a04ccc459ad4dcd2cff42884c5c64f2032aad33473ba737828747b932cecb99a

Analysis

max time kernel
142s
max time network
151s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-10-2024 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LCRYPT0R/LCrypt0rX.vbs
Size

12KB
MD5

24cbd3ad1736fa6950e220bba381429b
SHA1

44ceaa0b8622f64ad1e1d2283c4cfcc8629be152
SHA256

719ed739717c7ac5a2bbac4187738df3ead0e38e31f4a656e976e9a5716a9af0
SHA512

fc8fb1b1d06bf331c234af985f0fe2269d2f552dbd315507bb9796bb20eec948531c08e3f385ed9a1e6a8e86001fcbad2a8a8601fb1265621d634c975ce99ab8
SSDEEP

384:HobplStxYHQHSH7l+ii3qF2ZNvLyyB8dstnH+7Me:aM22M

Score

9^/10

defense_evasion discovery evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2832	wscript.exe
5	2832	wscript.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyStartupScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\LCRYPT0R\\LCrypt0rX.vbs"	wscript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\iamthedoom.bat	wscript.exe
File opened for modification	C:\Windows\System32\iamthedoom.bat	wscript.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\gcrybground.png"	wscript.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2896	vssadmin.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1956	taskkill.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop	wscript.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = e0fe2f380522db01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b9600000000020000000000106600000001000020000000771d51bdd99ef6d41b9d396d7c2676310886ba74b9854a9628b08ac5f5af72e4000000000e80000000020000200000003646848d034e0667caf28dbe08f3573eada45d6f4b430c6af65fd880cfc96f46800300004da92f9f7764798c6d45e4662ad6300a570b7cf92222078ed3c30a63756e611a5c05972ed436158322b4136f4142ddec68ac2b5f0838eae08f80522cca2e87f1a76c10885e1d4c9ab92f2f4013a9fd619ffa9ad04cddc92860ce5d20dcde89b47483089ea4bf681483d5aafa38749da9a567c6f9fb97f6b7d9f5d4b8727b137f69273041674e5fbc5bd7c8906dc7a2a322e59a7bfbcb8fe758a05b3cd32b9d6c1d52af2df6a0a89127c4514207e100ed94902655eb40b1123455f02237bfebfdefc2d84f12ddde5f6fc82588b6945e4ad3aaf3a8d5ee624b220ce5150b24014384ec04157cd67a43ee1f08a8709939ca1ea22a40c784e94c57129807d8125e133907167d3d8c671d1882c3c03b09a8a46e9613673fec2708cf8aeb2e4fa6836f74e7abc4a5a9fd5877b0037045cbb009964357977e61dc5159c30c36661404da52d8996d9ee20830ed6b616ef96aed1139674b49b08c4f56d50eb3f54cc8dc5bfdc669c271c3dd9c4ed837256a22bd2996c10679eafbfd0879f480fc1d17a15f847d6daac2095e89945890d06a49c949c09a1d50e75bd262f872611b6dfa070f00b25a50d26edc0d856d5601d1acb33fe03e361bf7f2e77b1e8808c8333402cd8ffa165acd6514aeaf3096d4393d401f0613e3492c0e36c1c913a0d644f00246b004599f08458faa03e8035c505a944099989cff7cce742a7050be139d87033acb7c76eec2470a237dc583294058342d3bd21ccf01110e2998b0f67f979a7b788e8b5d7292106212b4c22267f13640c19cc74d89a0541aabf1c0b12d8d2b488b8add55f07a888bcc6ea006063a37708dba97fec53a6d6c653241852dd9e078bc9548016e11fec1a13994e9865b468f92e6376bdbc67488fad95a01d21dbf2afab5e1dc9d3f5ecba3d33c0658c9aab9b3daac5df360da8574a6db0557136ba230210e5686217a5dd701b60946f654e9312326f00842a2b11149239b93cda2c5be4e81ddf226392fbac110585f1d5a43fa41adb06c29d6866f08516f76fd89e00d51306efaf445bff186b1a8f21c809d4c96e1c370a94765fcd2ee4a2fe37cec9555db8c48ede36e195ab14dc565931d041a67f2f6e27e1cb5fe9ea81af5e9789f117b8f97bca5e1a76a89cf7b6baafb8d5b4058d98f92f5b24b4887b80e751d8cab5e837b12d22ff1ac25c59cfd8f6458560ea9978c12f5ab617b8bcc00fae34f9060d8780e77740f96dd628b3ad137a3ea9bc349eb903aeaff2deb4e120cc1f6400000009115c7fdef8fefd1d8110028c2bbfc3f9ade0ce833f1ab59fe2111f406c205680c46e9854fcba3fad243f90dad042a03e1e990630396ea10c3b19bd45e9faf09	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff19000000190000009f0400007e020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{52A084C1-8DF8-11EF-ACA8-72B5DC1A84E6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b96000000000200000000001066000000010000200000002d5b8827e60254f5fa7a88ff2ee0d811c33fc8973893f7762a092a2accf64f2a000000000e80000000020000200000007f795e56aacbed54def514df83067640787db359640aa5759ebb4ffd63890f11800300002a6f7df12f76ca3fc6de436720603c89e9a96157542d99286ed9defbf1b038d70db9aa909badf071a2e6dcff41a1e6cdf675758085b79ea68ed7fdb806e04f9a73988cdc4c4a6838bb6957e200d7e3b6d9c27684cf7c3a5e09d5b5f3a9228716d9ff54472ab82606a38ba935e2731afa137bd214dcef13d7b101802fe9e47e51f0b96b1aa39a21407ec4da30a76df3b4e648d4ad003dff709baad89a0a97b69e29ee6f55dfc42235f17c01a2ec36c8395fb1a9c0a46492da9c5395d444f166bcc32124026e0939559a78771962e55622f462a82fd85abd1728fd3c07cfd80f555ea7e3336e5d07d5e35cf2e3a8ccde6171d08da50d0841ce30e745c0a3b72fc090e31c30e0d5cbacedf67b8158ba81deb619b41052902c47eb4ae0f31ab5a4113f97878df555b66e966bd013da4749a6ab340caf4fb0ab5d9f15290c7980d355405d28d479f2cda800bdbdb2bc607ccaa7edf5c51fba400d2f262f4c61122814ecb3a55e693eae49e9720ab7f08180ca0deae85767b55a8e85cd46e87d01d410a381538e9ded5c7ef7647a19bedc49234a1d3e06cb417f7667dcda692713efb87b7262277356edaecfd1b3f7a8a18e99e00f69d10b428eec574a594520417bb5d6d8bcc5dce3a108dda60db146b3edca7295c7e31ff272dfafcf2ce1862f619f2efbc29b5f18b7c7d61768b669ad344a7f8c425e410b975f1e30800577efee3714ad7a4a15c4252435f856cc5aa3846bf698cf863a70e2603b9fd40b522a9bf4d5b69f3afec8b5f79a3ae24f2df999c3d278df196e96aa547ee82b9ebe59a92a2e0c7daf3501bc407221cf3bade0e95ff81c4c63754f9eaac53e836b66294575a966c85c6436a8ce34169a881ae6e5e6d9d6b2c45cdeae6dcf151abc5cb68164a437cdd5b26b35ee0ed681039b5b30d37675c2f0967f14506ac49a3ebe517437ba8ce33077f2dab4a65cef17530b631f650e8e3f08c0aed8f35d271d5c92eceb2d5ebb4887955c76c9696c89e441f61185050ac7209f0ba270dc2057ab4066b4f134a4e366a1763d3a5c561969d90967e9eebdf4c5ddfa6494ea1e6637f71f4bc59d73ade0af60124f7a7b217111eca609c610ede922cd45b82ec690b148242473b75262f8d11dd5616a162b751eb4b86fd7fe96f1c36be720257ab0456cab7244d620bce0dfa357d26f986801335bfaad496437adf075e502acaf72c7a0bd878e7ef616724b11a337c1466ea599373e7edbea7da490f864a47c1a3b00c2c55a40000000fb9cd615a66a7fe03cd553a1c08bb66825a134f9dc099fd5a32d3ceead6318110aecdeaac6ccc31a8553d27d89f98dbfc152ad86ccd6deb50e7b3fc6afec2512	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5259EE71-8DF8-11EF-ACA8-72B5DC1A84E6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff19000000190000009f0400007e020000	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\SwapMouseButtons = "1"	wscript.exe

Opens file in notepad (likely ransom note) 6 IoCs

ransomware

pid	Process
784	notepad.exe
3512	notepad.exe
6416	notepad.exe
3348	notepad.exe
10168	notepad.exe
2296	notepad.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	2880	vssvc.exe
Token: SeRestorePrivilege	2880	vssvc.exe
Token: SeAuditPrivilege	2880	vssvc.exe
Token: SeDebugPrivilege	1956	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2428	iexplore.exe
2428	iexplore.exe
768	iexplore.exe
768	iexplore.exe
232	iexplore.exe
232	iexplore.exe
1904	iexplore.exe
1904	iexplore.exe
2300	iexplore.exe
2300	iexplore.exe
2576	iexplore.exe
2576	iexplore.exe
2200	iexplore.exe
2200	iexplore.exe
2152	iexplore.exe
2152	iexplore.exe
1168	iexplore.exe
1168	iexplore.exe
2108	iexplore.exe
2108	iexplore.exe
1984	iexplore.exe
1984	iexplore.exe
2160	iexplore.exe
2160	iexplore.exe
880	iexplore.exe
880	iexplore.exe
3296	iexplore.exe
3296	iexplore.exe
204	iexplore.exe
204	iexplore.exe
1548	iexplore.exe
1548	iexplore.exe
1676	iexplore.exe
1676	iexplore.exe
280	iexplore.exe
280	iexplore.exe
2060	iexplore.exe
2060	iexplore.exe
1736	iexplore.exe
1736	iexplore.exe
1648	iexplore.exe
1648	iexplore.exe
892	iexplore.exe
892	iexplore.exe
1480	iexplore.exe
1480	iexplore.exe
1652	iexplore.exe
1652	iexplore.exe
1868	iexplore.exe
1868	iexplore.exe
2976	iexplore.exe
2976	iexplore.exe
900	iexplore.exe
900	iexplore.exe
2884	iexplore.exe
2884	iexplore.exe
4188	iexplore.exe
4188	iexplore.exe
2428	iexplore.exe
2428	iexplore.exe
2428	iexplore.exe
2428	iexplore.exe
2428	iexplore.exe
2428	iexplore.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2932	mspaint.exe
1356	mspaint.exe
2948	mspaint.exe
2284	mspaint.exe
2392	mspaint.exe
2512	mspaint.exe
2160	iexplore.exe
2160	iexplore.exe
768	iexplore.exe
2428	iexplore.exe
768	iexplore.exe
2428	iexplore.exe
1548	iexplore.exe
1548	iexplore.exe
1168	iexplore.exe
1168	iexplore.exe
1904	iexplore.exe
1904	iexplore.exe
232	iexplore.exe
232	iexplore.exe
2948	mspaint.exe
2512	mspaint.exe
2512	mspaint.exe
2512	mspaint.exe
2948	mspaint.exe
2948	mspaint.exe
2392	mspaint.exe
2392	mspaint.exe
2392	mspaint.exe
2932	mspaint.exe
1356	mspaint.exe
2284	mspaint.exe
2284	mspaint.exe
2284	mspaint.exe
1356	mspaint.exe
1356	mspaint.exe
2932	mspaint.exe
2932	mspaint.exe
1676	iexplore.exe
1676	iexplore.exe
900	iexplore.exe
900	iexplore.exe
1984	iexplore.exe
1984	iexplore.exe
2576	iexplore.exe
2200	iexplore.exe
2576	iexplore.exe
2200	iexplore.exe
2108	iexplore.exe
2108	iexplore.exe
2152	iexplore.exe
2152	iexplore.exe
280	iexplore.exe
2300	iexplore.exe
2300	iexplore.exe
280	iexplore.exe
1648	iexplore.exe
1648	iexplore.exe
204	iexplore.exe
204	iexplore.exe
880	iexplore.exe
880	iexplore.exe
892	iexplore.exe
892	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2832	2752	WScript.exe	30
PID 2752 wrote to memory of 2832	2752	WScript.exe	30
PID 2752 wrote to memory of 2832	2752	WScript.exe	30
PID 2832 wrote to memory of 2884	2832	wscript.exe	31
PID 2832 wrote to memory of 2884	2832	wscript.exe	31
PID 2832 wrote to memory of 2884	2832	wscript.exe	31
PID 2884 wrote to memory of 2896	2884	cmd.exe	33
PID 2884 wrote to memory of 2896	2884	cmd.exe	33
PID 2884 wrote to memory of 2896	2884	cmd.exe	33
PID 2832 wrote to memory of 528	2832	wscript.exe	36
PID 2832 wrote to memory of 528	2832	wscript.exe	36
PID 2832 wrote to memory of 528	2832	wscript.exe	36
PID 2832 wrote to memory of 784	2832	wscript.exe	37
PID 2832 wrote to memory of 784	2832	wscript.exe	37
PID 2832 wrote to memory of 784	2832	wscript.exe	37
PID 2832 wrote to memory of 2308	2832	wscript.exe	39
PID 2832 wrote to memory of 2308	2832	wscript.exe	39
PID 2832 wrote to memory of 2308	2832	wscript.exe	39
PID 2832 wrote to memory of 1692	2832	wscript.exe	40
PID 2832 wrote to memory of 1692	2832	wscript.exe	40
PID 2832 wrote to memory of 1692	2832	wscript.exe	40
PID 2832 wrote to memory of 356	2832	wscript.exe	41
PID 2832 wrote to memory of 356	2832	wscript.exe	41
PID 2832 wrote to memory of 356	2832	wscript.exe	41
PID 2832 wrote to memory of 1732	2832	wscript.exe	42
PID 2832 wrote to memory of 1732	2832	wscript.exe	42
PID 2832 wrote to memory of 1732	2832	wscript.exe	42
PID 2832 wrote to memory of 1956	2832	wscript.exe	43
PID 2832 wrote to memory of 1956	2832	wscript.exe	43
PID 2832 wrote to memory of 1956	2832	wscript.exe	43
PID 1732 wrote to memory of 2932	1732	cmd.exe	46
PID 1732 wrote to memory of 2932	1732	cmd.exe	46
PID 1732 wrote to memory of 2932	1732	cmd.exe	46
PID 1732 wrote to memory of 2160	1732	cmd.exe	47
PID 1732 wrote to memory of 2160	1732	cmd.exe	47
PID 1732 wrote to memory of 2160	1732	cmd.exe	47
PID 1732 wrote to memory of 768	1732	cmd.exe	49
PID 1732 wrote to memory of 768	1732	cmd.exe	49
PID 1732 wrote to memory of 768	1732	cmd.exe	49
PID 1732 wrote to memory of 2588	1732	cmd.exe	50
PID 1732 wrote to memory of 2588	1732	cmd.exe	50
PID 1732 wrote to memory of 2588	1732	cmd.exe	50
PID 1732 wrote to memory of 2428	1732	cmd.exe	51
PID 1732 wrote to memory of 2428	1732	cmd.exe	51
PID 1732 wrote to memory of 2428	1732	cmd.exe	51
PID 1732 wrote to memory of 1168	1732	cmd.exe	52
PID 1732 wrote to memory of 1168	1732	cmd.exe	52
PID 1732 wrote to memory of 1168	1732	cmd.exe	52
PID 1732 wrote to memory of 1548	1732	cmd.exe	53
PID 1732 wrote to memory of 1548	1732	cmd.exe	53
PID 1732 wrote to memory of 1548	1732	cmd.exe	53
PID 1732 wrote to memory of 1356	1732	cmd.exe	54
PID 1732 wrote to memory of 1356	1732	cmd.exe	54
PID 1732 wrote to memory of 1356	1732	cmd.exe	54
PID 1732 wrote to memory of 1904	1732	cmd.exe	55
PID 1732 wrote to memory of 1904	1732	cmd.exe	55
PID 1732 wrote to memory of 1904	1732	cmd.exe	55
PID 1732 wrote to memory of 892	1732	cmd.exe	56
PID 1732 wrote to memory of 892	1732	cmd.exe	56
PID 1732 wrote to memory of 892	1732	cmd.exe	56
PID 1732 wrote to memory of 636	1732	cmd.exe	57
PID 1732 wrote to memory of 636	1732	cmd.exe	57
PID 1732 wrote to memory of 636	1732	cmd.exe	57
PID 1732 wrote to memory of 280	1732	cmd.exe	58

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoChangeStartMenu = "1"	wscript.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\LCRYPT0R\LCrypt0rX.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\LCRYPT0R\LCrypt0rX.vbs" /elevated
  2⤵
  - Blocklisted process makes network request
  - Disables RegEdit via registry modification
  - Adds Run key to start application
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Modifies Control Panel
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2832
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2896
- - C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" USER32.DLL,SwapMouseButton
    3⤵
    PID:528
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\READMEPLEASE.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:784
- - C:\Windows\System32\RUNDLL32.EXE
    "C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:2308
- - C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" user32.dll,BlockInput True
    3⤵
    PID:1692
- - C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" user32.dll,BlockInput True
    3⤵
    PID:356
- - C:\Windows\System32\cmd.exe
    cmd /c ""C:\Windows\System32\iamthedoom.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2932
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://languishcharmingwidely.com/22/f4/31/22f431404146fb2f892b30f7d213aea4.js
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1492
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.msnsndstdyyemkemafgk.dns.army/receipst/vbc.exe?pla
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:768
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:768 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3168
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:2588
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2428
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:6829057 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:6224
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://smoggy-inexpensive-innocent.glitch.me/
      4⤵
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1168
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1168 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3204
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://mail.yahoo.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1548
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3184
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1356
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://languishcharmingwidely.com/22/f4/31/22f431404146fb2f892b30f7d213aea4.js
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1904
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1904 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3636
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.msnsndstdyyemkemafgk.dns.army/receipst/vbc.exe?pla
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:892
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:892 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1552
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:636
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:280
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:280 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://smoggy-inexpensive-innocent.glitch.me/
      4⤵
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:232
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:232 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3652
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://mail.yahoo.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:880
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:880 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1500
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2948
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://languishcharmingwidely.com/22/f4/31/22f431404146fb2f892b30f7d213aea4.js
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2300
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3420
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.msnsndstdyyemkemafgk.dns.army/receipst/vbc.exe?pla
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2108
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3388
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:2112
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:1480
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1480 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4468
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://smoggy-inexpensive-innocent.glitch.me/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2576
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2576 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3136
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://mail.yahoo.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:900
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:900 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4076
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2284
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://languishcharmingwidely.com/22/f4/31/22f431404146fb2f892b30f7d213aea4.js
      4⤵
      Modifies Internet Explorer Phishing Filter
      Suspicious use of FindShellTrayWindow
      PID:1736
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4432
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.msnsndstdyyemkemafgk.dns.army/receipst/vbc.exe?pla
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1648
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:1516
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2200
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2200 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3148
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://smoggy-inexpensive-innocent.glitch.me/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1676
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4064
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://mail.yahoo.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:1652
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4212
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2392
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://languishcharmingwidely.com/22/f4/31/22f431404146fb2f892b30f7d213aea4.js
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:2884
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4168
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.msnsndstdyyemkemafgk.dns.army/receipst/vbc.exe?pla
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1984
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4092
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:1224
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:204
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:204 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:3880
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://smoggy-inexpensive-innocent.glitch.me/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:2976
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4476
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://mail.yahoo.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:1868
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:4328
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2512
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://languishcharmingwidely.com/22/f4/31/22f431404146fb2f892b30f7d213aea4.js
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3432
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:11678723 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6384
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:25113601 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:6052
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.msnsndstdyyemkemafgk.dns.army/receipst/vbc.exe?pla
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:2060
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4508
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:3024
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:3296
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3296 CREDAT:275458 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:4676
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://smoggy-inexpensive-innocent.glitch.me/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:4188
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4188 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:4316
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:4976
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:4496
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:2420
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:4464
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:5264
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:5476
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:5860
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:4208
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:5448
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:5904
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:6940
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:6452
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:7604
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:7864
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:7924
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:8092
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:7156
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:7904
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:3528
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:8012
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:3120
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:5768
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:2308
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:8060
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:1864
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:7292
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:1932
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:7952
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:7264
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:3452
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:2980
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:5244
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:8428
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:8688
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:9040
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:7548
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:8672
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:8964
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:7640
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:8564
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:9084
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:8280
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:8760
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:9140
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:5780
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:9024
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:8520
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:8360
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:8664
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:8444
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:8232
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:8860
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:9652
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:9960
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:9912
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:10004
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      Drops file in Windows directory
      PID:9760
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:9440
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:1664
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:9904
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:9312
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:9296
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:7700
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:10352
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:10812
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:11148
  - - C:\Windows\system32\mspaint.exe
      mspaint
      4⤵
      PID:10408
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:10868
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1956
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\AssertComplete.xlsm.lcryx
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:3512
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\CheckpointDeny.xht.lcryx
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:6416
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\desktop.ini.lcryx
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:3348
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\DisconnectUndo.mpg.lcryx
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:10168
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\DismountPublish.dxf.lcryx
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2296

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1EE2A8B033EB8C8D30746A1B3BD4E662

Filesize
504B

MD5
9351cc0c01783065e0e50b852c732dc4

SHA1
b4768c3bb4e1fe2e96bbb346deafab6760497168

SHA256
479c53c5e913131dc092554f42cb40877fc1899e50c816f1ad5f096737b7970b

SHA512
d31739b56758c6af7eb9c1fdee13bb0d4b5632ec05512cdb5bf8619af9f57bc2e70db7eedf628b9fb20a461ca5c2f7751e19d7543ddd9f4ef8e4d60c737e1d16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
e4371e4f58e222275d1ebc0c14876593

SHA1
5582883d674c9b1bf3eef72eb08edc8806afbcc8

SHA256
a0d1a6695cc8fcc5e3d823f7794f64c6bdbb58217e514e14e8b608b8827b7920

SHA512
04cb6a75a0f1d8aa1d152e134237b6c5873a71a3dad2307036d4050c00cf687ba1d1a6755f2907501de6e76b84b210e0b237e6c6dbad1d655e53c5d14ebb11d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD

Filesize
471B

MD5
6c52aa2bc66cc6e979cf61111a766be9

SHA1
9ac989af66cf25b7ac5a2edd9207046f48ba9ce9

SHA256
2a1c5ecd47ba7faaf614859d6206d0e0307bd6d85a28f0d08800b8a8c4961f4d

SHA512
4c03a340d56df97b06cd8d5fa08de6e284234d675c800eced01f3d32455209ce9da5e5f09352f9e8f8a6754062bfae6a429bc73c490597264eae0537c24bd022

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
67e486b2f148a3fca863728242b6273e

SHA1
452a84c183d7ea5b7c015b597e94af8eef66d44a

SHA256
facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

SHA512
d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
9f23271a7222ca6f917135df4f166fd8

SHA1
f89e69eeb24ef33e80902c53ca16f2102a1d21d9

SHA256
cc3c1bd1f13a3371ac30770ad243ca823c4e39546c3db57bcf09b01a6ba4c41d

SHA512
22152ef844ae62c59df673b5de055f787c078fad108c55f750f6778dd985c726d7f7fe0d17315e81c3f3021f782964e5ec98b3a6a3af23804a1dec4638a327be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
c8ae357b293ec93c62c8557d2c145251

SHA1
a50db972103fbbda774bb652b3ec9ba22514449e

SHA256
05bf2f7bc8179bf65dfb0623aec9a8413e55cfcbf88029e4fb7550d16852456f

SHA512
8255c9812858680149f92c0d273a85b8f56f3a44d85c73b0ca8391346b65c293c97e914930061cc3022456138a5ba7fccc3dcc748b5022bfb075307f20979b5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
b7f46f5dafbeacea1fde76503c859156

SHA1
a55afe597543f86e4af61ebf995f4d46519af033

SHA256
782efee5d1582e8d0ad2d7328d303fe1600a681707bb4d09402913f88093cad3

SHA512
0d8f8f2ac156a314a48ec1ffdcfc32bce8fdaa20915562294d89d88c40634f8d1232e967b30f89d646960c9c3f56eeedfbb7d90758d453bd1737da00259d56ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
670ed871f6c9b83925ced2fba716d904

SHA1
563fd093dcfa9f630071a1c8af34857e013c2ca6

SHA256
a6459c89b5bcda5c47e507334c259722ab2dda32733d5f67a9294ce2b9574434

SHA512
1f0bf7756d601471685a94cfd044c1bb8e6b7e1cec140ae5c2c6e3e166fb66514c06d4e3c3e77a10b9ccbca3cfad3a87bf9f3cf14c105ea1d0997c107a450742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
7ae610d84ba5202d1c3879d9beeba96a

SHA1
b33dd98baafb34f6ae6822c3d4f2ee4883c67548

SHA256
1cc1f807ae6c60f0b732c28605f100a32d77724ccf457b1c034a94cc8b8fd298

SHA512
52e812502133bd64a739b136b7f6acacd5244dfdb2f8bbda9af347d5e98fa81f3405e4346aafa5d2cead3745dc9514b383e33835846a313c14b94c9e2f888d37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1EE2A8B033EB8C8D30746A1B3BD4E662

Filesize
550B

MD5
243b60b5cfd79db157dcf5b17f96819e

SHA1
1275527dd4d767fb24e2672b061aaa97b1f15a6f

SHA256
2e97cacb8f083f712d94051594ed4cbbc2fa210a025caafe4c29f8a50ef714f4

SHA512
7595bebdd6c0aca3539b53764324d39c9508e7ba523d0729a6428369302dde8be739e7e709507c29c2b85e5d304657be06951b397271d3a970390365a2ee62bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1EE2A8B033EB8C8D30746A1B3BD4E662

Filesize
550B

MD5
a63bd4fdbfe7d173e6e5868b4cbe0b0e

SHA1
5e64e000eb22559b92dd2294ed9d64fe46b73c14

SHA256
557f262ddd00e6ec1d9bb837e4be43a418e9061401486a3c9b966d8854d245bb

SHA512
27ada1afc3bd3b1aac194c33efffc5b56c0fa8c1813bab6ee0ae5a3d04f31e0b110dbab7ef33d4b5cb2e7aadd0d695fbcbba50245f04240afbe6dde7f02f0230

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1EE2A8B033EB8C8D30746A1B3BD4E662

Filesize
550B

MD5
53317814a530c0185194862e03451b02

SHA1
1fecd6283c4fdcdddd43bfa617e0038c9fa45590

SHA256
facfff35bb152c4116435d2f182892fb53a7264590682567f34d8ddfbc35e1a5

SHA512
f222c453efcd616ed41e181f0d2bed67720516d86439e59d511ab4562ab0e4767779576d81af992b857f08c843e0c9c75ae3133095ce5435efdeecdec6646cd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
98175fe75a4f86c09c378731af4107cc

SHA1
6886fef2bcf58c185d85bcfcd6377bda099a353b

SHA256
620041829982a4b8f1fe7aa016e29d15c8fa13dc34f267ee60b66ce2334c95c9

SHA512
b4f09e7a9d8cef462b59c759653a8c684e6485f713700b67aabba2be0b756c968d79889e59299734037a2dfb4111b17f76cffaec37e958bcf8f4697328653c6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD

Filesize
406B

MD5
160d672aba1a216a3d1234de68fe5710

SHA1
f567777d98a0fdaa12eeff68bbf99de3eb92505c

SHA256
2e7cf99ba22a50619c7d5db643f787c79b60b37ca7eef484278d971140e7f886

SHA512
bd40124b0fa6ef99885b50dd6ff083838094d9f0d1686327b900719cf020607dbfd0e99eedf59436b9513bedf02274851a7ab50925b80717ab3aad028be3a993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
d4064aa2278e3c13eb385903e5bdc0a1

SHA1
331a6e8dc730957d34136cde1d985872fbbe3801

SHA256
f213dfb1546886e97acaa7ae0d0d2edc686cbe3a9b56611afc72044354ec0ff7

SHA512
848b7eb636d8590aed22894ea63e798ba283252d5f90bc8acbca4d7d12f963387d3265df15e05ed74c42feaf24e4be7a1e4cb8594ded343c7a3df62842bc7cea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb4e461734c17960f778c819b4abaea2

SHA1
7fb46676f65bc9cdc4f267fb45181168c14795f1

SHA256
2bff24001c244f507a89f91a53290ed3740907b08b9f61899165b0ccb309fcc2

SHA512
c6174c69915d94491cdf5f6ee10c20ae7d8ee85938afdafcfdfc5bac0658f33f722f0cc0857636ae6ef156e89bb7805e33833b904d76c20a59f236614ddb342d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8525fb38c88804a02802b689d329b696

SHA1
34fcd33e6c1de53be6d2d580c5b4983dfa7f4275

SHA256
d464c4f678b5e775e2864f253f3eb07a0c15203aaa9ae06cb76931dcbf26adaf

SHA512
d1053663a0c4d4b8d31d5a22c8da4c2ec5457925084e41f56eb9c95713e3c7ab9ebeea0f1d35743432aa69955c2e86ea8d83169ca6d1f4da8aa136ef78c218e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61d933f1dbf1313860cc0c9e44d451a6

SHA1
5fdadde109e73ac91012dd187567d8f1f43f1ca9

SHA256
4c3e87d61aed18f1a215ee2c64e6cf72589709f08d312f60e2bfef9bd163bbe6

SHA512
7f3ba11fc5aea8a14fb10960f6879737c0df606df14b42570e4ab8bec1e978fbc4f380a9a696d6dc37e83f143acc9856174554ab80738e9be96b5c269fbfe0bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
814fa0b23c4b83c234035f9d1a914118

SHA1
2970135b03efc97ce970c5601b8bf5e77f641f3d

SHA256
dc77e8b142e16675cb6ec0f638e57e0567fb2ebb801feaae612f431cdf2c5c8a

SHA512
a2f24dd8856acdba91eaa87327426c8cb7250692a7bf96086c71913eee026efc887426b1a742d46c7f05930f1cc58910710eebad7761f038261a894f6dff27cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbab60b11465a5eaa87e76212f57d96c

SHA1
70868d9341ff71fa7493cccb2bd25a10ec788ca6

SHA256
aa850487c0d4fbdd844e23c4e59934cc1a92c21f9899ad7d98b7a40de83878b9

SHA512
910f010a2f5badf6934a45d019c3bacf9e7649b77d9ea93890db4f210d0a943ecf90cdadfbb18f74c312a435124d7fc3b1a88c0fa5f14e0c4bb5f05ef450d93d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40a90db71c151ccec4b324d6325eace3

SHA1
7acde9d8956acba57f8fffd81fac98639d708cf6

SHA256
f3a472ecbe30a4ba587908672d5fc4fafd4b519af3c4aee9c0905d1aef465c47

SHA512
cd9d279d6c7d64c05f35808e898a99a6d494c5d1ae83bfe69cbd966071b7db65299bfc498892ff4072c89633197c78afb6031b6832b89f136f662596d85f1249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32b2b1fab91f9cb6fc431ecd1be7e106

SHA1
4abce880ce6f1f43de807d7cce1110cea9056403

SHA256
8adaeef5a2c7e29e0c830794c6a3281836e55e12a9a25e37e920e04f47997653

SHA512
a91af4b59094bf899335e2515c5e6b5124a486482bd2a463cc16898be25c61034525bcd49ad237fded33b64231ca2fd825e28f07251386b688048b9466b0d35c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e513f1f919c2a6303fe7bb823e2c3b25

SHA1
a5718f6c8223e83a30f4cf9410ba4e8565df941e

SHA256
aafbd87b662b74a7bb7d02c496075f8f27da3be247897c5ab32f2f90c5483e85

SHA512
f7609de867e7ad8b5c1bed1883f9e02d88a8a76aa6340bb7d0c435b08139b09c72046e3624d8fbc440a7f6bbe0078024a4c429532500938e01a428410e8fa76b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c83c5dcaf5be979a7fd97ef3f6caa0c1

SHA1
4068c235503514bee33405d7db4c260802ab83b3

SHA256
654cd78b4f3b58987d01bc5b72f7efb2d44b529ccd0c85cd92861c5ba45d5922

SHA512
da30bfa93c12cfa42d2303777ae09ee348dfe42ae80bfd82e389733c3133c01b16d51c6ba663d22c33d8645af2a16e8d19f8ba56697195d02ff70562d507fca5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c8486ca0470d28376940dad69adbf8d

SHA1
0d54fe310ad6d2d2817889ea4361f6b968bcd06d

SHA256
46589dc2d666d30f6ab3c6ee31309025e6a1fb41bbb5643354436098bb38dc2f

SHA512
05717bdaf1a9ba67a2a14e47e02d213e749dc6dcd72efa23a0471394e2e678df4e1816f138b3bf414b45c6bde426d4618b2ec52e9c12c283c005b4b6cead295f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01c75e35104c675ab4b49555ec0ae872

SHA1
6fd84f7c828a7d90b8959e6426118c93d7daf080

SHA256
1a9e0ad963f92be3a5e497a8528c4032942262f43a2deecbfef5386d095eff49

SHA512
c7ed1be1444caa29655d09550206024c5c4715b36d77ef8f1a3f6e00e9381063f194129e08b668c73144c1fd11d6515dfbc082932e67f2657fc75a7008077f9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac33cc642bc49d143cff7b68214c5353

SHA1
eccfe1b95191eb8e293c6043041a9c27d9b1277e

SHA256
fddc7409024cdb636631308486957766f52ccf9279a9e2c83df3cf36ac7fd40a

SHA512
86d496f6f9bf56f1290610c7406296f6ed06b71584660f1dcd2833b0c30608617c1106079c79744a69810bfce53c757e76d46c13489f2d07b857b38df8f0fcc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f557a776813c699d849a5dd3a4ada9e4

SHA1
91740cdfce88c3aa72a545ee3f19b54d2280a602

SHA256
d727bb1b233bd120d2322728dec6d4639fdc09f0ddaa2460c554a68f09270743

SHA512
0e5309c2560a8dce51b1f990aa8f2d0a6985126a6977822f1abe5d7cea34f4d9609978491b0ad1dea30dec5834c28cc15de7563093f6dae4e043445acaffe6f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed719cb56f7b747964992d0140f17eb5

SHA1
cf4bda47e5e50c1249fe25d12ed752256f7950da

SHA256
ab742b5d62661311c0dcc4b868db8b403bfc8c09a36a91c41b0246704f67ced3

SHA512
ca7420bf707edc3e0ce49e566703b4979e7399b73ac141211e69337c17e984b5a80cf87e1e0f12a5406fa43ac1139eba6fc3f3a8e462167a4c023d3277860c13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7a7b2e9bb38709c14085ccfd4637470

SHA1
1c6b751e388b48ad7284bbb427a6a5ec08f48ce7

SHA256
12f0fb7336ac2b53fe403fb68afdb242ef7a263363f7b80004b6fbf0e9180046

SHA512
1635d341db640639a38cc309bb04bf7328651738bd81fed65bd1e59402d4ff70dd4dacc6d730715e0f0c8a40eb22fc32d1724fdf86ceb62fe7432e981ea532fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6ead9099abb111865f2b6de09fb0115

SHA1
d3dfe6e3d806125c78e30148307f7f79dd2ce75e

SHA256
9c3d4fc267f7611fe57253077b6ac36b74320f63a529d1e4b8ee64850e733261

SHA512
fa2690d76c35b2a4f93661170e6b706481efecb7c8be1cef7200d82eb08fe121fa0fe221be50868443b8c52a05c9a2e1cfcfc7a4c4e8ea4fa956275749f27582

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
902771de9a879d92b2b564672cf78e40

SHA1
e80e0a94922ab1a846dbff614a085a3c4e8ba243

SHA256
c9af94b1c00712a7fe100b82a11e5bac135485f2e2baf44e508ce86fa26eb78c

SHA512
af4e668b4830abd87c5d78607b7a088b79ef74b06dc58cd38c81a9243a8dd4f7ebc974e04c3bce44f874beb22b778f9b8541f79c1f9aad1258a5f5fac5de7a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
828b51d9e6a4395f68f05eddb949137e

SHA1
4f7c539e34fccf2451c9b7f92864ba21323f6a33

SHA256
b374d5e0d1ddefc85b4e4fde225ffa4e6423f43fe0a5d3457fb9f85fe88910d0

SHA512
ad8dec81638bb946c5e5c6dcd1510215cf95279b00805405c7a392a8f96a98a88aae4fc0936ea8d5a52045acd4bc8b5d05d23a8d3a1861959d6978a25a9be0f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8576cf315509765b12643f1ed6ae80d0

SHA1
b911c8b1ba0deafdb5bbedbfc069b2f7e68ea27f

SHA256
fac8adb7aaf1dfa8424986d2edef1df7f20c8074ddcd354e7d8c84c91092b487

SHA512
f9518041d26829779a5f523319a5c6f6dc513e2433fe09848f3da070e3c0cd338c4b0eb80055229b3f920c41344a6cfa5e3511b9eb8d0b50cf68f2720a35bfbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3923040c8be5bb89272a33f4ed79d1e2

SHA1
52652078f9cabf02bfc3f6d01d81269fc4c2a395

SHA256
45463fe22c3551dd1f697ae82561cf05e0db10ad5417ee1b797b76014a97228a

SHA512
627f7ec298bf76585b35b6fc48099da1d4b279c3752069099dc262ed15bee35fd68a980a33562ec93c885c7f2031ff236a98b0b6e6597844acb597dcd4cec27a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa42150c1b6c3d91eb537680b2b5c982

SHA1
a69a381d7f4ae7f1b6e691c2ac9551b8c55b502c

SHA256
63e32fb9bbae9fef5e3c9c39143b325b3fc8e1244813d55a9d5775976e557028

SHA512
0089474cd6f6356025413c6214c85e734cb6601acf79c5f541ffdca72ad7343972ac96e26b95727c22b084fb5e79aee1a71436d786d511517aaecd9b20f29575

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbae69b3598317c578f51ab3870938f6

SHA1
5f4c1fab165d91f5233bfd5fd0d2df5eb5755d60

SHA256
703398f8f2274e5b5800569a02f1cf48220f8c4ecac303dd596593ce67f11e92

SHA512
90748c56f07ef5a704aec3fc8cb3f8289a270acfa3e7545fd43498612130934ec42d28e79bb6c664d9e4efe7790c338877dc9947e537fd22c7aeedbc8d43557a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2540c4c50951d814f312d87de753b10

SHA1
aecd94aee6b91dfe42ab03ace26f6841f60a8497

SHA256
2a5a59f88a488887ef5bcb7971c331dfe9c9e4c6de043b04eea18b55d2c5019e

SHA512
0e5e7519af431f24363a18b55e9e306e24e4f81461fee8b4562b370861671fd34d5f3710123b6395ccb73ad8e16a68b24b8bc3a697ae9b89155148449ba6a9a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa4df22fea6a7c3336540cbe864f0557

SHA1
baca3664017207bbb3a10fac9131b3e5f35b343b

SHA256
175e18cace7df075b040cd8a3ed955e0684ae23c12dab5eb0ebb1672c9af1e11

SHA512
76ad00cfc032126c03754eabde2933690be4da39eb4bed752036f93a102f0cbf8187a9bca3b0bcb70ae7e2545e1d3f12b8a74beeef81a417267cc81c7e01726e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5b8a2ff32c5552e2f0efae1bdc99a37

SHA1
5eb6fb3e75e410068f06c10f55a75d36053c985d

SHA256
38b9b763572a4c702cba216c284b47ad7326c61b9744a96c357e1dedf0003203

SHA512
455d00ba21427d9f22d41a19d31373d5eab3766b0a16ec183eb84d4985976540c5de983069cc05aeb1d2506a430bcdf114d45fd7c9e12f087f12a2b587ff5ed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0a84d5b4e084d061476cf639f167fc9

SHA1
b3b9050c69c152385187933368d26a92975e2d63

SHA256
879549cb9815eb905cb14be7bb663fd32f50d9cd8f2da4c5658fa6b895dc9182

SHA512
317d3e497174264d833e780e3eaab61d38d82e58718564a488bc84cdc07d4545db4ea867e61dc6b315ee747864cd408732516ba106602502c2180f3558e4cb71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc48234a817fad57859e365c742e81a4

SHA1
7a39af9d4cca6ea2593c1ab5ec36c9f463327594

SHA256
b1bf8de79528182af8d08bafe6c07767624acba03a7af65c4fcc41a462fd8c79

SHA512
96a024db0d07763ce3a8d62fa67601d64417bbc01bbba0047638ca019d2ef7511cd467f2fd4f6405fe1dc97fc859e1728813f07cbe7aceb6f05bff17781e8c74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7b13be0c3094ba36219fc5c4e3ff3f6

SHA1
41a0dfae6ad27b27a2e42c9e00c7b36e6409b45e

SHA256
e8b6d1f9816f422d0c999481d80e5657ec691966083818a2f406e70d086d9884

SHA512
ddda9031d6c3a407fba5ddd0f9ccb0134b0239e6f24a4a16b06dbc2a7df8b69e5bd4280caea683a1601ef331493b328498e5b36999c79741ecc719402ba65f81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d07ce38b31cfd5a8d47715a88aff7791

SHA1
eebd21302550f4a38d8d71d1e5636c01544f12d0

SHA256
47c3600edf5cbb9cae46b48a79bff4401bbf6ac4d9f885ac88b0a7d2f3ce7400

SHA512
47b6b528df9438875945d219b9e816510676862334bb975954669abb595ecd1a70425941a1e38a70e6e400d3278913778fab329d6fa167a5a2903cd8d5eaf597

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
513746573b4a5b11dd218f69ccbff864

SHA1
4b3935d54200e0374951b239823791b54b458aca

SHA256
d7c1a0b6347822a7864feeff026f1060d4a4006cc4469276c52fbda12f1296e9

SHA512
5e372553ba0c3daacf3fbe36c33db4dfd2921f49a940aaaf0aaf4cae71fc01aa97958b53c5b213578d1775cf4206eebf7b12d8d15c9ce29a910786d80a1a8c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53acb212329e560b2c620f9c9d55cc20

SHA1
0bffcc8973803d3ce0950c81a1a8e1190472c131

SHA256
ecd803470398608e040b82f8ae8c82c2acb162133f28dc07118bc221060ffed0

SHA512
d9492cc148d034d297e4b380b5e775c73f16483096bf45c09904992f4d1abc5a79299fe2f37abd204680595c4ab451518af0a3ddf6c828f1769d61b74fb630e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bde9979aa47c3c89c7a0f2d368615d58

SHA1
31f8c753ee3993ed2b8b96c4e2e404234d8c503c

SHA256
c42b52e7a9e77b29d43e48c5449050c628b79fafd9c8330de87c90759e1b311b

SHA512
ed94ddd2bfe1b4dcbd3ca79df4b232c77c7fdcce77cec5dea0eb59ad588438936b96280ac6fab2860f582aabe249c5dde272071fb7c4a924174985c5700ff930

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b616e6b14b64be89b5f773fb328fcea2

SHA1
9498394811c4cbe6a9610871ee12f8439d8decbb

SHA256
9da9e12eac5723482389aa708921a1ad3517ccc27dfd9d1b7678f5cd51610fd7

SHA512
2acdb8045babea764b70346c250ccc63450397cf6932c0eaaa99e5d4f412cbc872c04949245bc4e8de30c05ce529561e68c7b59975dc32f716f449ee5cce5ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
329353ba86122d753dfed809e7ad19b7

SHA1
bc2af9a38920db09a49f127b0d76983d2e99020e

SHA256
b83cf7792f2bab3d881643438d6efa9489f2bb47194e3fc4763a119cddf731b1

SHA512
73b3fb87a40e143eda096f4f37e6ce73a8a5d754a839da072d6fb28288fc686621e30aea0695b7b1699a5915d2917e1b21f31f50a790472a78f85da732f537fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9be738292b1fff50d06550da8d9166d3

SHA1
127d99407dcd21249290391cf72acbb2d5c8321b

SHA256
486e3a255a3b853e84398fe1715bd216b90310382c9ec5c61dcf9677d6d77778

SHA512
6c7d097ab4c63bb7cf1a47c60a874a432f55185c5eeeba803d1b561f7ead81beccbdf5710d0fc5250677a3e87f11d0352309f7b907fe63e2804c827df10c45ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a4de6671399cb9836fac0ef46ffb2a0

SHA1
1b7f92cf958b5df5995809120d4a179709985167

SHA256
ca9e2e1feedad7aeb843f3c7778ff8b3aabdfddb4d6d34243987dd08e9116d51

SHA512
7646a01552a4890cc5c816bfb33163efad7763435e06883ce708dff59888c54eb297e9a1a8ad35a6dc55e778f7bbdab4893b4ea735baa0b4adf253326b60ca24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98a5bea69cee61ce907f5947f949e0e5

SHA1
8bbb022faf60b3055e1ee77dbe003fc3c408e44d

SHA256
2fd86d500b590ff9ec030b85ffb7160b4d7e4eeb587ceb651765cdfd1393725f

SHA512
bd40d50bef1f5113a2dee5c209255b5a0be613cb827ce6b200d2241f9a4aeaafa7d560ee970aff29a350eb19935bbeed6e7c21bb6ca0b5a3f06b17bd5646b370

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14f2fa56a31a14d27c4f42e4acdc524f

SHA1
30b70f3873fa0fd3dfe5e19bd6589ef6fe535aa2

SHA256
ac3ccf9153588bf4f31ad01fc4eec042ddb2ff2946eba2f15eaaa4a38cb69a04

SHA512
373bde75ae85e6b6288a098b4131aed35f60bab4a2fca90db79c227a6a4c65a375e1cdffdf9d38fb65ddfad047b19687112ad1c2677a038722fe736f572591fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca2f2660467716f5b6fcc8337b26ab9f

SHA1
fe27fec6a9480b6d532f95a44786111c319d0891

SHA256
fea7ec2193f0140578d3e33219034461c56f99a9e675f2fba7ed898ff7af4579

SHA512
259dd5b0a31abf0b8a075c42a1c5aa55ff594105d71316e391de074dc696e1d133f0b44b5f6b2809e8a4bb992a864d6d5f9eaa3f241739871983998f04b11942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6c73fe212fb58e2c967ab07a064f654

SHA1
b68f0e85ace92cadc51479a167870dcf128f91e6

SHA256
175d380e4064879c56877bedcb5bca1480b204da492286907babc90d7c5a6f17

SHA512
2fd9932cb4a25001a1fb4576dda5b182b7566253021d1b698a9a4476c957a6428b11b92c90e2f648dc91623a5e4023c05d3fbe4bc6d6c7bdac0b4edf1f129079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ef6d053b082a8cd227c9f553fad983f

SHA1
473aec53cde0bbd0dba5c8a8b28603cf1424aa11

SHA256
68fb43fdcaf06c71b1177b053c6247f3f692588a63fec761b95206bd1875eb7f

SHA512
969b095d94b607a6e5e8cce7009bba91ff94202300ea2f47a7314fafbf2f0b90fa4aa0f236fe42bbe2a9c5daa366a75e43d9e2396c4f3aafacaa07f5bbc49b21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7129db28b85efa86ef7e081ad481797b

SHA1
c7408554b2e89bf20268d4115442c309cd402e20

SHA256
0f8ce2d1b3abc4ea52235769917d2d7a14b26fecb82de2ab42f8e2f2b1a165b1

SHA512
38c6642213d43c13ec7943ef97c9ed7755f8bd4215649ff43f302e0ddaf4620811c663e1520c6bbe451cc78da73929f5c3f60448615949e8acfbe9256392c2bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbbe88d35975f7177854d12632cf5333

SHA1
120ba3bf1c541d39cc1c15afb025047b52ec30b6

SHA256
27b750c734705c15f3985103b4a1ba51874e9b4fe62ca9288c91951a4bb33cb2

SHA512
37a7cf548e0f7dc7300945c5f0794d02c4e9bc81f02dbcca63ada353d0daec075cd1a22ed47b12d19723691a98d067d2b9e393f0f6c36b69fae1f5dd7caa624c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d28029d28e15e8180dd9425216491ea9

SHA1
a23e4a98529a3c46cedb8cda4e682aaa4522cc82

SHA256
a984fa4e4c6d429dc0602bf85cf2b4594d1653a882e9e418a237e9862e58fceb

SHA512
a424a3f957d32ee1eccb4c4bfb75be30f97fdd20813939b433e8904f0c585271a3bce3e9041811cd5bec839218a93e925c6bf62e17a514a10db2e7d41a983bee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
697ef20a8de19ecc3e774a4d58fc6c67

SHA1
ac9ed0098a9b722ead1d7d92887e17d2de841d9c

SHA256
d63e884603febe1cf943aa42077db2bcf31cb79e14b704c2b8602af126adc48f

SHA512
c73f5dd811c61adbe63999515046acffbc6268aae515b7469d02f7baf8e4e3c1a4485a45fd114fc00cc886c559d62e6c30263cc7ffe1cf54713bfdee5fd0ed19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1402c54abede5aedaa81a1571597b9a8

SHA1
03e2972efc19d9e46614b3432410e8967c9679df

SHA256
8fa1d929ec6b98b418252d3732135ae2343eb06597e27c9296b260f9508c1b13

SHA512
48d73ebb9d3ee4cdea1ad047eb4d718234b94e4c6e4c56f2a5a3484ba8c0e49f88c9338b1fe641627b94ae4f050fbcd0171b67924a0b4ba285ca2210d913af7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dada8643124c6d5297c256bd95911f41

SHA1
a04af95b13329f8308c5c3e914cf4a3a88756e96

SHA256
482cd9c2c854f4cbfbc909f8f1bb9db0f64fba2aa8209dcf02c5376e870c7f7c

SHA512
db2f6895d940c2fc09ccb4f2cfafc1e2ab4e599bd1463d6d232a7f9c38f5b9a9c72f83ff7ad54ca30038f9a83ba8744252d942db26645a1bfd25801dce742a56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2fe950a47380917a62566dc2b2a3f42

SHA1
07783c61fcac096b71741bd3b5159cb537ada821

SHA256
5a20439c58822c10b4b6fd8ccf08f1bb574fa230cb7fa1ba1de2e3b73f5482c3

SHA512
45932f294183cbefb4aa365d65931e13b127bea9464ab729a16a354e927a1a7e6d1c709769d2801f0c00320a4378130e6beb437345e99c0f313ece9ba67be437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c856c700a72aa7e31b3d0af8075a2c16

SHA1
3962197468d150380d6e1f7fda39d45f83dce23e

SHA256
5e98960678897dbfb901beb6064eef0f2f9eed6c9fc35c38c96f034e4188ef86

SHA512
e45f9e89d9fa92719a417074c4620ab5f7ba22ed84a50af3118b42fbd29cd926b480ca5e404ba6efc1e7e39ea43fb6869b90a935c503e64d9e3ba033161f3f79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
647bb1853f69eeb07f43bd7b3e20d87a

SHA1
eae15109f46ff7c59d9177247b9aaa776629fcf3

SHA256
95e6911a885937925822dccc7fe7b0577e91a420628903774088924f65028b26

SHA512
8220e525341d2875ba2a047a5c032038758616d9c2783c45f8f2103a9651b3925c5269a7899142c346b38874acf23bfaf2a62b5f8c9da7c29d15f6c63b46770b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d0e580c43b5d2a0b1a2ce3d19c89097

SHA1
f7922f423fec0ef4cccb32c9c5a1db1ab0f8e92d

SHA256
bfc43455f737c2f4d786ecad3e6843f85fb5a439a569ef3631f5a1e2cf5f2ba9

SHA512
a6aaedab1e126fcbaa4c54412756f2cea3280ba17faed6c89b7806976bd9266b8e746f84714fab7b0ee4c769216ae2ae08c708765f4222bcfc67725d5cbf0e14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0d497ab9f3e5f62860b851080f17871

SHA1
ddf4df09533f0251dbeeb041e71db31da3745660

SHA256
99508aa9aed75e1b4a61ae358f6751230aa4e3b2f678e71eea3c68caffd72c50

SHA512
f3016f163fcdeaa39e9bdd0f6a0aa92110c4d44287984ed2a33c5fd8aaf33a1aed59c27dbc41055e0bdf3d9a32be8b1de422c0e5606c65de5454c6b1d8311017

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
829b54a182b3459c3de5107d6e08b4ef

SHA1
6c114492a4906adad511de823fff9cabb2479cb8

SHA256
34d8280d80e39c27ead1680c741cb85cdc1b44f32eff86b30e15617efb06be76

SHA512
8fdb1ed61c7b02b7750c1fcd46d1ad9546c4c8f23b8e5d91ec765812bbc1b9cf79d410e1c094cd537b4ba9af88986fd50a006d6a58498510faf09108c8f2282c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
125ab605e089983df4a5c822998123bb

SHA1
38520e0fe5c9964e158b326ebe88f452ba6c3967

SHA256
aeb55d75d69fe7ac189e662f4e139f01cbd0d1953562ac28b5fe66f415005882

SHA512
7b07555caa67680fde184b4722b32f51b46c15fa3d23de26aaaf6c6c3191deaf4035c39da0f94b0fd11768aa43b876499cc5954865e716233ff34039151b7d60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e806128289a241b124d83873f077f498

SHA1
b96e3b6bf5f90d3f6836de0779de2218ee41476c

SHA256
9ec7017c75dcb9b35fca91622481d1b0509b8466e04c81a041759d140d9be703

SHA512
d7ec045abd3cc1f6f61c4ab490941b105624ed3d673a8854046728c75b1e9adffda601bc67664b798951d8e4a6de4c26a79d958fa08480c43409aedefc0086fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0546897b9136ce9ec57109aa330a794

SHA1
5b17e09c56552355a1df8cca357dfeac68dfa3e0

SHA256
036b18ec0f2a52fca644ac5f2c4a1c0f8f9366ed96b57a296ef40208658b5a16

SHA512
bb420774791238399815c20cf38c054ce67ad1a18425834ae323b7b00e3a1dbb12e9f26dac27a294d284f638ec14b6a2288a72dc50a6049d3814314d09181798

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82aa5a40bea56b2911d11a5fc86c317b

SHA1
df38370de00c016b8988ce3a945d858e27db7ce4

SHA256
2019cf3f681b07f817a2a10255e8a01014735a98f7e906821c0a417c5b2c01ed

SHA512
504efc4a0e5d44148cd443bf5c7da8a344d5dc1eaeaddca07bd72d4425b25acf9dd3619d0cba04ba7a44e17e7a8f894584a8810b7ea3a017de4577779bd5a5d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9ed7eb331a36a821c4c663510a1e12e

SHA1
5e605c9e4e27dc73d1bf3e55af975b6a33a62781

SHA256
2a8219c247b001f959516dbbc78947449438e2796c6ee939957e2cd5888292ce

SHA512
b5e6102e6f91e360ea931f54c46b5006147fc98193be8d0d221f3fa4ff8917638f9e96cb9df398d1100435309ccc608e5c2b5bc68f671ef44a714e3737833910

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50ecc72ee4ec4c66de32182341c44a83

SHA1
d9e8a94ab389e7ad9b93e945ee76151a8249db37

SHA256
7e27248dfc10f1801bd6dbaf5f3a28becb74c1fa1e9c5bed9d204b9d50f9253e

SHA512
5f2415619ffe24ae7b9707ec933966316410e95c1dce83885338421b7f8d44617fc5df1dad999e538aeb78e2832e772d05bbccdfa7c43280d56c6e88039649ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
992e748e5f336879b605f0b3800abc37

SHA1
61dde6833fb062554828da1b92859bd896bd42ba

SHA256
e6d49dfa5608b5f48f9cb70f7b657c057ad49b46ca52aa0e496e328ec80876a7

SHA512
1cdb4978042fd9e65b3018697acc30fd5220b33ad90d20e4c6fe3786f518d2bd2ab4e2e6a36e2e2a2f348cfc62446afbd66b0f6fe4e4707fc8189e2791bf77a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7d1257915e7bb98150de5e16c2ef2fd

SHA1
4503e65f8d92d70f6fc2f842d9c31ac3389c698f

SHA256
cc4f346fd25f0b30c14a7c16b2d571e89e53f405a16936b066428c2974a75ade

SHA512
7c2568166f32352c26683b47509a48472fbcae3fdcb4e9598948d9f5893b8320f4b8c28f2059123fb8c14374158c244ce34ab3cb2df30313d3ae69bedf684f7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c16c5e6d2f9e2d112a63359d2662193f

SHA1
28754905dbeeef939112f09e2c01d53716117232

SHA256
a6dff3c593fcc1d401dac70efb96b943ad875ca804e0eedc1ad28f9ca350311d

SHA512
a7f024156eaf4c04dbb0668fd1815ec2610aa16b20aa68249dfff0ddcb93dd5407b214f13b7c538ce3a1034e364b477ed6868a6ec3878de9ee5d095b0ab7d7ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
215a19344f1a0324e5b263f59226371e

SHA1
fc4e675073d62ac9adbbf52120824b9fc807bef1

SHA256
d170e7a0699b98930854f7102fc497ea1a41984b16d2125abf73f2dd2e522678

SHA512
55dd357558d49d0c71a91767eaff83f38f9f0dc97b1a8cdd3938679220845478ed5933cc3a70c57fe153b3dc90933b3cc3d115930e49e1cbb726d52ccb0e3bc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36da7f66ea8d6544763c45829ce8b456

SHA1
b88545683f78dcf8605afcc49b7d97791849a592

SHA256
901a0e54087d754688e07d8a59e03193210854a7c84aabfb71006a7ca3d6c108

SHA512
017efc7c9677f92aee5f373fb91e5c67f4e61f7619ad8dc4fdb219b5e43e7c03404fbdb641ba2d64915459cc6ddbd978b275fc81e9e081663f77ceef9995d70b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6c152eb65fb532ba00454047e6d76fe

SHA1
79b16ded5b6799fb0b66fc5073f8449b4b758b29

SHA256
00c49438be8906d715edf7c56476c44353f3cb303b0f25f21c03923a71597c19

SHA512
1089b63dc8f49386816247cdeb43c059cc7947850bf00af6612314e9d0014ffb1e157136a0ae8600e34a425a0c027ecb51e47748e32e0bfafeb4626e9e4382b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3477f92313f7bd89c6b47d82d1723038

SHA1
4728fec4dbf9714f44fb763691a153407f0ca839

SHA256
669c98c48db4b29039870518572686c2bebd854c143fe8be8860f661abb513df

SHA512
79cbca8501ca031914edf8f87faaca5176d640ec3ce4fcc85bbc67885d2e1e3083dd77498116a34c1491c767728becc4b062c2582b529bb6d22113c45b20f7ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a097bbd563b1e07e550fad69a67749d

SHA1
ec9605952b4e37aa3cacc68c82b9532535d84d66

SHA256
aa5f67360945a4b719362c5defa422069e618966aa376ba05b43be6769d7ee4a

SHA512
82f305b8cac48437c2a78426ae993016bc21c077884765bb65936a33ea220fd90c5937561d55b7722b77154946f71da9b057b6b060a23760237e6e922e70b3c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f700b7baa4d1b1678b2488f693b54a89

SHA1
8bc8fb9e8353bac5699d1b42a3e8eea6dececf3a

SHA256
5653e7505a56bd296056bf4ea8fb879d2d76d5c6d38490c374faa7b1837e1c9f

SHA512
0847613a4f895832083362295f3442cc2960cca4704532262cd734e6314c6c3908ad935e58e5bb384f8e0e90cbae99646a7237a114f065666b8c35f12e1199c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
0072ff6a79daa728ebd9c006085fe53f

SHA1
504af2b2824bfd48221139da19f2302c61c0a0a3

SHA256
89c2f0db7e380f97b9ad6c56b29656538c9d6c166e22d7ce3ee4ef57ce620238

SHA512
0f81cfad66076a5053859e3ca924317a49dbdfbc0595ceab2dc36a56817d27f7bc22a7a4ca1c03a1b69a00d96271ede8acc5f84f18e6f2f3d9e469cc8b354dc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5259EE71-8DF8-11EF-ACA8-72B5DC1A84E6}.dat

Filesize
5KB

MD5
edf501f6764065e939df667606e43530

SHA1
0b733971d71de7db2a596b51127bdc8bae888c45

SHA256
6bc52db797a439041316a0cd1ff6c4d68d684d048cef05e0d10652100e265c04

SHA512
e119319a5d45afe89627eef70cf4d1eb337bd3695b67cca1dbbefb73aa304e66c2111b31cb12e162bb9f0d2fa1204c0fc4af3352f117aaf93a7d574463650fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{526613D1-8DF8-11EF-ACA8-72B5DC1A84E6}.dat

Filesize
3KB

MD5
f8161e70fa3084d23c7c9dbfb2da59a9

SHA1
c0b2c42c1f7e88cffbf3b664dd84f6a478d3a218

SHA256
2a0491827d64a287ead6984c7555772b53de3113c49186790a83b400eecf0e19

SHA512
af882c45ce07f70d071ab33415324bedd4606e4a4f41afa1f8aeb0a35b83cca02e623ff5450cf8b44745d7500c9f74ba049ef5537ad80d963f8d0d65858a3819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{529D7781-8DF8-11EF-ACA8-72B5DC1A84E6}.dat

Filesize
5KB

MD5
bd2953f8f29ce4d3929add1747c5299e

SHA1
3700f055eaabc51dc0d74a0ed2a8a875f9d64ca4

SHA256
d6ef2f6b2c21e163cb5b862da03daf3c7157eea464147479d804108919917442

SHA512
6df4f9f81e2c699a72610a8d308eecc887e20f44f533169e5cd4a676576cc980d3b97265269e67ce36abc11bbcc23273b9f8bc0a1a256fad3b6f2a958c965171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{52AA48C1-8DF8-11EF-ACA8-72B5DC1A84E6}.dat

Filesize
5KB

MD5
9308627590c0c7f33fe26748a8b458ec

SHA1
92f0c0ba0f409d75bc27f1186dfbb04412029054

SHA256
5cb29fb0ce992bcb3c16343b0d3fa7f0e12974c9fa0f9a7c7c5a55b393c0525e

SHA512
7c9c419e266d290bbaa915bf06d4b85ee200c29fec5bf776a3c35fd63be8bd5c19cbb8e8edbfa2197890026547dead88e15eabff451b37bd312931ec59836b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{52AEDCA1-8DF8-11EF-ACA8-72B5DC1A84E6}.dat

Filesize
5KB

MD5
e880448af0a73907687e9eba4185f1bc

SHA1
2680404e3f208ff05a96ad53234dfeaf9dc656ab

SHA256
ef1e1940e6ac77fea823fc160ea85eacdbe5ceb14efa3e95b2364cf906b1d2c5

SHA512
8d2fac4d60df13c398e9a69937b81e75f7981fbead75cbdc3adb2908e873775af1ac461ccaacef9f3957406e8b60d857ee9bfb1d1af92b62a28fdc496e9dc3f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{52B60891-8DF8-11EF-ACA8-72B5DC1A84E6}.dat

Filesize
3KB

MD5
a64f9aa9ce8ae89b557308cdf0722a08

SHA1
290f334b0b05e64f607dcc4a4ef80d634e70e8e7

SHA256
e4eddc859ca8a8cd3922e450459b075d212559b48151bd111636e5981d4a7c19

SHA512
d6e11b28a61ec00d6a0f4c6348be812bf05315012b1888cc25b04de03822961787a7141a19c729bc1895b8630540572defd5f08bc74218565935bd8a09bb9d16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{52B60891-8DF8-11EF-ACA8-72B5DC1A84E6}.dat

Filesize
3KB

MD5
7e83c1f7c824258038903501ba08b9d6

SHA1
479074c77f7490af6c9d5cb124157b46980f238e

SHA256
b5420d3289ad5904e37fcdb2d9fecaf93a5f0bdcf5986e692a3c82f620a4d21b

SHA512
6e35296ce1175b385037fd3d2050a7937d2d02d2e271af954161bb9c3943170bb03e6c7755cbcac9bdc07e9488da1e249d3b67772b99eef1ac3514634d62b046

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{52D037B1-8DF8-11EF-ACA8-72B5DC1A84E6}.dat

Filesize
3KB

MD5
d78c68c3dea1f348685e751820c461a4

SHA1
2ae51aa444365b5fbdcf8d11c55ef670ffdd3f36

SHA256
1af441bcbd8ba10942f893f4317a1aaff7a7e392d4c3814b19089a39e9786c7a

SHA512
cadec8fbe131e8d5d70d8c08c2bddb706ee88cb0d20c7577ff621984bfc94ef5715afd6c5fa6124a378d7754bcc8374e7c892d7e58eee6b0862d5602f4499fe9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{52FA2611-8DF8-11EF-ACA8-72B5DC1A84E6}.dat

Filesize
3KB

MD5
b3a00dce00648affd389a1d57ebdb192

SHA1
202d7833a4b93492f014f0bdf2d6773aa16aed1c

SHA256
9bcb8545500abc37a619a3836f01110b8dd2747b896a4398cd46cc5366c85c07

SHA512
bf0379a0307b279a23c5a946378ed6bb5fddb8a32204401e0b4d1bb48073dcd5db95755ce4be09a90b770bb04456cd225862f4f981fb3a061388f0dd27175bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z8d0nzh\imagestore.dat

Filesize
1KB

MD5
a7542a1eb91c093cdc8cbaf536f83b76

SHA1
18065fdecd4b26dd8a48b5c3156b3021c6925de4

SHA256
c6c5b71aa85873c610d7cd2a0ebc7562b8bda0433438ee731dd521ba1e87bcd4

SHA512
e7461c96a20b2d16aa916b127d8101b13430687c8306702ed00f2e03848305deaa5dd5fbf607289a31c9da070f7be1420b198bbc9281542443c5f8d4f7e00cf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5GWW47WY\ErrorPageTemplate[1]

Filesize
2KB

MD5
f4fe1cb77e758e1ba56b8a8ec20417c5

SHA1
f4eda06901edb98633a686b11d02f4925f827bf0

SHA256
8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f

SHA512
62514ab345b6648c5442200a8e9530dfb88a0355e262069e0a694289c39a4a1c06c6143e5961074bfac219949102a416c09733f24e8468984b96843dc222b436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0PVW9XR\background_gradient[2]

Filesize
453B

MD5
20f0110ed5e4e0d5384a496e4880139b

SHA1
51f5fc61d8bf19100df0f8aadaa57fcd9c086255

SHA256
1471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b

SHA512
5f52c117e346111d99d3b642926139178a80b9ec03147c00e27f07aab47fe38e9319fe983444f3e0e36def1e86dd7c56c25e44b14efdc3f13b45ededa064db5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0PVW9XR\info_48[1]

Filesize
4KB

MD5
5565250fcc163aa3a79f0b746416ce69

SHA1
b97cc66471fcdee07d0ee36c7fb03f342c231f8f

SHA256
51129c6c98a82ea491f89857c31146ecec14c4af184517450a7a20c699c84859

SHA512
e60ea153b0fece4d311769391d3b763b14b9a140105a36a13dad23c2906735eaab9092236deb8c68ef078e8864d6e288bef7ef1731c1e9f1ad9b0170b95ac134

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\3a8e55c6-b1f3-4659-99eb-125ae72bd084[1].htm

Filesize
167B

MD5
0104c301c5e02bd6148b8703d19b3a73

SHA1
7436e0b4b1f8c222c38069890b75fa2baf9ca620

SHA256
446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f

SHA512
84427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\NewErrorPageTemplate[1]

Filesize
1KB

MD5
cdf81e591d9cbfb47a7f97a2bcdb70b9

SHA1
8f12010dfaacdecad77b70a3e781c707cf328496

SHA256
204d95c6fb161368c795bb63e538fe0b11f9e406494bb5758b3b0d60c5f651bd

SHA512
977dcc2c6488acaf0e5970cef1a7a72c9f9dc6bb82da54f057e0853c8e939e4ab01b163eb7a5058e093a8bc44ecad9d06880fdc883e67e28ac67fee4d070a4cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\dnserror[1]

Filesize
1KB

MD5
73c70b34b5f8f158d38a94b9d7766515

SHA1
e9eaa065bd6585a1b176e13615fd7e6ef96230a9

SHA256
3ebd34328a4386b4eba1f3d5f1252e7bd13744a6918720735020b4689c13fcf4

SHA512
927dcd4a8cfdeb0f970cb4ee3f059168b37e1e4e04733ed3356f77ca0448d2145e1abdd4f7ce1c6ca23c1e3676056894625b17987cc56c84c78e73f60e08fc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\down[1]

Filesize
748B

MD5
c4f558c4c8b56858f15c09037cd6625a

SHA1
ee497cc061d6a7a59bb66defea65f9a8145ba240

SHA256
39e7de847c9f731eaa72338ad9053217b957859de27b50b6474ec42971530781

SHA512
d60353d3fbea2992d96795ba30b20727b022b9164b2094b922921d33ca7ce1634713693ac191f8f5708954544f7648f4840bcd5b62cb6a032ef292a8b0e52a44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\http_403[1]

Filesize
4KB

MD5
3215e2e80aa8b9faba83d76aef71f1b9

SHA1
c7582d414ee6a1dae098f6dbbbf68ed9641d0023

SHA256
d91c22ef6451561f346b8c8bc6f98897e2e5c28135a421ee946800f6c8451b24

SHA512
690e4d62229ad14d3d842dabe986651b4cc2e4c873a50e5b7fc4fd539662a703690ecc70649acea7751e69ce6046489c0e6b05d24f0030d68773c67b3dcbae00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUUZQMCA\bullet[1]

Filesize
447B

MD5
26f971d87ca00e23bd2d064524aef838

SHA1
7440beff2f4f8fabc9315608a13bf26cabad27d9

SHA256
1d8e5fd3c1fd384c0a7507e7283c7fe8f65015e521b84569132a7eabedc9d41d

SHA512
c62eb51be301bb96c80539d66a73cd17ca2021d5d816233853a37db72e04050271e581cc99652f3d8469b390003ca6c62dad2a9d57164c620b7777ae99aa1b15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUUZQMCA\errorPageStrings[1]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUUZQMCA\httpErrorPagesScripts[1]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab86DC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8670.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFDE0826E609B764FB.TMP

Filesize
16KB

MD5
4516e4d267e5959bc032702af00c8232

SHA1
be8199858e78c3574450986e56cf84bb9a770ddd

SHA256
4d4056300adb39f2cd43f53fb4cc562e980db5c7c2a8d9961e3a4f2cc0327052

SHA512
6ef0f8e68a4afbc55406837b08972b890524c50cbcf26618f6a5e5f25b00fc1da84eb533820f19f7bad5040a7390e5d719277f91c7305dc8ff8597af911ab8d5

Download Submit
C:\Users\Admin\Desktop\READMEPLEASE.txt

Filesize
95B

MD5
316cdf8bc3bae069158a2b5ce6e6584b

SHA1
1fb87b0babb134777c858a5a0ca2b61257be7b88

SHA256
5185b861b4c7d2c74ec334178a1f9eb6bae84bfaefc11ef9f1aa88ca1d1ef211

SHA512
48e69c5958b7dce18dbcf0330aae01be09b8db685d5e080e24d88a4ae91f8cede980b19522b81d5a7c82cd70dd51a60c3d971d5775c7ef8fd5cefccd65520080

Download Submit
C:\Users\Admin\Desktop\gcrybground.png

Filesize
90KB

MD5
fd90c054a45db9bda8b4c9e0cec9d8eb

SHA1
60fcba6b7e6330e7ca89b9a19c2609a2d5c7db48

SHA256
5db9ee4bacde419570388df802cc8ee9c7d571e834ab726fd772ac848e1fa869

SHA512
24b7e3db61db36d1a0db7922e891f90834b21fa957e728ed926b1cbf7ace1e5e25db870ee56c0ea59500d8596bab27e96b80c45bd635e99a2cb4918906880107

Download Submit
C:\Windows\System32\iamthedoom.bat

Filesize
320B

MD5
87b38705d72cc16189ca8043e1e7cdd7

SHA1
a7caa6d14276714b95eb394dc3be1a6fb479590c

SHA256
7306e8aef5accfe4f7b3796d2c16f1f88b2650e65ee9a9736554fd335f2875af

SHA512
48a7a2a1370973e141931f375254b645884f9467b59f7b0babb821f12382368350a6d4925af2da74221f0420f0ccb5a6133412536d6a5a3c32c8f7d527218294

Download Submit
memory/1356-680-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/1356-3065-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/1664-8296-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/1864-5672-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/1932-5843-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/2284-3067-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/2284-682-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/2308-5455-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/2392-679-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/2392-3064-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/2420-3755-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/2420-900-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/2512-683-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/2512-3278-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/2932-681-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/2932-3066-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/2948-678-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/2948-3063-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/2980-6061-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/3120-5168-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/3528-5014-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/4976-3558-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/4976-856-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/5264-1112-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/5264-3849-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/5448-1236-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/5448-3969-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/5780-6981-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/5860-3933-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/5860-1134-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/6940-1673-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/6940-4509-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/7156-4648-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/7264-5917-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/7604-2602-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/7604-8464-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/7640-6604-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/7700-8555-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/7924-4529-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/8232-7308-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/8428-6215-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/8520-7111-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/8664-7187-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/8672-6463-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/8760-6840-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/9040-6462-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/9084-6745-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/9312-8465-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/9652-7504-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/9760-7724-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/9912-7536-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/10408-8846-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download
memory/10812-8703-0x000007FEF6270000-0x000007FEF62BC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads