AUDIODG.EXE 0x4a8 0x33c
                                              1⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4920

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\# DECRYPT MY FILES #.html

                                              Filesize

                                              12KB

                                              MD5

                                              4f5769d6a05d83ce0dc50d87b7df639d

                                              SHA1

                                              0f027394298555259050a75d5dc968eb014200c4

                                              SHA256

                                              d9fafd4c06349abb942048752bafa06ee63fe9e94c7f27e61536e7d0fc54741c

                                              SHA512

                                              084f4476ae11de8b72bca8b3c190b8ebc4831668a8620dac2f709973f84b046c1c66d63b16bdfea63ca87f4be1c1fdf7633db9794e515a76593004d391bb8a40

                                            • C:\Users\Admin\# DECRYPT MY FILES #.txt

                                              Filesize

                                              10KB

                                              MD5

                                              27663044ebdbd2f8bacaa1012a3d57bc

                                              SHA1

                                              537ad94836dcf9e7f2ad73eefe33de9cc6eb8fc6

                                              SHA256

                                              ac5b42836700b51fe54493d9e750968e91c1d325cbe4fbd44f3e0cfd532f047c

                                              SHA512

                                              6e824b560b8341bb022acc1651fb8e1ee90a00735f2cca34a6bcd5f1f8263c0a1ee4bb8d65fdc2539f56830f797b252b767c6400739bbcdb0fa5625d5b9fffff

                                            • C:\Users\Admin\# DECRYPT MY FILES #.url

                                              Filesize

                                              85B

                                              MD5

                                              a25454b04f35ef908526489062451a43

                                              SHA1

                                              a6484d0cdf01fb37a1727933eb33f1e210e9b155

                                              SHA256

                                              06a3bd1883891266f4f84d415a8ec160423a825873b77d9c0de42ad36b5e6ddf

                                              SHA512

                                              e077fedb776963658816a3174d7a38d63bbfa5abee547ee430ecc55d9208ad72748f0aa575a0c068fccd03364c66207d922687c9821a0a2e5418720eaa109bff

                                            • C:\Users\Admin\# DECRYPT MY FILES #.vbs

                                              Filesize

                                              225B

                                              MD5

                                              f6d629f2a4c0815f005230185bd892fe

                                              SHA1

                                              1572070cf8773883a6fd5f5d1eb51ec724bbf708

                                              SHA256

                                              ff1de66f8a5386adc3363ee5e5f5ead298104d47de1db67941dcbfc0c4e7781f

                                              SHA512

                                              b63ecf71f48394df16ef117750ed8608cc6fd45a621796478390a5d8e614255d12c96881811de1fd687985839d7401efb89b956bb4ea7c8af00c406d51afbc7c

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              443a627d539ca4eab732bad0cbe7332b

                                              SHA1

                                              86b18b906a1acd2a22f4b2c78ac3564c394a9569

                                              SHA256

                                              1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

                                              SHA512

                                              923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              99afa4934d1e3c56bbce114b356e8a99

                                              SHA1

                                              3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

                                              SHA256

                                              08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

                                              SHA512

                                              76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              1188036b0efe9a4d37778498f0bad22f

                                              SHA1

                                              bfe423b93d47343c7de527379ecc7f99976101e9

                                              SHA256

                                              98cc35bf203bdfe92ffa3b5c6007e00ff4d4f54fd31ff1fbfa2f8e68b8624b5d

                                              SHA512

                                              2077e2fac680bd1bcb6957afab862e74d475d5d1198cddf0a98ed07c8c810bc7130683eeeab1e3aca63202beb6f9722d8c70929888cfb2469275672adfc79a62

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              88b581d5d526aadb914120e2dd173f67

                                              SHA1

                                              1c3dfa9eecf4ca1d5c88a6e4e0680f4ace3a175c

                                              SHA256

                                              12ff78cce6eca3e4ed042982a3c3c6b8d52f7590e40963c174040adc75f7aa45

                                              SHA512

                                              a22b2826ac541bd6c96820c5cd06d2f8784658a09efdf8055df79583d8529373f0728b790c3a3fa4f711b13f9a0758de9b0fc02b4be0bd9259e04d68ab81ccfa

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              206702161f94c5cd39fadd03f4014d98

                                              SHA1

                                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                              SHA256

                                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                              SHA512

                                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              46295cac801e5d4857d09837238a6394

                                              SHA1

                                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                              SHA256

                                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                              SHA512

                                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              10KB

                                              MD5

                                              dc2a7d82d16cbb6e0f25417e97aef9e9

                                              SHA1

                                              9fa913594ec8cf24b283dd409614645cb81e8421

                                              SHA256

                                              139645b68a01aa45af82fc5130beba1905030fa8cf37335c44f1aabe366ff436

                                              SHA512

                                              1e1a2fbc3ec297f25551948ed1c91b799c4e7f381a66d6eac7ef86f3d07c59d982a2dbdab1da2ef1c4f8484b3048a310b590f5d247836779f6027c239ed3af57

                                            • C:\Users\Admin\AppData\Local\Temp\nsxB3C1.tmp\System.dll

                                              Filesize

                                              11KB

                                              MD5

                                              6f5257c0b8c0ef4d440f4f4fce85fb1b

                                              SHA1

                                              b6ac111dfb0d1fc75ad09c56bde7830232395785

                                              SHA256

                                              b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

                                              SHA512

                                              a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

                                            • C:\Users\Admin\AppData\Roaming\403-6.htm

                                              Filesize

                                              1KB

                                              MD5

                                              0867f716af23d31be71dfae15132e9f7

                                              SHA1

                                              5c6bcc7c2ec90563aecab3d5ae9be796ec711667

                                              SHA256

                                              fd3a370b8f2b85902afed937a0e5b562c0aa978850cf21fa1269279162721859

                                              SHA512

                                              419f771cdc80f86a1682c14ed60ed5c22a31b141e88f456b74b52f830642e4ed220c0c59d725dc1d9e69f8f68831d441c802a47b180bd5404768c2d9eb80aa4d

                                            • C:\Users\Admin\AppData\Roaming\404-14.htm

                                              Filesize

                                              1KB

                                              MD5

                                              6d07737bfe629f02f13c37ddeeb4773a

                                              SHA1

                                              4ac6fcf803cfe6d07fc1f709e73783674a87091e

                                              SHA256

                                              eeb7eabec03ac23cf799cd60514ec95b4f853cef2a260e9873c4f597b5733f66

                                              SHA512

                                              6bdbd84daa09f9c919437ea4aee239652af230ec6b07b16b6e3f901313d59278d2bb0eeeb5c1ecbc18d529dfe71f63f875c95246e9c441b0b891fad86950bc53

                                            • C:\Users\Admin\AppData\Roaming\7.png

                                              Filesize

                                              344B

                                              MD5

                                              0def94f52c5e45256232320aaffeb1ce

                                              SHA1

                                              81508ec66d4305d2f291c666943fa19629fa67f3

                                              SHA256

                                              959986b33f56465e2acfe85004c168e0c0988b69ec726bf7f18f0936dacefa1f

                                              SHA512

                                              3400a02c438896d2a76b8e4c42e875b93d5806f9d8ebab0d9650359e89db8a891b873ec988031a08eadc3e686251cb5bfae5b59aff4e5105bb8a53e888b97f09

                                            • C:\Users\Admin\AppData\Roaming\7.png

                                              Filesize

                                              716B

                                              MD5

                                              eb4b5c7ec0788f5e539797f5579ac42b

                                              SHA1

                                              e38935a1fac4650a37b89d87e973acd1d4d0898c

                                              SHA256

                                              cb306a1063d1d2462b1fe3e6dc79f09558ed8863fb9eec1b02c6e157dd3e5a0a

                                              SHA512

                                              25d022d838ff272af911610585679e3f5bdb074bdb22d4d8c00811d3119dda04ee18b2b201f0fc54745025567225ae39742b874156d92ea81782416baaeff667

                                            • C:\Users\Admin\AppData\Roaming\Almaty

                                              Filesize

                                              453B

                                              MD5

                                              6ee80d47909884474a149de238fd366f

                                              SHA1

                                              76880a7d4afb20d51b0eead05ef5d1a16b86d615

                                              SHA256

                                              fed08d02e1f70abeb3e85207c8aca77404c3d4a5e067782a92fcf84763b5cfb1

                                              SHA512

                                              d1a2adb50239615616a76ed75f7607cff723e8d6979aa67244ee17031e2bb73629a44d10228e215d9beeee4e0d628b20978bdd5b025a69a20d80a4205e7afc7b

                                            • C:\Users\Admin\AppData\Roaming\Attributions.txt

                                              Filesize

                                              3KB

                                              MD5

                                              19ad62300dd66d6f479b13c40bae58e4

                                              SHA1

                                              c2393e348c48f9f3e6644f08473dfe22f889f9b2

                                              SHA256

                                              6505cb7369eb363a6dca90fd9dccfcb98bfd9eb9a1aaf586652f6e2950ff719d

                                              SHA512

                                              2bca333525c9892bd0cf13ec58d1786b67b1c63f1e7cfe688383fdba366ae8dede26f4bcaebce2b5c393987a9a2fef6c9cabf150ac0d0bc3f7d332c09aa3029d

                                            • C:\Users\Admin\AppData\Roaming\Attributions.txt

                                              Filesize

                                              3KB

                                              MD5

                                              f000cae0746571f16ea828644b48d7c8

                                              SHA1

                                              ed49ce8faf0681058f7ff56b1ceabac5a08a5577

                                              SHA256

                                              5bd62c9373f40d25dab917fcff8b3da24373e826ab8cf209781f727d68adcd48

                                              SHA512

                                              2272229465ec21ac5fe180f78a9004cd43bb73de731dd4f61c7ff34faeb0118e61a2e25823c935c15020ee5014414870f21d782fb511685f64988b877368027e

                                            • C:\Users\Admin\AppData\Roaming\BMC blue 3.ADO

                                              Filesize

                                              524B

                                              MD5

                                              b69b3adad4d6eb984ab4b597486038ee

                                              SHA1

                                              024a44587667fa1419d3f3aa8ce6b6111169e09b

                                              SHA256

                                              16b36fc550ca223fe6f35dadbdcd9746e84ad32b1880b9bf80ddbdabef7db156

                                              SHA512

                                              1b534f8675d75bc5aad72135c82ab107a1f59a755d86b32e0d5b4d7498ce0ee72394bbb872930f5841d6d70879d903e7bb861261b52937f3b036afd8cc804058

                                            • C:\Users\Admin\AppData\Roaming\Bl WmG9 CG6 CG3.ADO

                                              Filesize

                                              524B

                                              MD5

                                              01530c78ad082b812f0666d1be154bb7

                                              SHA1

                                              a1004c03b9f0428ea8ad12ee56563b601469eadf

                                              SHA256

                                              d380af43b5904bde5c53957f51627472f4186086b3124015b9854e91324244e5

                                              SHA512

                                              18655104239779a14ba03fa98ad02ed9f9750f954f7d1258b2bc4fa367d8291a13d0567dc075a5032f5fd4fdec615cf7e79e8714818b68f420688eab4e89e467

                                            • C:\Users\Admin\AppData\Roaming\BlackRectangle.bmp

                                              Filesize

                                              4KB

                                              MD5

                                              a59552f1c776a3745ca8391aff8bcca6

                                              SHA1

                                              be8e062d1fec7eed2ab33177019069798fde07ff

                                              SHA256

                                              4adb9b44ae64eee08d87750ba2cd2ddb1e88da5ff7e90c63d813755d73a92005

                                              SHA512

                                              1ee933756e08f71219753f5921ccbc8c307541ce4bfc15a654cbea075d7c28071b627779cec9d2146d8263e37dc8005bd333275058dc0de9a62c74391bd24595

                                            • C:\Users\Admin\AppData\Roaming\Ceuta

                                              Filesize

                                              1KB

                                              MD5

                                              ffcdcb20bd0798d3a424d11cb66cb889

                                              SHA1

                                              dc6a7ab6705b3dc39ac17f789b618fcf778fc33e

                                              SHA256

                                              d46d741412eedb69a13f292affbfb9b6cd1c5d18cee9bae789f5198cc766800b

                                              SHA512

                                              89d18ed4f271db9d9e42c7138e668fbca50f98b9b83865a5293882195f2289aeadd4c09dc64b01f1d794aa25a27d46674e6d349df4aabdfe264e982346425e59

                                            • C:\Users\Admin\AppData\Roaming\City Twilight.hdt

                                              Filesize

                                              127B

                                              MD5

                                              28d9887b962ab59d294eae376d61e315

                                              SHA1

                                              b93371861f6ee888be1fb2b26a6a0bca7214d9c9

                                              SHA256

                                              4c152354148193159c8e7de1f7d0a6ce921ef4c2b82c519e9a213aceb09b068c

                                              SHA512

                                              010d32d5d3bdeae824e9d797e669d3752a1b24d33d68d9b119ad1457b527d05e4f17b2b41c92ea35fd7d82929ae1ffefac253d6be5d38186c360f509676dbd2e

                                            • C:\Users\Admin\AppData\Roaming\Dialogs.dll

                                              Filesize

                                              40KB

                                              MD5

                                              52ae8f7762522c2c6bad92bb437aac2e

                                              SHA1

                                              323ab7cc3fdc285d9b19bcf3b1000227a0cf8f58

                                              SHA256

                                              6bfa771b9bdb75e44601044b4bbaec87583caca07839814c7afb241f783282b0

                                              SHA512

                                              a3cd9752e4576ed19fd57f24d562582ea1cd8ed775d96182b2fbc5de40d44f4e8a6b4ff1cda712748d2c98236a03b39d4b3d3fda69eca9fb4e59853b841fa398

                                            • C:\Users\Admin\AppData\Roaming\Earth.F

                                              Filesize

                                              123KB

                                              MD5

                                              45f0acce40593a69a9a9938278aa3ebb

                                              SHA1

                                              b1527ff839fe5f8f60f9f0873134bdde96e0185f

                                              SHA256

                                              84ea3b5bc418eedf2088b0e1ce2ff4e943694df0f366c323daa541e041a3d1db

                                              SHA512

                                              63bb4b010b2dbb175e00001eed512500d978a5511bb1790dd251b8ba8f1f835ed591b37963488c554e7161eb12430ef1713008f46febd5048dc466d75c753b8d

                                            • C:\Users\Admin\AppData\Roaming\GMT-14

                                              Filesize

                                              27B

                                              MD5

                                              50acae087c7cadcbea89084d596e0ce1

                                              SHA1

                                              5d3b809185cbb2f7bcb9eaf019c28e9f60ff7672

                                              SHA256

                                              473ce905ead8fdc35cd9a60dec506b6ed2462dd176d44a7e412601d1e8a725b3

                                              SHA512

                                              4af6081e8a4b19b0fb9f82f67182f0c9d9b4c03d54df38a92e90e01a911189bd90171d5b5675dd450f6de478c137eb04852e13e87716bd19faf4150ab1747971

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\raserver.lnk

                                              Filesize

                                              1KB

                                              MD5

                                              e8c6f36ce807cca7b555d39c1f04506e

                                              SHA1

                                              9a8f1287951eb28cc936255a67c9acd81d6064f6

                                              SHA256

                                              7b6b717244d26344557088fee8cf9bdce3eafb6b79ab55c2c08d5140e8ca892c

                                              SHA512

                                              a93cdb061ff34c82b581e0f38d1147753cbe85e4377d2d82268ca1e47ac37ce476fe8cbcecd25b670e704c575e6fec753abc0cd634b53e63ef0f36e7e5a5c876

                                            • C:\Users\Admin\AppData\Roaming\Parenchyma.z

                                              Filesize

                                              1KB

                                              MD5

                                              857267961ea1d474c6f4eafa8a963ad1

                                              SHA1

                                              c2c219e79844ef2444a03d8ed443fa17d8784593

                                              SHA256

                                              de26a311ddbb8e30acec416ba66b71c0bdf6dc3369b9b51e2d2947c643c442f3

                                              SHA512

                                              5f426015386785dd21e3a4f1c675c3b4eb10523c6cbe2228908ce244e0776d208d756464c86cfd4701585b1ba137d7726eaf6c8c159661c294ea78ec3204e71f

                                            • C:\Users\Admin\AppData\Roaming\admonition.title.properties.xml

                                              Filesize

                                              1KB

                                              MD5

                                              66c966605830cb94d10fc95415ca9cec

                                              SHA1

                                              0f0bf09b6c04039cfd3c7e837ef073b48dd50f69

                                              SHA256

                                              f6940a3a972c99fa34d755fd91e3f733e192d591851b76a56fbc181fa0262245

                                              SHA512

                                              a04554662680e5cd6b5d748266e528b5fec7fb16b998c077e4f1bc06b85749716110840e01e5702dfd0fab5018d58999bb4eb02756a77bd18c1e4237544f0ae8

                                            • C:\Users\Admin\AppData\Roaming\admonition.title.properties.xml

                                              Filesize

                                              1KB

                                              MD5

                                              a8eb07304def5b4b6107ff965eef0b5c

                                              SHA1

                                              23948e2ff5c53b371531e0cf5d380d4e4a9b2f63

                                              SHA256

                                              955479e2007a213237a290c61a7a8ec4dad949b9e1ecef4d0512ae5d4a6a9415

                                              SHA512

                                              b1dd0d13f1298167b5ef366c9b999c3c69b14c9e8cd8b87ce2b62c520bd14c78cef08a106790494f011f92083e4330ba6e4aec38dc0b185b5933dee6bfd3c29d

                                            • C:\Users\Admin\AppData\Roaming\aepath.txt

                                              Filesize

                                              53B

                                              MD5

                                              1f4b75f76c2f4f47cc4d09ad69c9ddb9

                                              SHA1

                                              ad667b272ad8c36f21f330c3fc5cdf463f27ab24

                                              SHA256

                                              cabdd5f56d8321156f29249d4e10c450670728495975b553eeba49031c8e47ee

                                              SHA512

                                              b7a5c6e0e14271897d49003037b8d105525ce11b2765c8f295acc38c1b5031fcc549a2dca3484528dfbd4df8ece203e617e2b8d7f226f5b623f571c30e4fa709

                                            • C:\Users\Admin\AppData\Roaming\aepath.txt

                                              Filesize

                                              435B

                                              MD5

                                              ec27edb651223d1e829367628e0a22e1

                                              SHA1

                                              23840eaa578eec0555ab193922f98f2d65191bcb

                                              SHA256

                                              f1432febd34374b00d2052e0727a589e1c3cef516f306a738b0955ab530c3583

                                              SHA512

                                              65f1fc5937cb29cda3c28840245eba9206e01c35564e5884a4f29252ffa0fa78f1d5ff2cfa3d85d1be55accd51cabfb2773d32f7520c4fcdf8546183b7847204

                                            • C:\Users\Admin\AppData\Roaming\alignment.xml

                                              Filesize

                                              1KB

                                              MD5

                                              370c70320cdcba10bcfb8afd5267888c

                                              SHA1

                                              fe7d143794554dad4776c43066581d4fe094e6c8

                                              SHA256

                                              b0ec9d1769d4dd4aba3ab79593972e1326e8008798d39fcff8857283efca836d

                                              SHA512

                                              f5e44b869969619f0aac46054d10d1b75c915b4363cdb74ce3616867f48644e3f5508520b412b43e31a82767dcb925598a4653f7cfb3cf0e11f18ec6ed9ce39a

                                            • C:\Users\Admin\AppData\Roaming\alignment.xml

                                              Filesize

                                              1KB

                                              MD5

                                              43e2689baec1e0afd38fc77eba1c8abe

                                              SHA1

                                              caca77c50543109a5a1b61a590a45b4f6b9f7441

                                              SHA256

                                              f337061e91fa2accda0f605ce8ec6f9051f0cbb4e24ee08480140c87bbdef22a

                                              SHA512

                                              5d90584200804ec1030950c2b09465e18c2104a6baf6000bf26ba61283113a38103532cb9141f0d290ba8a3d0de08976d6083412c1ec07f1e11ed093ed7243b0

                                            • C:\Users\Admin\AppData\Roaming\annot-open.png

                                              Filesize

                                              837B

                                              MD5

                                              8961808067af5253f333cdf0c8139004

                                              SHA1

                                              29adf64660e293b41583decab8a05df8edc93740

                                              SHA256

                                              96108677136e482951437c3b41e0f6aec42526cb065b8654ef5b81343f788be9

                                              SHA512

                                              ef88d7aa922ff6ce6b75f87c4b380a861db60dce94c4b0b958f5fdcd6685739a3a49ba5ff574a6df9e1f6673cd1d4b615a6327834dd53e25658e1c1e76be9c92

                                            • C:\Users\Admin\AppData\Roaming\annot-open.png

                                              Filesize

                                              1KB

                                              MD5

                                              b32dace88cac82a07aa96fe87656f2c6

                                              SHA1

                                              08e511031a33a4680a5c586e695e699f78fc016e

                                              SHA256

                                              680bb1c63be8b490df6caf85a8dcc8192b32b57aa331b7e3a49e3d9ad0540a58

                                              SHA512

                                              b3f6c7ebc67bc2b555b67f314d6f3b898c08f132487201d105953c88baa09d382b7d55501aa9bc051b46ea60095fe2354eea3797cfbec77d48ce92567348d399

                                            • C:\Users\Admin\AppData\Roaming\antenna_diversity.png

                                              Filesize

                                              5KB

                                              MD5

                                              ac2095fcdfe4603c866f9f6bc157101f

                                              SHA1

                                              244c844c54e236bce0ba004adce0832b3a38499e

                                              SHA256

                                              716567625c60045faa010895618ebe8fc2879ea4e8d9fafd4dfd67ea03350ed8

                                              SHA512

                                              2f95a08d9e5d72efcc6061ced4d59b574cc5b410e580fca273055226c8f45e6f501d201fa7d3d0a6666dd4c811f5f699c4e10ddb5f998111a65399b0fdda831a

                                            • C:\Users\Admin\AppData\Roaming\antenna_diversity.png

                                              Filesize

                                              4KB

                                              MD5

                                              38acb815e1753df1c9ca12d791792f7f

                                              SHA1

                                              29e9de3f8a01893d85e712066dd6cb2df11d489f

                                              SHA256

                                              bf929fa402c7b68b3de876ad186fa7d5be524b83bf47d0ac8b2daf949f086ae8

                                              SHA512

                                              126178f9391171d19ac951a7ef3e54cd4391ed3214bb65ceee821a658b00eb369dc54578f339738dca9a5e907f3d66d1e5d62e7d15bac69f6ce29a9c42116fd9

                                            • C:\Users\Admin\AppData\Roaming\author.othername.in.middle.xml

                                              Filesize

                                              1KB

                                              MD5

                                              34013f7ba10c307ffe52cdff5731f3a1

                                              SHA1

                                              b86d40b6e5cc2935bf4fd8fe6ea937e9f0c4448c

                                              SHA256

                                              adcb5c3760fe94b1e6b205ecaacefa0e8fa34c7882f6668e62b5b82c46e02528

                                              SHA512

                                              1d67d32cf696aa0afaccd4761da08d5df97639d6a84eef915dcf3f2d4a814e9401177f11d8bfc641c240c40aa6ed12ce23db9a0b98a90288ea04a59ce32b94d3

                                            • C:\Users\Admin\AppData\Roaming\author.othername.in.middle.xml

                                              Filesize

                                              1KB

                                              MD5

                                              3f1d6a0faa879df8fa3202e131687ee1

                                              SHA1

                                              339812d5fad87c162d14e6aaf9c5a313382bf3d5

                                              SHA256

                                              b2dfd9fbddc8c041ff3243770174620c3c4716e2993f7ac4d2ca84474933b848

                                              SHA512

                                              1433abc7596037061c1128dc1ae3baae698ddd00dabcf41efd7e6ab0a22200ffb3d8a9ff8b8fc7639eeb9f2035b300e2c99bea2e3faef337d58fece719f29359

                                            • C:\Users\Admin\AppData\Roaming\bar.conf.xml

                                              Filesize

                                              3KB

                                              MD5

                                              551ace9d95dd3883fdd0b19b37aaca75

                                              SHA1

                                              7aec5ae020696c1634bb76cfe12e87a20aa413ac

                                              SHA256

                                              932d698a7677df7a3389f900c54bb127945ad8e6673b14cc0ed72f04306014bd

                                              SHA512

                                              34cab6a038f460d50e1829c927aba3a58ca3a33f8efb0f2482b4b1a118538e564cf0435ce821f70856e2c7ed617ce90ff42a3f1259856aca616b21462608b6b7

                                            • C:\Users\Admin\AppData\Roaming\bar.conf.xml

                                              Filesize

                                              2KB

                                              MD5

                                              178e152ee2e209d26786a745433ad712

                                              SHA1

                                              a4bbd2efef3aa9dc09a2d393f3cdcb23ffa467c3

                                              SHA256

                                              b5036788bb1d86da7263410892e70822e370302394a6c320124b973027d8b0ee

                                              SHA512

                                              1f1eda2806b08a1252a865089ec3746fe61e434194634cb75025739e2cd3aec5bb8c0ad7602df19b02140aca3dc620d8fee35d85f40e2d119dbc9ea692fe251c

                                            • C:\Users\Admin\AppData\Roaming\baynote80.js

                                              Filesize

                                              775B

                                              MD5

                                              40c50b766e20fbf2fc6deab710f5aeb3

                                              SHA1

                                              bb83416bb7191a49d0bcd37a57e28b719afe354e

                                              SHA256

                                              f9d753b34a1bb5f1b8265c97c1b25d02269cd855ec9fc92e75bb690b44aebb75

                                              SHA512

                                              aeddb6f4db0e5910df75e3e18d97d4e72350c7e9c07597d6d83ebd7c332deaaf74c82dd96619727cca44b3b764ace57f89b83f040496a86f1827bde25d664d25

                                            • C:\Users\Admin\AppData\Roaming\baynote80.js

                                              Filesize

                                              1KB

                                              MD5

                                              e94ad4b9610368b911ae9acc29b8ec36

                                              SHA1

                                              aa3c6ccc505794c99bbeefc6f9fe7da68e98f0da

                                              SHA256

                                              81aa88d6f988acb34b1db52d133e9e8a43850c6a0bd288ff91f012d4bb3485a9

                                              SHA512

                                              f71468baf5e22cae28b7ff0f0992026b6d8a2e8d7652d5d4d99982788cd5d1b8717e99841827be699f237307991d8af6d22e566446f9b682ffeb1501c4c2f103

                                            • C:\Users\Admin\AppData\Roaming\benchmark.png

                                              Filesize

                                              4KB

                                              MD5

                                              66774a13c8f3917bd188d164749e9637

                                              SHA1

                                              505452afdc8c064bd36d520e38f98a6c2b854348

                                              SHA256

                                              27fd5c0dff36fdceb96f8dceab5230010c86e94e295625e46f6ab12ba4b7e69f

                                              SHA512

                                              fc43cd5f3aaacdf5ee9749f467b9a86fb661340d3e4a47b8b5096b3dd0a69a4f43a7ccd751f451491b66b29bdf787578f6d29bc5a06aaaeff5a4cf862feede9b

                                            • C:\Users\Admin\AppData\Roaming\benchmark.png

                                              Filesize

                                              4KB

                                              MD5

                                              9982680cc9d875f7fac6914f5f225ecf

                                              SHA1

                                              4e2323b0413c09cd495b21392338944fea0445f9

                                              SHA256

                                              f7ec8f1f7e741f9998ca00a78e41ddd58dc8f14ec53c0711fecfb04cb3837362

                                              SHA512

                                              df06e161b863e50873f811f00201d699f7466b27d3dc4a928e103fc93fdb0bebefeed96fc9d98b6982d0cbf6f28bf6456476d50406d66ab05d8468a0ca6a9857

                                            • C:\Users\Admin\AppData\Roaming\calendar2.png

                                              Filesize

                                              1KB

                                              MD5

                                              970d4ba9d2ff6fa6bb0be1185309d0ac

                                              SHA1

                                              7d0b05bbd14fbec1f83d466d1a57e019b300373f

                                              SHA256

                                              fa9aed53f4fb59fd5a16f49e3700d1feb50b351c904cd817f1cdf0f2e1cf0a3a

                                              SHA512

                                              6e174e75057e9edff5b1f78b19e3b9ca67edf54a8552b6f015e86f230add70f869fa4d15a72fa75e16b94b85f6d252f8063b6904a0ca235ff4388fb7cc19fd87

                                            • C:\Users\Admin\AppData\Roaming\callout.list.table.xml

                                              Filesize

                                              1KB

                                              MD5

                                              ba13484b2294780e6fb964b8dce37525

                                              SHA1

                                              bad6a9dabfc3a36e7a9eb87d35bb39a67ea67f8c

                                              SHA256

                                              85c350f206f60a4995621208b8b82c271deeb0f7a58f3366b62d010e1886bcad

                                              SHA512

                                              a5e3e1dcb28e2297b3bb37b92448f80d88cc2b263c3d07ec419326048c1a33980f0dcbeaaf037a5ba8400b7103f88738729216076f10fe54475351487801f29e

                                            • C:\Users\Admin\AppData\Roaming\chmod.js

                                              Filesize

                                              1KB

                                              MD5

                                              86b436eac80e09ab73167e1c19482f3f

                                              SHA1

                                              df618eaecc275ad751f3e45b71618655572e072f

                                              SHA256

                                              f317efe6072c7e4bab43485d3b2dcb2262323159d4a4fb4a41e3561f7d3c57c3

                                              SHA512

                                              7e5341acc76fdc0800c18b3879f9cf23e84c8291a15fbac53995cbcb353797dee26725633a45621c48c5303cb7174c92ca1ac9ec7f4067c22aa88a6d16f2a9d9

                                            • C:\Users\Admin\AppData\Roaming\chunk.sections.xml

                                              Filesize

                                              960B

                                              MD5

                                              fbaa353fc2559f142aea6250a505292b

                                              SHA1

                                              6b0712045722a8ac05d09d062266ac16e31bb3bf

                                              SHA256

                                              1271cb8f19f8d7c04937271a2037db928de5f4eb2ffa4067ae96816ba4c75a09

                                              SHA512

                                              e049808e913dea4f7f98d362c28a38894d6523add4bee31a73f3203b3a3a1cf6e7b8efea477c71507b1e823f1f780b61495cbd26264d068035fb908a5482bb8e

                                            • C:\Users\Admin\AppData\Roaming\circle_blue.png

                                              Filesize

                                              4KB

                                              MD5

                                              16bbbec98772193c3b712afa603265f2

                                              SHA1

                                              52c8f2fa55eaf32711b7b8b1721de603d9b45a99

                                              SHA256

                                              a527ce92781e80d9db05a09f3dc2339fc5d10942a7da5c08559b38e15e91ff85

                                              SHA512

                                              98e41474ef721545ce4e2fae14468be4d14953d5ef5bf708b8216dcb79df8e941e41c7a453409fca8f8f89350ffcfc6d17bb9175d12d106fed74f6cee8428f0f

                                            • C:\Users\Admin\AppData\Roaming\circle_orange.png

                                              Filesize

                                              3KB

                                              MD5

                                              559051954c06cda77ce071b4f054aa48

                                              SHA1

                                              ff8efb4e4e9709119dce2a551e71857cbe7edfc9

                                              SHA256

                                              a1158994e013285a15cd5bb648f21216c3fb6025b6f6e59c47e03e705f3662c6

                                              SHA512

                                              e952db9634a218affb422095645dd11c99079057be3129a56ec93896bbeeea245a0a940d78c61fdcdef4136caf5d4601d9ca06217f2c1bc872e028816225650b

                                            • C:\Users\Admin\AppData\Roaming\computer_diagnostics.png

                                              Filesize

                                              3KB

                                              MD5

                                              bd8078dcc074aaebdc63ba53082e75c2

                                              SHA1

                                              a3887f75154e5de9921871a82fe3d6e33b7b5ba7

                                              SHA256

                                              9e35270e3510c195a64635292dfcc6dc508e93dcb5715c3e30cf3ec15af6951e

                                              SHA512

                                              9a0b6c67c52ba0a0c9175a62680e9e35793676e4e06dfc6b5bafbff3b50474c94c5434e700d19eff4c46ee84ef0a424e850a3e7fd78d6f62d1d19912a8a38e66

                                            • C:\Users\Admin\AppData\Roaming\crop.mark.bleed.xml

                                              Filesize

                                              946B

                                              MD5

                                              698edf38b621162b47ecec4210df45ed

                                              SHA1

                                              d8765a302abe40e55ba29bd26497651a46756f62

                                              SHA256

                                              f5907f5e0a5ba15fa9a0878143f71ef4962f0a3a20eea324a526b0cac31b2b01

                                              SHA512

                                              08179156c0466572e497aeae7f464cfb34bb7172a6429de7d6e47c3dbb89e0b92a8e5448d5d95ae02ab76615e576218525b8004b63abc03877919accfee67de0

                                            • C:\Users\Admin\AppData\Roaming\data_transfer.png

                                              Filesize

                                              1KB

                                              MD5

                                              6dcfd632eb0a8124ea05a92209e73bab

                                              SHA1

                                              094612b281c4d378ec3def211d60a259bcb41fca

                                              SHA256

                                              0b7e998b98af82bbf0e9f8916aa5e1614a3e42d7a79cd2877c7c72690a42272e

                                              SHA512

                                              581f7f73592c3cf0999a76a2400e0d385330d0594f12c1fe7e37cdef492fd2eafafaec2b6310000efac34c507a1bc660a7e9d38158c888e3869d19ca3f74acab

                                            • C:\Users\Admin\AppData\Roaming\diagnostics_na.png

                                              Filesize

                                              410B

                                              MD5

                                              1b509acbb124eda9d7a1f722941096cc

                                              SHA1

                                              9ed8ce338f74a57365546c4e112cc25564b7c971

                                              SHA256

                                              b6eaa77c7f3cc6efa96fc6f7f555477d7ba9226206cc954212d52d2e2dd90ebc

                                              SHA512

                                              61ec6ef8e4697456261b9d49b883f40a75f50f5c4c6bcdd4a88809724608fa6645803ec30b687b7d8a07eb6ff088e3eeb5bd46b55e0d916ad4a2fcaeec173d2f

                                            • C:\Users\Admin\AppData\Roaming\diagnostics_queued.png

                                              Filesize

                                              250B

                                              MD5

                                              42d41cbebc9df064e55e06bf3bcc5a2c

                                              SHA1

                                              b037f0eef44b874aad0091b2c5e3b6bd12f219b1

                                              SHA256

                                              b8a3ce2bc7d65d8f2c18b570f14ba03a8729b460e2e6e9a7364308199efbdb40

                                              SHA512

                                              fff2355aa493f321eeba30417aa223fae2a57403b26bdc65ef67bdd5a943a32f62bf92c48f1db8fd2fca1f7efa0f8109ba89ee2d14215c663f758e7bed22e989

                                            • C:\Users\Admin\AppData\Roaming\eamonm.inf

                                              Filesize

                                              2KB

                                              MD5

                                              e8d4282400a1c4709ecb37b933269a98

                                              SHA1

                                              dc9febbb99924c761c77bf69286241efaa803f38

                                              SHA256

                                              cb1765e39a9bfde57e60683657257cdae7c84c88d55be43524168a4010be701e

                                              SHA512

                                              f51e18f1705fa4bcb5bd7f072095ee4f9c37ed1503b038854a4a147344f08deda036e000ac4bcfbbe4d688bc238434d18dea75db645c7648ca63e8c00a6b11ec

                                            • C:\Users\Admin\AppData\Roaming\embedding.xml

                                              Filesize

                                              4KB

                                              MD5

                                              7246ded2719a2ed3a5d325dbe15e4226

                                              SHA1

                                              d6f781dd2f3d9e3c4388ec7a07b20c9c490f9cef

                                              SHA256

                                              44db2977e5bb2422e73c63d4bd1a727779313c1acfe124b205325db391076f3c

                                              SHA512

                                              76855b922d4ecfd2caf708dd94a424853f03470f1d13a4ebccb3e56e8068dd36855ae529381f80817be576bd6d43f55e64ce8c1bec12e525a2ea16c090fe97ec

                                            • C:\Users\Admin\AppData\Roaming\f16.png

                                              Filesize

                                              1KB

                                              MD5

                                              04e342c4c897da1280973c56fdfa4017

                                              SHA1

                                              b035ecefbb20dbf906fe3dcee8bc39e8341f8346

                                              SHA256

                                              14130d579b728d41dddeead049bd96a1fa1b41a93bf0de5776164ce467e47790

                                              SHA512

                                              aaaaa5f84671de83a894bd5531a0f8dc842763023352db3a74dba9629beaa0020a1bcfd0d6a83752338a13b862cdb69dcf26c6ee4df0c26db0a99a61bf77ab39

                                            • C:\Users\Admin\AppData\Roaming\f8.png

                                              Filesize

                                              1KB

                                              MD5

                                              d9235deeacc7d331ccdc9d5bde06f32e

                                              SHA1

                                              b72d0fafe7d59f98ac26f03f2aba7c260be0ecf5

                                              SHA256

                                              63abc4a1a89822a59fd6ff22047a5020f37acbc8e35acb2a0dec5061807db943

                                              SHA512

                                              2d5006f2fd85ed1d7c8d759f4b562290d4971e690d4e896a13691e85d1ab53aa24c49a21351c69755e6d954ac9f99ab5df97667f128dd3aec87df099ed9f4918

                                            • C:\Users\Admin\AppData\Roaming\fi.pak

                                              Filesize

                                              4KB

                                              MD5

                                              ad8bd1d148df05a5e4466ad1aa235238

                                              SHA1

                                              a10d10f66ae7b761d52892bcae70ac24be183dd1

                                              SHA256

                                              0f8b07de44956f6187754946f127e23f64c646493721db6459367d61eeec9190

                                              SHA512

                                              ba291b0d95dc16e089de45f7e5966ccb465a45060f08c9a89403bd948b9f9c8a99d3320f83bbb49adc10ea80f3aa3835d6f541bdde8d9a680f6edd6e3d8b426f

                                            • C:\Users\Admin\AppData\Roaming\function.parens.xml

                                              Filesize

                                              922B

                                              MD5

                                              054b78215f249c0bdb4a66dc5194ff6b

                                              SHA1

                                              b7375a86ea0bc22a5a2033ea92eb0435e5a6c0d4

                                              SHA256

                                              4acce89219d39f8e1f024bd6e90f93936afc4899821cf0674548f96a80815fb9

                                              SHA512

                                              e59c92ff9198afa690a61d789379e6cc448156c20a673e948066dbf97446bf2f11533516d92deba0b865b8b6460b785646cab9970234aada7fda02fdac15fca8

                                            • C:\Users\Admin\AppData\Roaming\goURL_lr_photoshop_en.csv

                                              Filesize

                                              510B

                                              MD5

                                              72846352548853b375cd1966c5b25a3a

                                              SHA1

                                              c51c6d5641dfcabdb6569e071c502deacda8d2d1

                                              SHA256

                                              97f1d4f62e381f8f65d3e7d3da9f3c5d8194c73a2d30a2d08057d0d5ce30e130

                                              SHA512

                                              b4c5a4be9a676323e3f1df1eed60761def150a91e237d830c96413770397df3138176ffb1374580b10abb1466bebc8f8aef99d0a44be0fa29ac5edce3cf9874e

                                            • C:\Users\Admin\AppData\Roaming\{73E2C040-E79E-C111-12FC-85EE17911C8A}\raserver.exe

                                              Filesize

                                              211KB

                                              MD5

                                              445ccd39adf264dd422cd181f7bfa915

                                              SHA1

                                              85f9e892fd3a6b396868d2f06f33fcd7ffbe9eab

                                              SHA256

                                              f1790d16765d15529243d326719330b7d0ad989f6fa452108e11646cc9328873

                                              SHA512

                                              9ce007c002a25dd6b0261cf2def6c3b1c486c72324d952c74754c2785d7273d23bc5ae8cb1097a482b2d4496e0ce97f7c2df03b4691a7cda04899a1e093069de

                                            • memory/1072-567-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-555-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-166-0x0000000003E70000-0x0000000003E71000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1072-164-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-162-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-168-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-169-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-170-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-171-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-549-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-576-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-573-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-570-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-177-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-564-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-561-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-558-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-509-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-552-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-546-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-543-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-540-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-537-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-535-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-579-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-178-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-174-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-664-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-175-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-663-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/1072-645-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/4652-53-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/4652-51-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/4652-55-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/4652-67-0x0000000000400000-0x0000000000423000-memory.dmp

                                              Filesize

                                              140KB