Overview

overview

10

Static

static

1

RNSM00426.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    199s
  • max time network
    212s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-10-2024 15:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00426.7z

  • Size

    17.3MB

  • MD5

    8cf2c7d415775b5196246520c2b59271

  • SHA1

    82ef631a57e81daf3bb2e417eab8da6430ad20dc

  • SHA256

    5eac949abc1ffef1ef1674274a591d10ba4007bd56162cc0c5bb43a99644506d

  • SHA512

    cbd349f83deaaea2c0774e51eefc6863e3a0845f2e93b829c797e845c9852f5fd82922e7d6308322dd22b92d08cf9d4c166f6ee09eb04b024f85da7cbdba8ce1

  • SSDEEP

    393216:4Y+JuAQ92vSTTF6Bmbm6+f90VZ5WT1J0o5ji7XyB1lczJ:WJOwGoBymJfY5WT1J0ayqjcl

Score
10/10
burancrimsonrathadesmodiloadervashsorenazeppelincredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwareratspywarestealertrojan

Malware Config

Extracted

Family

crimsonrat

C2

172.245.87.12

Extracted

Path

C:\Users\Admin\Desktop\HOW-TO-DECRYPT-4lrb9.txt

Ransom Note
[+] What happened? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has extension *.4lrb9 By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant get back your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! - Download and install TOR browser from this site: hxxps://torproject.org/ - Open our website: hxxp://5lyi3c7x3ioakru4.onion - Follow the on-screen instructions Extension name: *.4lrb9 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) will make everything possible for restoring, but please do not interfere. !!! !!! !!! ��

Extracted

Path

C:\Program Files\7-Zip\Lang\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: C6C-677-A9C Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Buran family
    buran
  • CrimsonRAT main payload 1 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat
  • Crimsonrat family
    crimsonrat
  • Detects Zeppelin payload 1 IoCs
  • Hades Ransomware

    Ransomware family attributed to Evil Corp APT first seen in late 2020.

    ransomwarehades
  • Hades family
    hades
  • Hades payload 1 IoCs
  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modiloader family
    modiloader
  • Suspicious use of NtCreateProcessExOtherParentProcess 10 IoCs
  • VashSorena Golang binary 1 IoCs
  • VashSorena Ransomware

    Ransomware family with multiple versions/spinoffs. Decryption of files is generally possible without paying the ransom.

    ransomwarevashsorena
  • Vashsorena family
    vashsorena
  • Zeppelin Ransomware

    Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

    ransomwarezeppelin
  • Zeppelin family
    zeppelin
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • ModiLoader Second Stage 1 IoCs
  • Renames multiple (163) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Renames multiple (3452) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 34 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
    defense_evasion
  • Loads dropped DLL 17 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 36 IoCs
  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 44 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 2 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00426.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3256
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2772
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /1
      2⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2004
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Drops desktop.ini file(s)
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:728
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5092
      • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.MSIL.Agent.gen-a6787985243f50e272c98fe15b21f461f892e8905bbc5ffd7018ca2694bc5079.exe
        HEUR-Trojan-Ransom.MSIL.Agent.gen-a6787985243f50e272c98fe15b21f461f892e8905bbc5ffd7018ca2694bc5079.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2940
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 896
          4⤵
          • Program crash
          PID:2036
      • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.MSIL.Blocker.gen-186d9afa5f922ed9b4cb93853bd15496aeaf37d212f479c049fbd74c40d0b8af.exe
        HEUR-Trojan-Ransom.MSIL.Blocker.gen-186d9afa5f922ed9b4cb93853bd15496aeaf37d212f479c049fbd74c40d0b8af.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        PID:3112
        • C:\WINDOWS\explorer.exe
          C:\WINDOWS\explorer.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.supportxmr.com:7777 --user=44ZbNFaekfHa23g4diPcvAcMkqsmYpLvV9DjqgJwofqHCxtfukqzt3LHHr9Y8Ur8tnJJcLCqsyivmHgu6bzDuaYi5r9GR3S+150000 --pass=yagemob --cpu-max-threads-hint=50 --donate-level=5 --unam-idle-wait=2 --unam-idle-cpu=80
          4⤵
            PID:5688
        • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.MSIL.Foreign.gen-4c8e0459524380a9f00ffc58913f461c3e1d8737dd18252881f09e2d416e4f73.exe
          HEUR-Trojan-Ransom.MSIL.Foreign.gen-4c8e0459524380a9f00ffc58913f461c3e1d8737dd18252881f09e2d416e4f73.exe
          3⤵
          • Executes dropped EXE
          PID:4432
        • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.Win32.Blocker.gen-2cf41c6c7b120dca73fc1b0145406c190c5ea38edf5f349387a51184359e82e6.exe
          HEUR-Trojan-Ransom.Win32.Blocker.gen-2cf41c6c7b120dca73fc1b0145406c190c5ea38edf5f349387a51184359e82e6.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:1740
          • C:\Users\Admin\AppData\Local\Fast\Fast.exe
            "C:\Users\Admin\AppData\Local\Fast\Fast.exe" /firstrun
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:5964
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 1924
              5⤵
              • Program crash
              PID:1196
        • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.Win32.Encoder.gen-ce979ac72ae1a0e4c13109625c4eee0ad521ee72cf380642bcc8375739b82d29.exe
          HEUR-Trojan-Ransom.Win32.Encoder.gen-ce979ac72ae1a0e4c13109625c4eee0ad521ee72cf380642bcc8375739b82d29.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:648
          • C:\Users\Admin\AppData\Local\Temp\y_installer.exe
            C:\Users\Admin\AppData\Local\Temp\y_installer.exe --partner 351634 --distr /quiet /msicl "YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y YABM=y VID=666"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            PID:4896
            • C:\Users\Admin\AppData\Local\Temp\y_installer.exe
              C:\Users\Admin\AppData\Local\Temp\y_installer.exe --stat dwnldr/p=351634/cnt=0/dt=2/ct=2/rt=0
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4052
        • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.Win32.Generic-ea0663308264d011ded742ebb145cea6be39193596654979bd5a9f16b380aea3.exe
          HEUR-Trojan-Ransom.Win32.Generic-ea0663308264d011ded742ebb145cea6be39193596654979bd5a9f16b380aea3.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4888
          • C:\Windows\system32\cmd.exe
            cmd /C "taskkill /F /IM sqlservr.exe /T"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1144
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM sqlservr.exe /T
              5⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3464
          • C:\Windows\system32\cmd.exe
            cmd /C "taskkill /F /IM sqlceip.exe /T"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:756
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM sqlceip.exe /T
              5⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3076
          • C:\Windows\system32\cmd.exe
            cmd /C "taskkill /F /IM sqlwriter.exe /T"
            4⤵
              PID:2632
              • C:\Windows\system32\taskkill.exe
                taskkill /F /IM sqlwriter.exe /T
                5⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1724
            • C:\Windows\system32\cmd.exe
              cmd /C "rmdir C:\Users\Admin\AppData /s /q"
              4⤵
                PID:3904
              • C:\Windows\system32\cmd.exe
                cmd /C "rmdir C:\Users\Default\AppData /s /q"
                4⤵
                  PID:4076
                • C:\Windows\system32\cmd.exe
                  cmd /C "rmdir C:\Users\Public\AppData /s /q"
                  4⤵
                    PID:2836
                  • C:\Windows\system32\cmd.exe
                    cmd /C "attrib +h +s Encrypt.exe"
                    4⤵
                    • Hide Artifacts: Hidden Files and Directories
                    PID:2008
                    • C:\Windows\system32\attrib.exe
                      attrib +h +s Encrypt.exe
                      5⤵
                      • Views/modifies file attributes
                      PID:1856
                  • C:\Windows\system32\cmd.exe
                    cmd /C "net stop MSSQL$SQLEXPRESS"
                    4⤵
                      PID:3292
                      • C:\Windows\system32\net.exe
                        net stop MSSQL$SQLEXPRESS
                        5⤵
                          PID:3484
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS
                            6⤵
                              PID:3832
                        • C:\Windows\system32\cmd.exe
                          cmd /C "rmdir F:\$Recycle.Bin /s /q"
                          4⤵
                            PID:4312
                          • C:\Windows\system32\cmd.exe
                            cmd /C "rmdir C:\$Recycle.Bin /s /q"
                            4⤵
                              PID:1224
                          • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.Win32.Makop.gen-9ddffccd20b4260116e889b979e21e772848a457cb6b17a2664a4ee12aa9199f.exe
                            HEUR-Trojan-Ransom.Win32.Makop.gen-9ddffccd20b4260116e889b979e21e772848a457cb6b17a2664a4ee12aa9199f.exe
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:2096
                            • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.Win32.Makop.gen-9ddffccd20b4260116e889b979e21e772848a457cb6b17a2664a4ee12aa9199f.exe
                              HEUR-Trojan-Ransom.Win32.Makop.gen-9ddffccd20b4260116e889b979e21e772848a457cb6b17a2664a4ee12aa9199f.exe
                              4⤵
                                PID:1928
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 900
                                4⤵
                                • Program crash
                                PID:3832
                            • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.Win32.Stop.gen-d466ef9698569363af4f08b64235817c7838c726c1faee300582aab3d90f5683.exe
                              HEUR-Trojan-Ransom.Win32.Stop.gen-d466ef9698569363af4f08b64235817c7838c726c1faee300582aab3d90f5683.exe
                              3⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:2352
                              • C:\Windows\SysWOW64\icacls.exe
                                icacls "C:\Users\Admin\AppData\Local\0dda7230-3da2-4000-b101-6367093b30da" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                4⤵
                                • Modifies file permissions
                                • System Location Discovery: System Language Discovery
                                PID:4244
                              • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.Win32.Stop.gen-d466ef9698569363af4f08b64235817c7838c726c1faee300582aab3d90f5683.exe
                                "C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.Win32.Stop.gen-d466ef9698569363af4f08b64235817c7838c726c1faee300582aab3d90f5683.exe" --Admin IsNotAutoStart IsNotTask
                                4⤵
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • System Location Discovery: System Language Discovery
                                PID:6092
                                • C:\Windows\SysWOW64\icacls.exe
                                  icacls "C:\Users\Admin\AppData\Local\ebae5ddd-6f41-43a7-af86-4b49c73c4f64" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                  5⤵
                                  • Modifies file permissions
                                  • System Location Discovery: System Language Discovery
                                  PID:5220
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 2084
                                4⤵
                                • Program crash
                                PID:2076
                            • C:\Users\Admin\Desktop\00426\Trojan-Ransom.MSIL.Blocker.aw-f4ca0ba460f6423e6168c27d45dc590bbd79774be4aee3804e0b5ec961ab97fa.exe
                              Trojan-Ransom.MSIL.Blocker.aw-f4ca0ba460f6423e6168c27d45dc590bbd79774be4aee3804e0b5ec961ab97fa.exe
                              3⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • System Location Discovery: System Language Discovery
                              • Modifies Internet Explorer settings
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1556
                              • C:\Users\Admin\AppData\Roaming\Chromium Updater Module.exe
                                "C:\Users\Admin\AppData\Roaming\Chromium Updater Module.exe"
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Checks processor information in registry
                                • Modifies Internet Explorer settings
                                PID:632
                            • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Blocker.jzec-ed34ead6ec6c362e85707d8a4ce385f6a967e155242be57ee4ee7235759d9870.exe
                              Trojan-Ransom.Win32.Blocker.jzec-ed34ead6ec6c362e85707d8a4ce385f6a967e155242be57ee4ee7235759d9870.exe
                              3⤵
                              • Executes dropped EXE
                              • Impair Defenses: Safe Mode Boot
                              • Adds Run key to start application
                              • System Location Discovery: System Language Discovery
                              PID:2076
                            • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Blocker.mvwo-8f4df1b11998017853ed5d0f009f461275cdd73f9c274d865fd11c36f6280118.exe
                              Trojan-Ransom.Win32.Blocker.mvwo-8f4df1b11998017853ed5d0f009f461275cdd73f9c274d865fd11c36f6280118.exe
                              3⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4200
                            • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Cryptor.edd-a39888f0df247072b57479e11d5536692035f10a8a2b18b5dd510a7d2fffcc3d.exe
                              Trojan-Ransom.Win32.Cryptor.edd-a39888f0df247072b57479e11d5536692035f10a8a2b18b5dd510a7d2fffcc3d.exe
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:32
                              • C:\Users\Admin\AppData\Roaming\AccessRendezvous\Enhancement
                                C:\Users\Admin\AppData\Roaming\AccessRendezvous\Enhancement /go
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:1472
                                • C:\Windows\SYSTEM32\cmd.exe
                                  cmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Roaming\AccessRendezvous\Enhancement" & del "C:\Users\Admin\AppData\Roaming\AccessRendezvous\Enhancement" & rd "C:\Users\Admin\AppData\Roaming\AccessRendezvous\"
                                  5⤵
                                    PID:1396
                                    • C:\Windows\system32\waitfor.exe
                                      waitfor /t 10 pause /d y
                                      6⤵
                                        PID:4396
                                      • C:\Windows\system32\attrib.exe
                                        attrib -h "C:\Users\Admin\AppData\Roaming\AccessRendezvous\Enhancement"
                                        6⤵
                                        • Views/modifies file attributes
                                        PID:1800
                                  • C:\Windows\SYSTEM32\cmd.exe
                                    cmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Cryptor.edd-a39888f0df247072b57479e11d5536692035f10a8a2b18b5dd510a7d2fffcc3d.exe" & del "C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Cryptor.edd-a39888f0df247072b57479e11d5536692035f10a8a2b18b5dd510a7d2fffcc3d.exe" & rd "C:\Users\Admin\Desktop\00426\"
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:2380
                                    • C:\Windows\system32\waitfor.exe
                                      waitfor /t 10 pause /d y
                                      5⤵
                                        PID:4644
                                      • C:\Windows\system32\attrib.exe
                                        attrib -h "C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Cryptor.edd-a39888f0df247072b57479e11d5536692035f10a8a2b18b5dd510a7d2fffcc3d.exe"
                                        5⤵
                                        • Views/modifies file attributes
                                        PID:1944
                                  • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Encoder.lqn-5fd1a714a3c72c00cc9cbcdf8f100c2e8e8e475354c8c582d1711e737c398423.exe
                                    Trojan-Ransom.Win32.Encoder.lqn-5fd1a714a3c72c00cc9cbcdf8f100c2e8e8e475354c8c582d1711e737c398423.exe
                                    3⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:5036
                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\SayCheese.exe
                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SayCheese.exe"
                                      4⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:736
                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\config.exe
                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\config.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops desktop.ini file(s)
                                        PID:1672
                                  • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Gimemo.besk-bcc15645592a6add5c91d3d097e63e8775b949be72de33fd7b06c5197c9a40fe.exe
                                    Trojan-Ransom.Win32.Gimemo.besk-bcc15645592a6add5c91d3d097e63e8775b949be72de33fd7b06c5197c9a40fe.exe
                                    3⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3672
                                  • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Gimemo.cdqu-e633ebfa45af4939e7cdef26411dbc929554ce84c076cbd85ab4a19ec1f3abcd.exe
                                    Trojan-Ransom.Win32.Gimemo.cdqu-e633ebfa45af4939e7cdef26411dbc929554ce84c076cbd85ab4a19ec1f3abcd.exe
                                    3⤵
                                    • Modifies WinLogon for persistence
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • System Location Discovery: System Language Discovery
                                    PID:436
                                  • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Locky.bim-fb0f5ff4760f6869a63fc6ed01d19241d83919b88f70343473cb6af014fa8954.exe
                                    Trojan-Ransom.Win32.Locky.bim-fb0f5ff4760f6869a63fc6ed01d19241d83919b88f70343473cb6af014fa8954.exe
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    PID:1164
                                    • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Locky.bim-fb0f5ff4760f6869a63fc6ed01d19241d83919b88f70343473cb6af014fa8954.exe
                                      "C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Locky.bim-fb0f5ff4760f6869a63fc6ed01d19241d83919b88f70343473cb6af014fa8954.exe"
                                      4⤵
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Checks SCSI registry key(s)
                                      PID:5556
                                  • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Vega.ap-b7f96fbb9844cac5c7f4ec966683f3564bbb9a2f453927e1c579dcb0154f5f83.exe
                                    Trojan-Ransom.Win32.Vega.ap-b7f96fbb9844cac5c7f4ec966683f3564bbb9a2f453927e1c579dcb0154f5f83.exe
                                    3⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4000
                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -start
                                      4⤵
                                      • Executes dropped EXE
                                      • Enumerates connected drives
                                      • System Location Discovery: System Language Discovery
                                      PID:2996
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1176
                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                          wmic shadowcopy delete
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:5948
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5256
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5184
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5304
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4276
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5568
                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                          wmic shadowcopy delete
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1076
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -agent 0
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        PID:3404
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -agent 1
                                        5⤵
                                        • Executes dropped EXE
                                        PID:5432
                                    • C:\Windows\SysWOW64\notepad.exe
                                      notepad.exe
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3316
                                  • C:\Users\Admin\Desktop\00426\UDS-Trojan-Ransom.Win32.Crypmod.xvk-338dd780ea34a04619568845e036d97ff23758c54d65704c81b37a59c66275e7.exe
                                    UDS-Trojan-Ransom.Win32.Crypmod.xvk-338dd780ea34a04619568845e036d97ff23758c54d65704c81b37a59c66275e7.exe
                                    3⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:1908
                                    • C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD4CF.tmp\UDS-Trojan-Ransom.Win32.Crypmod.xvk-338dd780ea34a04619568845e036d97ff23758c54d65704c81b37a59c66275e7.exe
                                      "C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD4CF.tmp\UDS-Trojan-Ransom.Win32.Crypmod.xvk-338dd780ea34a04619568845e036d97ff23758c54d65704c81b37a59c66275e7.exe" -ORIGIN:"C:\Users\Admin\Desktop\00426\"
                                      4⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:3516
                                      • C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD4CF.tmp\extracted\UDS-Trojan-Ransom.Win32.Crypmod.xvk-338dd780ea34a04619568845e036d97ff23758c54d65704c81b37a59c66275e7.exe
                                        C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD4CF.tmp\extracted\UDS-Trojan-Ransom.Win32.Crypmod.xvk-338dd780ea34a04619568845e036d97ff23758c54d65704c81b37a59c66275e7.exe "C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD4CF.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\Desktop\00426\"
                                        5⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Drops file in System32 directory
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4172
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c start http://mrantifun.net/
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4668
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://mrantifun.net/
                                            7⤵
                                            • Enumerates system info in registry
                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                            PID:4720
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbc80b46f8,0x7ffbc80b4708,0x7ffbc80b4718
                                              8⤵
                                                PID:1944
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
                                                8⤵
                                                  PID:752
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
                                                  8⤵
                                                    PID:4132
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2464 /prefetch:8
                                                    8⤵
                                                      PID:5096
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
                                                      8⤵
                                                        PID:3064
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
                                                        8⤵
                                                          PID:4376
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
                                                          8⤵
                                                            PID:3464
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:1
                                                            8⤵
                                                              PID:2628
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
                                                              8⤵
                                                                PID:5184
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
                                                                8⤵
                                                                  PID:5256
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
                                                                  8⤵
                                                                    PID:5284
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
                                                                    8⤵
                                                                      PID:5304
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
                                                                      8⤵
                                                                        PID:5840
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3932 /prefetch:8
                                                                        8⤵
                                                                          PID:1176
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                                                                          8⤵
                                                                            PID:5696
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff77c5e5460,0x7ff77c5e5470,0x7ff77c5e5480
                                                                              9⤵
                                                                                PID:5896
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3932 /prefetch:8
                                                                              8⤵
                                                                                PID:4612
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
                                                                                8⤵
                                                                                  PID:5028
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2360 /prefetch:1
                                                                                  8⤵
                                                                                    PID:4048
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7452 /prefetch:1
                                                                                    8⤵
                                                                                      PID:2128
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749606535712032693,10898752533499901679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7416 /prefetch:1
                                                                                      8⤵
                                                                                        PID:3352
                                                                            • C:\Users\Admin\Desktop\00426\VHO-Trojan-Ransom.Win32.Encoder.gen-f246d574704530d9e191350c1d4ecf118e4cb5444e598c16351fd02acc3fe928.exe
                                                                              VHO-Trojan-Ransom.Win32.Encoder.gen-f246d574704530d9e191350c1d4ecf118e4cb5444e598c16351fd02acc3fe928.exe
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3040
                                                                              • C:\Windows\system32\cmd.exe
                                                                                "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\E0F5.tmp\E0F6.tmp\E0F7.bat C:\Users\Admin\Desktop\00426\VHO-Trojan-Ransom.Win32.Encoder.gen-f246d574704530d9e191350c1d4ecf118e4cb5444e598c16351fd02acc3fe928.exe"
                                                                                4⤵
                                                                                  PID:4904
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2940 -ip 2940
                                                                            1⤵
                                                                              PID:3876
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                              • Boot or Logon Autostart Execution: Active Setup
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:1164
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2096 -ip 2096
                                                                              1⤵
                                                                                PID:4536
                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                1⤵
                                                                                  PID:3736
                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                  1⤵
                                                                                    PID:5152
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2352 -ip 2352
                                                                                    1⤵
                                                                                      PID:6104
                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
                                                                                      1⤵
                                                                                        PID:4304
                                                                                      • C:\Windows\System32\svchost.exe
                                                                                        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
                                                                                        1⤵
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:4200
                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
                                                                                        1⤵
                                                                                          PID:5696
                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                          "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                                                                                          1⤵
                                                                                            PID:4440
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:5792
                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                              "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
                                                                                              1⤵
                                                                                                PID:3016
                                                                                              • C:\Windows\system32\vssvc.exe
                                                                                                C:\Windows\system32\vssvc.exe
                                                                                                1⤵
                                                                                                  PID:4980
                                                                                                • C:\Windows\system32\vssvc.exe
                                                                                                  C:\Windows\system32\vssvc.exe
                                                                                                  1⤵
                                                                                                    PID:5264
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5964 -ip 5964
                                                                                                    1⤵
                                                                                                      PID:2552
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:4624
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                                                      • Drops desktop.ini file(s)
                                                                                                      • Enumerates connected drives
                                                                                                      • Checks SCSI registry key(s)
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                      PID:2316
                                                                                                      • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Gimemo.cdqu-e633ebfa45af4939e7cdef26411dbc929554ce84c076cbd85ab4a19ec1f3abcd.exe
                                                                                                        "C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Gimemo.cdqu-e633ebfa45af4939e7cdef26411dbc929554ce84c076cbd85ab4a19ec1f3abcd.exe"
                                                                                                        2⤵
                                                                                                        • Modifies WinLogon for persistence
                                                                                                        • Executes dropped EXE
                                                                                                        • Adds Run key to start application
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:1800
                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy
                                                                                                      1⤵
                                                                                                        PID:2784
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                        • Modifies Internet Explorer settings
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:5384
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:6088
                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                          "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy
                                                                                                          1⤵
                                                                                                            PID:4300
                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                            "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy
                                                                                                            1⤵
                                                                                                              PID:3888
                                                                                                            • C:\Windows\SysWOW64\werfault.exe
                                                                                                              werfault.exe /h /shared Global\168b514cc1e0425ebd987a2db264ada0 /t 4372 /p 736
                                                                                                              1⤵
                                                                                                                PID:2612

                                                                                                              Network

                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                              Reconnaissance

                                                                                                              Resource Development

                                                                                                              Initial Access

                                                                                                              Execution

                                                                                                              Windows Management Instrumentation

                                                                                                              1
                                                                                                              T1047

                                                                                                              Persistence

                                                                                                              Boot or Logon Autostart Execution

                                                                                                              3
                                                                                                              T1547

                                                                                                              Active Setup

                                                                                                              1
                                                                                                              T1547.014

                                                                                                              Registry Run Keys / Startup Folder

                                                                                                              1
                                                                                                              T1547.001

                                                                                                              Winlogon Helper DLL

                                                                                                              1
                                                                                                              T1547.004

                                                                                                              Privilege Escalation

                                                                                                              Boot or Logon Autostart Execution

                                                                                                              3
                                                                                                              T1547

                                                                                                              Active Setup

                                                                                                              1
                                                                                                              T1547.014

                                                                                                              Registry Run Keys / Startup Folder

                                                                                                              1
                                                                                                              T1547.001

                                                                                                              Winlogon Helper DLL

                                                                                                              1
                                                                                                              T1547.004

                                                                                                              Defense Evasion

                                                                                                              File and Directory Permissions Modification

                                                                                                              1
                                                                                                              T1222

                                                                                                              Hide Artifacts

                                                                                                              2
                                                                                                              T1564

                                                                                                              Hidden Files and Directories

                                                                                                              2
                                                                                                              T1564.001

                                                                                                              Impair Defenses

                                                                                                              1
                                                                                                              T1562

                                                                                                              Safe Mode Boot

                                                                                                              1
                                                                                                              T1562.009

                                                                                                              Indicator Removal

                                                                                                              1
                                                                                                              T1070

                                                                                                              File Deletion

                                                                                                              1
                                                                                                              T1070.004

                                                                                                              Modify Registry

                                                                                                              5
                                                                                                              T1112

                                                                                                              Subvert Trust Controls

                                                                                                              1
                                                                                                              T1553

                                                                                                              Install Root Certificate

                                                                                                              1
                                                                                                              T1553.004

                                                                                                              Credential Access

                                                                                                              Credentials from Password Stores

                                                                                                              2
                                                                                                              T1555

                                                                                                              Credentials from Web Browsers

                                                                                                              1
                                                                                                              T1555.003

                                                                                                              Windows Credential Manager

                                                                                                              1
                                                                                                              T1555.004

                                                                                                              Unsecured Credentials

                                                                                                              1
                                                                                                              T1552

                                                                                                              Credentials In Files

                                                                                                              1
                                                                                                              T1552.001

                                                                                                              Discovery

                                                                                                              Browser Information Discovery

                                                                                                              1
                                                                                                              T1217

                                                                                                              Peripheral Device Discovery

                                                                                                              2
                                                                                                              T1120

                                                                                                              Query Registry

                                                                                                              8
                                                                                                              T1012

                                                                                                              System Information Discovery

                                                                                                              7
                                                                                                              T1082

                                                                                                              System Location Discovery

                                                                                                              1
                                                                                                              T1614

                                                                                                              System Language Discovery

                                                                                                              1
                                                                                                              T1614.001

                                                                                                              Lateral Movement

                                                                                                              Collection

                                                                                                              Data from Local System

                                                                                                              1
                                                                                                              T1005

                                                                                                              Command and Control

                                                                                                              Web Service

                                                                                                              1
                                                                                                              T1102

                                                                                                              Exfiltration

                                                                                                              Impact

                                                                                                              Inhibit System Recovery

                                                                                                              1
                                                                                                              T1490

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              • C:\Program Files\7-Zip\Lang\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
                                                                                                                Filesize

                                                                                                                935B

                                                                                                                MD5

                                                                                                                f81c4131d0915c4a493d9f38bf907c2c

                                                                                                                SHA1

                                                                                                                c007a1b90a4fce7e36fe574f5b9beddd4287bcc3

                                                                                                                SHA256

                                                                                                                ed6015e1973c2dc10ac2931b3f868bb42635075bde566c4635b6b7cebd181a76

                                                                                                                SHA512

                                                                                                                c90a4388cc5055336ef938620307b4e1b10164764320a7120475a9b3cc8f5696cb331629eee6db1c0b8e1f50228bbc98626721ead5bd192f1524feab3fc7769f

                                                                                                                Download Submit

                                                                                                              • C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
                                                                                                                Filesize

                                                                                                                4.1MB

                                                                                                                MD5

                                                                                                                32feadb9657f329df21a7139dd35ec34

                                                                                                                SHA1

                                                                                                                2c16160559af011dad254c08528904fc44b1cfb9

                                                                                                                SHA256

                                                                                                                78a36b357b4be300ae81d5360d345bae8730c0c28c86295b3eb38420df61f1ee

                                                                                                                SHA512

                                                                                                                14cd19674afe6eacfaa6abb173d7da7347bfe35ecf45c622025fcb7b9d4a948040547d0570ac412a56adf42134554381f05aa1a7ecd825a4f65327e03772bb1a

                                                                                                                Download Submit

                                                                                                              • C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX
                                                                                                                Filesize

                                                                                                                293KB

                                                                                                                MD5

                                                                                                                728e32dfece4e39a4d077c9fbbdcc92d

                                                                                                                SHA1

                                                                                                                231ea4bf51921026e9187894d220a0b0363a919a

                                                                                                                SHA256

                                                                                                                4a048dbf59c371c27616bf3337a88cf5799e79f9a0f077c3755bd3750c42dab2

                                                                                                                SHA512

                                                                                                                de1e8cf75553f7e176f05b4402d853e23dff440e36c6306c9c6defb509a2e5402358a0e3f541f45ff2346ef358469b6f11b7cbb95a9af1924852fb570d564e10

                                                                                                                Download Submit

                                                                                                              • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmdp64.msi
                                                                                                                Filesize

                                                                                                                2.4MB

                                                                                                                MD5

                                                                                                                3af2d65f5ea654e7d18930d19a364bd4

                                                                                                                SHA1

                                                                                                                172245ab68f255b302680766233573e01812df0d

                                                                                                                SHA256

                                                                                                                40192994e40052e6e1bbf04c5e60e10e6dd23868ab414a7e63704451d84eab45

                                                                                                                SHA512

                                                                                                                1c10decc81453248156b2dd04590b991d1075cc5b52819327ae507a9e14b62da5ffb7a924d03f0d9502a7d16c774a27df76eb43effd05b312caece7d0047d719

                                                                                                                Download Submit

                                                                                                              • C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe
                                                                                                                Filesize

                                                                                                                1016KB

                                                                                                                MD5

                                                                                                                9297fa28d26de31c6788a24dba3a78ac

                                                                                                                SHA1

                                                                                                                ea9d18a8a3400a3f75bbe940981f9771c1cd2f03

                                                                                                                SHA256

                                                                                                                caa24240bcbfdfe01bcf7864108848f63a50bc677506559ab0c03a7be891070e

                                                                                                                SHA512

                                                                                                                71887ccef14d0230db988bd168ac95eb7b18ed5e19d1ee3f9a86a215b58c0a5228a484000c4987fe48bc85087736378ab91cf3eaa41f2160cf05d94b614f2189

                                                                                                                Download Submit

                                                                                                              • C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo
                                                                                                                Filesize

                                                                                                                607KB

                                                                                                                MD5

                                                                                                                50445fd1422453d1a6a98258f449dc4f

                                                                                                                SHA1

                                                                                                                bb627ac2931ef7246d2f86fd8ff70a8293606c17

                                                                                                                SHA256

                                                                                                                37ec3111363636a3cdb83999d3b88f94b3b6304d0535fe83e3cd1db1320f408c

                                                                                                                SHA512

                                                                                                                c9bdfe275325ad4614df07bfd13290b09dcf9d06b76fa2bb31f1e9169657a505cba2662f3aa95276ac0875738bb2467e409708497d4ce12bfa064996f5ac5951

                                                                                                                Download Submit

                                                                                                              • C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo
                                                                                                                Filesize

                                                                                                                611KB

                                                                                                                MD5

                                                                                                                f0abb1256d79f0e675a735303dd7fae1

                                                                                                                SHA1

                                                                                                                9224e0618b37acc1085e1e8dccabc48ab4e60e56

                                                                                                                SHA256

                                                                                                                fcfa2603b7374840469227586126afee09db5ef5e164fdb837094dc05309da03

                                                                                                                SHA512

                                                                                                                c87ef3d75a84a4eb53176bc50c55e7a676aa4a1eb8166a11780696f35ee1f517655ead1ee4eb19f898d11e1c7ecc600cc26d67df9341b544c5befe6287e7f4a6

                                                                                                                Download Submit

                                                                                                              • C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo
                                                                                                                Filesize

                                                                                                                674KB

                                                                                                                MD5

                                                                                                                75c38a107f1927e7a25c2d9c4e25e729

                                                                                                                SHA1

                                                                                                                53dfccc5e4013ec99542dcb549e3dbe361510e26

                                                                                                                SHA256

                                                                                                                572641224d422ba3ffcd490b9f84e17168ace3756d747e8b2e69583798a4edbe

                                                                                                                SHA512

                                                                                                                4f3b761da8924606b2d2649362d6bb970187a195697fcd221f016c4f56a0cbb7782f9559d850672b34ed54562108e6bbaf9369ee28f17228364839a33f5d46f1

                                                                                                                Download Submit

                                                                                                              • C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo.C6C-677-A9C
                                                                                                                Filesize

                                                                                                                1.1MB

                                                                                                                MD5

                                                                                                                348cf89efafce7b7ccef89c85508cef0

                                                                                                                SHA1

                                                                                                                75eee74b40b884ee5daedb9cd462fdcd65a1cf2d

                                                                                                                SHA256

                                                                                                                0f48f27aec50ae96fe921b1c0e63ef12344f0605646f51200c548b68f8d3ec55

                                                                                                                SHA512

                                                                                                                a5a983662a1378d4d5497cde1ce4e4c51d1b3e5eee2db6538a23343e7f6cb912f5ecb3874bff6de7cf0600c1e4c76d46b14551e69ab664188ec2117810e25bce

                                                                                                                Download Submit

                                                                                                              • C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo
                                                                                                                Filesize

                                                                                                                596KB

                                                                                                                MD5

                                                                                                                b0d11dc61054a3c1a5c572e33f4f0242

                                                                                                                SHA1

                                                                                                                f468483f983402938e2fd9a38f0003fb8010a75d

                                                                                                                SHA256

                                                                                                                ea8c6337dcf7aa9f655a45541dabe1a9996a51b9a360c365c1d9a84341ac62d3

                                                                                                                SHA512

                                                                                                                62ae56d17fc0d700eb6eb581f7ebfab2f9f161d7d431b8a6c28f0f912208d797f8aa3c7e5fc7df6e9c06427c088e1e6b95a34a18a46f0a30ae0f8db1f000e90a

                                                                                                                Download Submit

                                                                                                              • C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo
                                                                                                                Filesize

                                                                                                                617KB

                                                                                                                MD5

                                                                                                                ad0d96e04084556e8535666a2e35e044

                                                                                                                SHA1

                                                                                                                eeb4d14efe3ac1b447e444a1b6c1bae42f87e510

                                                                                                                SHA256

                                                                                                                d47139dd073b9a3a4c34b473079d90b567e32451b28ee02fc616086846192f45

                                                                                                                SHA512

                                                                                                                c7f74ed5b4fc59ba23b0ff5ab63a8f5267a9f72f8db46e6838d40bc33c95b7c969d4728472d9630a7994e0184490b280aae9ca7af97217e36e4c4040afef3185

                                                                                                                Download Submit

                                                                                                              • C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo
                                                                                                                Filesize

                                                                                                                781KB

                                                                                                                MD5

                                                                                                                758533d28dc1564360332ebdb0f3b915

                                                                                                                SHA1

                                                                                                                814b43dd3d820f1f5a7f9fea5c7b314b13719172

                                                                                                                SHA256

                                                                                                                f3c95aaf9990cf06e5a25f5077524783610689843557243f5b77d9b4f34aec34

                                                                                                                SHA512

                                                                                                                c2610f282531cee89dc7a28d344ccfec6fb2c2305577b8f6a1ef3029a0baf77fe11c5953c5e0bb1cb1a73a7ec1a3912dd15cccacf9acb796f4ad461b4d66963e

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Comms
                                                                                                                Filesize

                                                                                                                32B

                                                                                                                MD5

                                                                                                                4e78702e5f4fc8e40dafd100cd46a33c

                                                                                                                SHA1

                                                                                                                8f5e99a3f07a0b07c5646bd9344e3de88b10bfae

                                                                                                                SHA256

                                                                                                                a1c189cd475c7df870b4f25c1c4a5995a3ea46ad83115727017766add0d9a328

                                                                                                                SHA512

                                                                                                                7087359867e1b817c19b0c73eee5c1b70581c368bb620d0a9d6aa5d7a93981faf89305c9b7c6e4b437260d245253d3d2c681c3885749ea7bc04626c014c7337d

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                Filesize

                                                                                                                64KB

                                                                                                                MD5

                                                                                                                d2fb266b97caff2086bf0fa74eddb6b2

                                                                                                                SHA1

                                                                                                                2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                                                                SHA256

                                                                                                                b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                                                                SHA512

                                                                                                                c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                Filesize

                                                                                                                4B

                                                                                                                MD5

                                                                                                                f49655f856acb8884cc0ace29216f511

                                                                                                                SHA1

                                                                                                                cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                                                SHA256

                                                                                                                7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                                                SHA512

                                                                                                                599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                Filesize

                                                                                                                944B

                                                                                                                MD5

                                                                                                                6bd369f7c74a28194c991ed1404da30f

                                                                                                                SHA1

                                                                                                                0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                                                                SHA256

                                                                                                                878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                                                                SHA512

                                                                                                                8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                Filesize

                                                                                                                152B

                                                                                                                MD5

                                                                                                                3baf62a335f440924f686646ba83af1b

                                                                                                                SHA1

                                                                                                                5b737491392394376d6ba7188d509dc416864cff

                                                                                                                SHA256

                                                                                                                489626a707b2a096b93de41fb832f38a4fd169c7fea45e11afae1fdf2064bf7f

                                                                                                                SHA512

                                                                                                                a2288eafc09541beb1056de462e6f4a7201ba953d0570c11333fc5fc60b0fd0ecc7cf25b5d3ee243401724b9688dca7967b15647880702c9c03995e5af91fbe8

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                Filesize

                                                                                                                152B

                                                                                                                MD5

                                                                                                                8ae747f9093512ee126aa55a7a6d88f4

                                                                                                                SHA1

                                                                                                                bea951e951a290034698d20247f988c658a59f2d

                                                                                                                SHA256

                                                                                                                db33e5e17f8df444002b369aac8e79c00208830ade560d29911819ee4bbb0f29

                                                                                                                SHA512

                                                                                                                781245481a7a25ef6a575e5c859ef6e767be2c02ae340fe18496f5d8710e7e929a8f3f27f073dae4782dd2fa52fb9fbd2ac10b1e8a50c81f4a9001762a01bfc2

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\94f77f77-1588-40b4-a649-0893d21d5b10.tmp
                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                MD5

                                                                                                                66479e20abd433e54c34e5ccb82909a1

                                                                                                                SHA1

                                                                                                                4ebdd0a17f1cdd7fef450b29d23c76328308b818

                                                                                                                SHA256

                                                                                                                cb27eb93d1091daff490b7da6195db07af4a98a039d1d2b3db6fb0a94d3b66d9

                                                                                                                SHA512

                                                                                                                e7bfb1d58ba68d7b082f718db86604cfa8c1a7b91b14f2df647b3ff6fadea9520208cfa4748c69945be4df8c23d19ae291d2bafdbda191e1eae198b061b67f11

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2
                                                                                                                Filesize

                                                                                                                8KB

                                                                                                                MD5

                                                                                                                0962291d6d367570bee5454721c17e11

                                                                                                                SHA1

                                                                                                                59d10a893ef321a706a9255176761366115bedcb

                                                                                                                SHA256

                                                                                                                ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                                                                                                                SHA512

                                                                                                                f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3
                                                                                                                Filesize

                                                                                                                8KB

                                                                                                                MD5

                                                                                                                41876349cb12d6db992f1309f22df3f0

                                                                                                                SHA1

                                                                                                                5cf26b3420fc0302cd0a71e8d029739b8765be27

                                                                                                                SHA256

                                                                                                                e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                                                                                                                SHA512

                                                                                                                e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                Filesize

                                                                                                                48B

                                                                                                                MD5

                                                                                                                735ab6e47d651f67109266517765e94a

                                                                                                                SHA1

                                                                                                                efdec440cfec449c136b5f6a72c20ddea2b99369

                                                                                                                SHA256

                                                                                                                0c1b47153c731ad17ce4c67b80a5f8b91b6530921a30a20e2e9594302cee5914

                                                                                                                SHA512

                                                                                                                6d301b3d832944dc537ff92b706426cab5cfbb635f9a66d7a03cfe3acbb4543f0a1c30089567ad28efe83cf70e384d41b4b6f72e751e80dff0ba333b784228be

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                Filesize

                                                                                                                192B

                                                                                                                MD5

                                                                                                                5eaff111882e4c8d01430fd2d3fb04f0

                                                                                                                SHA1

                                                                                                                861f619d4f071bcf29156b49701a4d3cb611e838

                                                                                                                SHA256

                                                                                                                cb9119419ca29508dcf8f725745b09e517f9945e6dab012f84372ee5b8e1bb02

                                                                                                                SHA512

                                                                                                                0714ac980bf08823b3a0f43e5800047c8202f61a42319afc255ffacf60a60a48d2b56a58ad79726e4056d559652ab4f256e226cc0065a4ff9a7eca14020aae5c

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001
                                                                                                                Filesize

                                                                                                                41B

                                                                                                                MD5

                                                                                                                5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                                SHA1

                                                                                                                d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                                SHA256

                                                                                                                f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                                SHA512

                                                                                                                de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
                                                                                                                Filesize

                                                                                                                2KB

                                                                                                                MD5

                                                                                                                33121192641f4d182eb51a0d8a37ca00

                                                                                                                SHA1

                                                                                                                4d2b41569fb705df926f812f969e16ff7cf106a5

                                                                                                                SHA256

                                                                                                                4e232c783287a6132a862272ec705ccd1c8bb474e7afa33d1f020f58691f168a

                                                                                                                SHA512

                                                                                                                7de962114e9418673f1ea5385713551aae16819f191cb371fac0475f8a0626f05a3dc46737b366548a525fed3838983e57f71c6ec9247aedb58e6944e5dff16c

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                Filesize

                                                                                                                59B

                                                                                                                MD5

                                                                                                                2800881c775077e1c4b6e06bf4676de4

                                                                                                                SHA1

                                                                                                                2873631068c8b3b9495638c865915be822442c8b

                                                                                                                SHA256

                                                                                                                226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                                                                                                SHA512

                                                                                                                e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                Filesize

                                                                                                                668B

                                                                                                                MD5

                                                                                                                6145712f02eb648f91c4b4ea9e6e48b9

                                                                                                                SHA1

                                                                                                                13cb7ff2729789168d0104b09bf5b54a5cf3c171

                                                                                                                SHA256

                                                                                                                d573070cd2f40de99ecc163ab93643c3b781c82483bff8534a82c5e914fd0356

                                                                                                                SHA512

                                                                                                                b08a4a7cc076548f039c88625d4f1e419b8865c3bc6bd1947f210dbf71910ec802b7d16127c2cc1fde9b1e370881e7e66e058bb98fc4f058bf185d6dea9ae7af

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                Filesize

                                                                                                                5KB

                                                                                                                MD5

                                                                                                                8bcaef7d4caff3c4822d3b9e79aa9656

                                                                                                                SHA1

                                                                                                                b0133180b347e050fdb668fc4465c8c35857afd1

                                                                                                                SHA256

                                                                                                                76fcfbf50dd93a1157b9843cad1a5cf9e8340299f61517226f9d3a0a52956113

                                                                                                                SHA512

                                                                                                                8977d411ef09f0122bb70efce5828d2612d4b93279753fe6d9c0a30dbe88123f67e82d8b4f6cd562f6f09c97fd5d86dcdf415936290be78809e7375066fa1054

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                Filesize

                                                                                                                5KB

                                                                                                                MD5

                                                                                                                0cf3861a8a9c14fee68c0e747d2f45d2

                                                                                                                SHA1

                                                                                                                4ce18e65ee0cf2bc9209f487b0d5e638aa784dcc

                                                                                                                SHA256

                                                                                                                163512470f16d0d4fac7dbb86db178db201e4d0d0fde00ff2958f2ca3a4ef6e5

                                                                                                                SHA512

                                                                                                                5312c1a62ccec029c65023325c3dce36dfab3d6bbde8c8524258d2290b40d34e0fa0e265466f28b5730870385051722ccf3dca9ae8659b3450af2f47e1901315

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                Filesize

                                                                                                                5KB

                                                                                                                MD5

                                                                                                                a84f9f80e4e70d82691aaee06ea08929

                                                                                                                SHA1

                                                                                                                d9307319450793ce444a8d78b7547278d1844032

                                                                                                                SHA256

                                                                                                                f774b0d7a464791802a0c8bcfe83a37345c36d8431dd4574849788cdc227b0fc

                                                                                                                SHA512

                                                                                                                7e7c40fb9af2d9d3125b1e167f24b28ff123ada157486ef6af7278787baa0ac32a65fc2df7853176b69247584bc0e909129114d17162b09ab21845fc7b551c0b

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                Filesize

                                                                                                                24KB

                                                                                                                MD5

                                                                                                                f5752c6e3d715fb90f9b7686f508cadf

                                                                                                                SHA1

                                                                                                                b106673cc44e8df4d6edabcafe327187734f9082

                                                                                                                SHA256

                                                                                                                5d63db559af6b9e85458a4edeff3ba130df467dffdc2bbdae4f6f71103581585

                                                                                                                SHA512

                                                                                                                cf63a03a6bcbb527f74da172761ae662a6c1d9bd20978834823bd0bf874bfe414bd21d483efd74c519c0dd8b8f1160c095e1261b2ec056248c9e532af3383e19

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RFe59236c.TMP
                                                                                                                Filesize

                                                                                                                24KB

                                                                                                                MD5

                                                                                                                c94be039d8a317eeed67ccac3450c787

                                                                                                                SHA1

                                                                                                                010b914be0acd6cb6fae89bcafc2cfc5ba867f8c

                                                                                                                SHA256

                                                                                                                c905fd45b0bcc0b2f514299d089f2160d175b69a4d09144e956ef1b4d633f1bb

                                                                                                                SHA512

                                                                                                                7a9e55351fc7eb51727e45de464b7152ddd0f1683306a86ef232408a9dc4e78113fbdc778ca1d094b5f8371c487d7c91aac51c5402be344a00e50213d11bee64

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a3d7833f108992ee05ac47ddc9f1b240200bcf4a\d8af12b3-9c35-498d-83fd-aafe51a0a8e4\index-dir\the-real-index
                                                                                                                Filesize

                                                                                                                72B

                                                                                                                MD5

                                                                                                                54e2fe811c9a1a3d3b67df0f87cbc278

                                                                                                                SHA1

                                                                                                                e186895236b4528eaeeeba50c70826b2ae20f943

                                                                                                                SHA256

                                                                                                                2d65798f3a547f1deac07829305dfa8bbbd09f7d84902ffa6df7ad0fff64f9d1

                                                                                                                SHA512

                                                                                                                42939787560fd43f88612ad20cabe8968262941c99f83a3c3fd61fbcb6df4a50c33a11c9d579b469f5d2e977bed7c08b6e70758c9d49e5fe2f6f36dd5dde18dd

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a3d7833f108992ee05ac47ddc9f1b240200bcf4a\d8af12b3-9c35-498d-83fd-aafe51a0a8e4\index-dir\the-real-index~RFe5957ea.TMP
                                                                                                                Filesize

                                                                                                                48B

                                                                                                                MD5

                                                                                                                792520bf3fde0394680f5a2a468c9ba2

                                                                                                                SHA1

                                                                                                                4c51186ba097c030a841713b27852bf5b57164f1

                                                                                                                SHA256

                                                                                                                9cc25558065da4b624525861542c8c11b5adca6905b450e300d3620766bd21fe

                                                                                                                SHA512

                                                                                                                ad17fc96850149ea59b7205fc5d1df1a7ed038da4fc37fa6d2025af0f9df53e1b038fea74b1ed4e67ff3673173b88f5f2b741706c70c022b201f6455ce7e233d

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a3d7833f108992ee05ac47ddc9f1b240200bcf4a\index.txt
                                                                                                                Filesize

                                                                                                                89B

                                                                                                                MD5

                                                                                                                584d1725c9338bf5af314fffa8608989

                                                                                                                SHA1

                                                                                                                82b0ed53609ae31392395bca99677b3bf1c21244

                                                                                                                SHA256

                                                                                                                81f8cc0415a6d2dfe9a65709489914577cf8e78586df476985ed2d60aed1a88f

                                                                                                                SHA512

                                                                                                                fc70dbb5afd1ad5b562d6de22d7bdee9ea4727fbee8cb31236f0305747a2f87d98788536dcb3c82c6e45c3f94a0cb2370437471d68786071a09764e0cda16a8d

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a3d7833f108992ee05ac47ddc9f1b240200bcf4a\index.txt
                                                                                                                Filesize

                                                                                                                83B

                                                                                                                MD5

                                                                                                                6f76f0815f307f4d5f1a75dd7b926ed6

                                                                                                                SHA1

                                                                                                                314702ee65298a642ab354261a608d4748899b50

                                                                                                                SHA256

                                                                                                                fb663a6f9cd8823306c621831ebd397b520b85a1476c0b67deaebeaac0d1babe

                                                                                                                SHA512

                                                                                                                6aaf86f7d3f92ada26b6ef25744c951b38c335133560594e624aa2d282c9550a17ac7b56f573ba3c376a35194563872bdf7b6001f481ab9290b9545d8b34e39e

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index
                                                                                                                Filesize

                                                                                                                24B

                                                                                                                MD5

                                                                                                                54cb446f628b2ea4a5bce5769910512e

                                                                                                                SHA1

                                                                                                                c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

                                                                                                                SHA256

                                                                                                                fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

                                                                                                                SHA512

                                                                                                                8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                Filesize

                                                                                                                72B

                                                                                                                MD5

                                                                                                                1ad569854755923e2c9e365fea17edb1

                                                                                                                SHA1

                                                                                                                b54350855accfc431501e91acc61f2e35aff6e0d

                                                                                                                SHA256

                                                                                                                ee7413ff7cfdca7909eb08d6b138d0cca454c30d4b46c9071b6c75ba130f227a

                                                                                                                SHA512

                                                                                                                fe60d61ae493afa1ac7b41aa2c383272bf9c1ebc7da9d5d392d6ea51549c86565a40aad3e197b274d17e70b3877488e9317ec14d7f5c6d2797aa09592669f01e

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5955e6.TMP
                                                                                                                Filesize

                                                                                                                48B

                                                                                                                MD5

                                                                                                                65e56cfc70e84f04c5e5ce153e087463

                                                                                                                SHA1

                                                                                                                35961d45b2707df1701f78864ab697335fb84d5e

                                                                                                                SHA256

                                                                                                                7cbc354e166ce0698d7cdd19d80e305b4e8485b31919692e97effa258481d5ec

                                                                                                                SHA512

                                                                                                                5af6e28e5b3464ada0a4bea391b2384f5bc6b34f34acc86687b263ddd9f145d56088ed2140118ffd1256b2d9ee1abab21c4b90eeea7bda2d3ef770f009629ca0

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\CURRENT
                                                                                                                Filesize

                                                                                                                16B

                                                                                                                MD5

                                                                                                                46295cac801e5d4857d09837238a6394

                                                                                                                SHA1

                                                                                                                44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                SHA256

                                                                                                                0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                SHA512

                                                                                                                8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
                                                                                                                Filesize

                                                                                                                8KB

                                                                                                                MD5

                                                                                                                cf89d16bb9107c631daabf0c0ee58efb

                                                                                                                SHA1

                                                                                                                3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                                                                                                                SHA256

                                                                                                                d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                                                                                                                SHA512

                                                                                                                8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
                                                                                                                Filesize

                                                                                                                264KB

                                                                                                                MD5

                                                                                                                f50f89a0a91564d0b8a211f8921aa7de

                                                                                                                SHA1

                                                                                                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                                SHA256

                                                                                                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                                SHA512

                                                                                                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a18bf5a0-6bd9-46b7-9a18-d7b9b74fb0d1.tmp
                                                                                                                Filesize

                                                                                                                70KB

                                                                                                                MD5

                                                                                                                e5e3377341056643b0494b6842c0b544

                                                                                                                SHA1

                                                                                                                d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                                                                                                SHA256

                                                                                                                e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                                                                                                SHA512

                                                                                                                83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                Filesize

                                                                                                                16B

                                                                                                                MD5

                                                                                                                206702161f94c5cd39fadd03f4014d98

                                                                                                                SHA1

                                                                                                                bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                                SHA256

                                                                                                                1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                                SHA512

                                                                                                                0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                Filesize

                                                                                                                9KB

                                                                                                                MD5

                                                                                                                dc5ff60f1ead1537ef10084cb1769964

                                                                                                                SHA1

                                                                                                                daa5dd0442a3fd082af61d829ac213dafb42bb9d

                                                                                                                SHA256

                                                                                                                1a0b2a4559a55c78a7d74f9895808539d60cffdf1b5aa612ae10512947fff413

                                                                                                                SHA512

                                                                                                                45092c42023c476b1ee5c2deec41aaca9c544d081394bc12af3a0163574fa7c0b6ee00d2ac8d6e1d9ff7556dc4987534f5db824fcba3d30ba79ac36255872126

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State~RFe594220.TMP
                                                                                                                Filesize

                                                                                                                7KB

                                                                                                                MD5

                                                                                                                0dde1deea3926c33c0e964ecb52b7173

                                                                                                                SHA1

                                                                                                                82bd4811c916b4d19852d245103fbabd9705679d

                                                                                                                SHA256

                                                                                                                560f4d9e722ebc6b32cdd23214c2d814d2666dc10ea3240d2c4e000ef04ab3db

                                                                                                                SHA512

                                                                                                                cd34b36ab2b36afd2ecb111722ad1ec22016d9e480df6b90594d50096ad1105d4e15ecb772fd181699e5c7e39076219b1aff3cbaaccabc6215d5c8efffe7bf47

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
                                                                                                                Filesize

                                                                                                                174B

                                                                                                                MD5

                                                                                                                e0fd7e6b4853592ac9ac73df9d83783f

                                                                                                                SHA1

                                                                                                                2834e77dfa1269ddad948b87d88887e84179594a

                                                                                                                SHA256

                                                                                                                feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122

                                                                                                                SHA512

                                                                                                                289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                                MD5

                                                                                                                777dd969da3dd17026244668b774e058

                                                                                                                SHA1

                                                                                                                e0a066d28dfc6bcca1c13a50bfc4b35a37541b7a

                                                                                                                SHA256

                                                                                                                221f1bd7bad281fe93374736df606e52ce7393ae4fe0bdd4682935b90f184e59

                                                                                                                SHA512

                                                                                                                1f1a19b1a969a62cd8c83622e89077492457dd00f28505f0fe49a600688b18bf0407cae61e0da9f0d23fd0f6d874125fe83a5666ca7975976d612743fda08158

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                                                Filesize

                                                                                                                7KB

                                                                                                                MD5

                                                                                                                77b65a77cac00fe47b16dd4819c4a4c7

                                                                                                                SHA1

                                                                                                                5d174cc05cfc487ee35db8aaa770930a26529bc0

                                                                                                                SHA256

                                                                                                                31aa3f7fa15dc18c49e4e36554fbaed761808284a0fa4a792a48e46d267e0383

                                                                                                                SHA512

                                                                                                                abcc320916161427a5b5683edd9242ad065680eee55f35b770e24c58f3ddb5b77bc1f58bc4c5fb851bec15b441a8de904a10dbb7eeaf6dcdf9460470d3d33d78

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                                MD5

                                                                                                                d6b130e951a42c547e09b5427476d4f6

                                                                                                                SHA1

                                                                                                                891b3b6c623b61d54fcb3b70ad7ec8464cac65f8

                                                                                                                SHA256

                                                                                                                0fcf035645c3fb2f683de1e0bfa1885e3d5a32c2e4125aac70bdc127fb44b935

                                                                                                                SHA512

                                                                                                                47460f3a19b49240995a4c60924b2428f1a166e43e3dbf376d3e334599fa7e4d339162868f6137fc2fdf722282d09705228d973e8ff5351f947d133eeffecf28

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
                                                                                                                Filesize

                                                                                                                7KB

                                                                                                                MD5

                                                                                                                e8dcf21ea94f3d01fa76f97c6a7cab93

                                                                                                                SHA1

                                                                                                                295cfe620e51da3f6b94aa971c589c605b7263eb

                                                                                                                SHA256

                                                                                                                99760809e09c86100ee137a6fa7e468fa37694af6563902cca113bc95b6ad145

                                                                                                                SHA512

                                                                                                                8a64ec1a739897a1e618e509ed7c16cae8ea3821b5adcc4a1ab1358b07701036d035381a78745aacb9fbc874629ddcc5645a8c2761b8fa930c0923147816281f

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\FWH0DPRU\microsoft.windows[1].xml
                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                99d739ab815387d31c85e489a51495cd

                                                                                                                SHA1

                                                                                                                c0bcbc18d52c644f9f09f3989ffba0df482e068c

                                                                                                                SHA256

                                                                                                                da6f92552c98fab7e3e89eb0c21b90cf27a983973f993cb0d5c55927238690ac

                                                                                                                SHA512

                                                                                                                b352742864ea1047b90e56b50c34552b1fbe093cd7fc3344a8dfaa72632b0f54d33076e603942436a5443552e102416e2ad15c470aa3352408a14058d55c6cdf

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\SayCheese.exe
                                                                                                                Filesize

                                                                                                                987KB

                                                                                                                MD5

                                                                                                                d5265e76d13e38eb1a431852432b35e4

                                                                                                                SHA1

                                                                                                                3b6c8d937cd4a767f5471eeb222db8394bc9438c

                                                                                                                SHA256

                                                                                                                444a6c5f95a50f9ab7e97fe914bc7704c6952cc105aa5c11c21eb7a15382a6c0

                                                                                                                SHA512

                                                                                                                9a7a1fed616384a0e910d12b270e15bdf0aa4e622f34074989ceae0e461c1b7b0b7cbd5c04fad96f40012294feb19e2c6b60feb112fc58f0f6d4668277ae46e4

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\config.exe
                                                                                                                Filesize

                                                                                                                2.6MB

                                                                                                                MD5

                                                                                                                96957db0a8bfc0b0e44733b14b436191

                                                                                                                SHA1

                                                                                                                a0983b80a98d23d4cb0741be077ab60a6882e2d0

                                                                                                                SHA256

                                                                                                                13edf1c9c3ca671916716f4c48d1acbe1c6b9e43f2226fe4420fd52071fcfc03

                                                                                                                SHA512

                                                                                                                40278dd866097c6135950c6bd59722470bb15be537b2049a33338634506237f58be33f18875f4a42b3e021dab2317d691153750b80a9bd28e0bb8645cd76aac4

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kchql2n5.1k3.ps1
                                                                                                                Filesize

                                                                                                                60B

                                                                                                                MD5

                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                SHA1

                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                SHA256

                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                SHA512

                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD4CF.tmp\UDS-Trojan-Ransom.Win32.Crypmod.xvk-338dd780ea34a04619568845e036d97ff23758c54d65704c81b37a59c66275e7.exe
                                                                                                                Filesize

                                                                                                                196KB

                                                                                                                MD5

                                                                                                                808de473370ef6b5d98ab752f245a3ca

                                                                                                                SHA1

                                                                                                                800bd4ad10c17471829693fac3cee4502b14f029

                                                                                                                SHA256

                                                                                                                65cbed2e8db313b8966638e40eb27f94156c294eb060b28a02c130d146518c39

                                                                                                                SHA512

                                                                                                                fafaff03ad502523b3627e59e1026b8af4217a80215782a90667bc4f4c330871d8c3d890f2601b68ec9a42c0171d12b9e5b87067c95dcad1132b0a8979c56a4c

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsa9EAD.tmp\System.dll
                                                                                                                Filesize

                                                                                                                11KB

                                                                                                                MD5

                                                                                                                0063d48afe5a0cdc02833145667b6641

                                                                                                                SHA1

                                                                                                                e7eb614805d183ecb1127c62decb1a6be1b4f7a8

                                                                                                                SHA256

                                                                                                                ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

                                                                                                                SHA512

                                                                                                                71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsd9816.tmp\INetC.dll
                                                                                                                Filesize

                                                                                                                24KB

                                                                                                                MD5

                                                                                                                640bff73a5f8e37b202d911e4749b2e9

                                                                                                                SHA1

                                                                                                                9588dd7561ab7de3bca392b084bec91f3521c879

                                                                                                                SHA256

                                                                                                                c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

                                                                                                                SHA512

                                                                                                                39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsd9816.tmp\System.dll
                                                                                                                Filesize

                                                                                                                16KB

                                                                                                                MD5

                                                                                                                c8ffec7d9f2410dcbe25fe6744c06aad

                                                                                                                SHA1

                                                                                                                1d868cd6f06b4946d3f14b043733624ff413486f

                                                                                                                SHA256

                                                                                                                50138c04dc8b09908d68abc43e6eb3ab81e25cbf4693d893189e51848424449f

                                                                                                                SHA512

                                                                                                                4944c84894a26fee2dd926bf33fdf4523462a32c430cf1f76a0ce2567a47f985c79a2b97ceed92a04edab7b5678bfc50b4af89e0f2dded3b53b269f89e6b734b

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsd9816.tmp\nsDialogs.dll
                                                                                                                Filesize

                                                                                                                11KB

                                                                                                                MD5

                                                                                                                da979fedc022c3d99289f2802ef9fe3b

                                                                                                                SHA1

                                                                                                                2080ceb9ae2c06ab32332b3e236b0a01616e4bba

                                                                                                                SHA256

                                                                                                                d6d8f216f081f6c34ec3904ef635d1ed5ca9f5e3ec2e786295d84bc6997ddcaa

                                                                                                                SHA512

                                                                                                                bd586d8a3b07052e84a4d8201945cf5906ee948a34806713543acd02191b559eb5c7910d0aff3ceab5d3b61bdf8741c749aea49743025dbaed5f4c0849c80be6

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsx97F7.tmp\System.dll
                                                                                                                Filesize

                                                                                                                11KB

                                                                                                                MD5

                                                                                                                a4dd044bcd94e9b3370ccf095b31f896

                                                                                                                SHA1

                                                                                                                17c78201323ab2095bc53184aa8267c9187d5173

                                                                                                                SHA256

                                                                                                                2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

                                                                                                                SHA512

                                                                                                                87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsx97F7.tmp\npHelper.dll
                                                                                                                Filesize

                                                                                                                328KB

                                                                                                                MD5

                                                                                                                ef81554c861acf96e5b9a61277838a01

                                                                                                                SHA1

                                                                                                                15200c8163840e47688271c18a5e611bf170e05b

                                                                                                                SHA256

                                                                                                                bc48e8ed0d9961d410984e8a4abc8870890bd0a7610d2db7a68ec15c651aec6b

                                                                                                                SHA512

                                                                                                                97909f2730130d53d3e70686e973fb81c95574fcb03b1075053ec9bf8bb6f91dcc223a98c1f726c4692e1f6e5e2a240f49eb2aa955fdde908ae587073fc23676

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsx97F7.tmp\nsDialogs.dll
                                                                                                                Filesize

                                                                                                                9KB

                                                                                                                MD5

                                                                                                                0d45588070cf728359055f776af16ec4

                                                                                                                SHA1

                                                                                                                c4375ceb2883dee74632e81addbfa4e8b0c6d84a

                                                                                                                SHA256

                                                                                                                067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a

                                                                                                                SHA512

                                                                                                                751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
                                                                                                                Filesize

                                                                                                                174B

                                                                                                                MD5

                                                                                                                17d5d0735deaa1fb4b41a7c406763c0a

                                                                                                                SHA1

                                                                                                                584e4be752bb0f1f01e1088000fdb80f88c6cae0

                                                                                                                SHA256

                                                                                                                768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed

                                                                                                                SHA512

                                                                                                                a521e578903f33f9f4c3ebb51b6baa52c69435cb1f9cb2ce9db315a23d53345de4a75668096b14af83a867abc79e0afa1b12f719294ebba94da6ad1effc8b0a3

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
                                                                                                                Filesize

                                                                                                                174B

                                                                                                                MD5

                                                                                                                a2d31a04bc38eeac22fca3e30508ba47

                                                                                                                SHA1

                                                                                                                9b7c7a42c831fcd77e77ade6d3d6f033f76893d2

                                                                                                                SHA256

                                                                                                                8e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531

                                                                                                                SHA512

                                                                                                                ed8233d515d44f79431bb61a4df7d09f44d33ac09279d4a0028d11319d1f82fc923ebbc6c2d76ca6f48c0a90b6080aa2ea91ff043690cc1e3a15576cf62a39a6

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.MSIL.Agent.gen-a6787985243f50e272c98fe15b21f461f892e8905bbc5ffd7018ca2694bc5079.exe
                                                                                                                Filesize

                                                                                                                309KB

                                                                                                                MD5

                                                                                                                870fd3454e119ef7d325a73bb9fbdf61

                                                                                                                SHA1

                                                                                                                11c07a627e7ce13acbaafd11776b75e5bcb57d18

                                                                                                                SHA256

                                                                                                                a6787985243f50e272c98fe15b21f461f892e8905bbc5ffd7018ca2694bc5079

                                                                                                                SHA512

                                                                                                                3200f40fa5b8d328c8947eda31e66ee2a18e41154c030772074ee266770d47d79d8b3cf0e92ed5bb7975388ede0813d3c3e9ec5b4338dd1334af97f8821da64a

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.MSIL.Blocker.gen-186d9afa5f922ed9b4cb93853bd15496aeaf37d212f479c049fbd74c40d0b8af.exe
                                                                                                                Filesize

                                                                                                                2.1MB

                                                                                                                MD5

                                                                                                                46b09cfe0be5ac8aab7160322d803216

                                                                                                                SHA1

                                                                                                                2cf4dcbd0e74bfbcf0dd100bd3de844d6c4c43ba

                                                                                                                SHA256

                                                                                                                186d9afa5f922ed9b4cb93853bd15496aeaf37d212f479c049fbd74c40d0b8af

                                                                                                                SHA512

                                                                                                                3528045ba85f1086fcf2f7e9ee151dde265e54d8c71538802ce0720c6b1a3ad6b62acee4a9b9cb3a0a367d0ee00860a27a80f91d816fd4f01641cccad8f73c70

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.MSIL.Foreign.gen-4c8e0459524380a9f00ffc58913f461c3e1d8737dd18252881f09e2d416e4f73.exe
                                                                                                                Filesize

                                                                                                                9.7MB

                                                                                                                MD5

                                                                                                                ed50add120e6acbd68d9940c4037ef9d

                                                                                                                SHA1

                                                                                                                1b20bebb26b47ebcad25512740eb293620b63124

                                                                                                                SHA256

                                                                                                                4c8e0459524380a9f00ffc58913f461c3e1d8737dd18252881f09e2d416e4f73

                                                                                                                SHA512

                                                                                                                c31fc44e2dd4ba42f0c65ddb7cfbf25c2a44818bf99496a82b84d3c36c2a5f14caabcd8f90195007dcec94ff3e28a1c7a5d6f18fe92f991f697c77f04d121150

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.Win32.Blocker.gen-2cf41c6c7b120dca73fc1b0145406c190c5ea38edf5f349387a51184359e82e6.exe
                                                                                                                Filesize

                                                                                                                1.2MB

                                                                                                                MD5

                                                                                                                1293f2a7bae8b6232854fdb05c41bd58

                                                                                                                SHA1

                                                                                                                391fcedf2a12251884a7d380f9b9b1e6e652f8e2

                                                                                                                SHA256

                                                                                                                2cf41c6c7b120dca73fc1b0145406c190c5ea38edf5f349387a51184359e82e6

                                                                                                                SHA512

                                                                                                                76298ba5bbe9efe57a6e67841a9e297f53b08309e8ffb5dd980406e23d13bb92f21e2e37bc84b94a600407750343d8fb77dcb68960c8f0aba90387050c84abd5

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.Win32.Encoder.gen-ce979ac72ae1a0e4c13109625c4eee0ad521ee72cf380642bcc8375739b82d29.exe
                                                                                                                Filesize

                                                                                                                201KB

                                                                                                                MD5

                                                                                                                434c9cea94668908bc6095ddc00b38df

                                                                                                                SHA1

                                                                                                                ecc2e452fb29bd800a7a21a9b5091d74963641c2

                                                                                                                SHA256

                                                                                                                ce979ac72ae1a0e4c13109625c4eee0ad521ee72cf380642bcc8375739b82d29

                                                                                                                SHA512

                                                                                                                bfa07c580e2b87f2b6a0eddeedb320271a780f83ad8e9f612da2e7229ac5a54bbb690b605581a5300cc66eee1c8155e39c624fe6da64f4377f59f69309f2a083

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.Win32.Generic-ea0663308264d011ded742ebb145cea6be39193596654979bd5a9f16b380aea3.exe
                                                                                                                Filesize

                                                                                                                2.7MB

                                                                                                                MD5

                                                                                                                1de88eb91e168dbfc2bdec64c0522ea9

                                                                                                                SHA1

                                                                                                                c9d16703a81f5044455ebb8b4075782f7f0581d3

                                                                                                                SHA256

                                                                                                                ea0663308264d011ded742ebb145cea6be39193596654979bd5a9f16b380aea3

                                                                                                                SHA512

                                                                                                                05e5035431fbd7c7763dca2db38a200bc7914e2935a1630441c00c4d599cbf01d9695b3e0f391c19348e6ce98eaf683e47c6e9c78960559d4c082a2fcb374eb2

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.Win32.Makop.gen-9ddffccd20b4260116e889b979e21e772848a457cb6b17a2664a4ee12aa9199f.exe
                                                                                                                Filesize

                                                                                                                877KB

                                                                                                                MD5

                                                                                                                4f66694bd09060fa11e6b24ef7180c6b

                                                                                                                SHA1

                                                                                                                d60daf84ab9a6f2b955976fc24bf0fa88273367a

                                                                                                                SHA256

                                                                                                                9ddffccd20b4260116e889b979e21e772848a457cb6b17a2664a4ee12aa9199f

                                                                                                                SHA512

                                                                                                                b26e259570a1a948c85cf416a085247986b9982024d195eb962da1edc1be67b97fce1ad8db86569a7d3d9231b3a50fef972c840486691144fcb2610a1d96b49c

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\00426\HEUR-Trojan-Ransom.Win32.Stop.gen-d466ef9698569363af4f08b64235817c7838c726c1faee300582aab3d90f5683.exe
                                                                                                                Filesize

                                                                                                                698KB

                                                                                                                MD5

                                                                                                                839609b011f03a293a0573ea5fb1277e

                                                                                                                SHA1

                                                                                                                fe48ac0a84e79bc2dd0024e55a62e86b077f8c12

                                                                                                                SHA256

                                                                                                                d466ef9698569363af4f08b64235817c7838c726c1faee300582aab3d90f5683

                                                                                                                SHA512

                                                                                                                526f6345e367950bc775213663fd68bd7bae2b82c71df70e8589dccc173da66af0171183c4abc4a102e45e151453ff8a8d67c2e4c8fcf72c54d85def22d37ac4

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Blocker.jzec-ed34ead6ec6c362e85707d8a4ce385f6a967e155242be57ee4ee7235759d9870.exe
                                                                                                                Filesize

                                                                                                                397KB

                                                                                                                MD5

                                                                                                                8cf7b4a93013dc7726d05a3e56cd9167

                                                                                                                SHA1

                                                                                                                af9d193ed9ae5b4aa84bdc227b5a6116e26937be

                                                                                                                SHA256

                                                                                                                ed34ead6ec6c362e85707d8a4ce385f6a967e155242be57ee4ee7235759d9870

                                                                                                                SHA512

                                                                                                                556645b333f5170e610f9355cf7fa0afdb99e45b7f584eb8a5d3faaf2a50d84ca4c690a481c6ab718c9cbc5dcb278353b3e6682199ec0c216b8c1f8f7d5eb597

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Blocker.mvwo-8f4df1b11998017853ed5d0f009f461275cdd73f9c274d865fd11c36f6280118.exe
                                                                                                                Filesize

                                                                                                                2.5MB

                                                                                                                MD5

                                                                                                                148d216f156537381a7dbf6c85576628

                                                                                                                SHA1

                                                                                                                a7baeb6a146bc90f5a60a9e75d0b3281fdcefb47

                                                                                                                SHA256

                                                                                                                8f4df1b11998017853ed5d0f009f461275cdd73f9c274d865fd11c36f6280118

                                                                                                                SHA512

                                                                                                                b876ec36495df3d729e9984e6562c3110d2afd4c4945f8d1183340bb4eab8725acdfa7fcd96d2af460be21a2def997e21c7bfe100c9aba369acd9535a987d397

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Cryptor.edd-a39888f0df247072b57479e11d5536692035f10a8a2b18b5dd510a7d2fffcc3d.exe
                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                MD5

                                                                                                                e7dac7353aedea59d7ff589a8c6ca5c3

                                                                                                                SHA1

                                                                                                                8a974ac76fb587855d488629944abfa1fb5822e3

                                                                                                                SHA256

                                                                                                                a39888f0df247072b57479e11d5536692035f10a8a2b18b5dd510a7d2fffcc3d

                                                                                                                SHA512

                                                                                                                1d614ef09db89fa5f218b57c6dc372f62d223dee14e599d93ef86c8e5deca067c7beafcf19f6fee7f408a193c167162c3ec3fe747ba0568a58444d7183c3b058

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Encoder.lqn-5fd1a714a3c72c00cc9cbcdf8f100c2e8e8e475354c8c582d1711e737c398423.exe
                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                MD5

                                                                                                                67643493892a1d118708069dea7317cb

                                                                                                                SHA1

                                                                                                                97ad8e5c5807b71695a726ddc054619cb28b7237

                                                                                                                SHA256

                                                                                                                5fd1a714a3c72c00cc9cbcdf8f100c2e8e8e475354c8c582d1711e737c398423

                                                                                                                SHA512

                                                                                                                2a7683514fa2c7142920aa274718bc60ee8f1a4136e4552e429354a8201d513e07f294ccfe8c2f859e179e339e56ac4572ef7c593247411c9779a8b76382ea93

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Gimemo.besk-bcc15645592a6add5c91d3d097e63e8775b949be72de33fd7b06c5197c9a40fe.exe
                                                                                                                Filesize

                                                                                                                1.9MB

                                                                                                                MD5

                                                                                                                cec938aba350d8d70d79407ec5c148bd

                                                                                                                SHA1

                                                                                                                f92898a9b87c739ad6896472275b4f53e927df48

                                                                                                                SHA256

                                                                                                                bcc15645592a6add5c91d3d097e63e8775b949be72de33fd7b06c5197c9a40fe

                                                                                                                SHA512

                                                                                                                382fb2e4e6228e9f37a7717591908e805e1c098fac0d5b119004b744023ff7641f3a4ade8eb210ace45302d23296a521e24e9205f19b27122b64207d3486d077

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Gimemo.cdqu-e633ebfa45af4939e7cdef26411dbc929554ce84c076cbd85ab4a19ec1f3abcd.exe
                                                                                                                Filesize

                                                                                                                436KB

                                                                                                                MD5

                                                                                                                f4f8696f22a4d908c027887166d8f8e0

                                                                                                                SHA1

                                                                                                                ddbb532c3d696493af2cbad98c722f592fc2f912

                                                                                                                SHA256

                                                                                                                e633ebfa45af4939e7cdef26411dbc929554ce84c076cbd85ab4a19ec1f3abcd

                                                                                                                SHA512

                                                                                                                cadd2879ea3a88b7c18bb7bd43299ad0517790dacb3604d63a85a8373e26eb42a0d0b3aa9ec44a34daf1750b7adffea16320ac33086e7377e31ecf07b3c83d94

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Locky.bim-fb0f5ff4760f6869a63fc6ed01d19241d83919b88f70343473cb6af014fa8954.exe
                                                                                                                Filesize

                                                                                                                248KB

                                                                                                                MD5

                                                                                                                26bfc108ec961ea10ca20afce4594d95

                                                                                                                SHA1

                                                                                                                4dedb5288ee87a245a4bcfe9451675badb4f9106

                                                                                                                SHA256

                                                                                                                fb0f5ff4760f6869a63fc6ed01d19241d83919b88f70343473cb6af014fa8954

                                                                                                                SHA512

                                                                                                                648d27cd78b94e629b73955643b847265bc64aab45f57f21bd2d7be214986a8c714f78611421c18da2ba13fd3db634407450ffaa73d04dba2dc3e28b2c116b84

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\00426\Trojan-Ransom.Win32.Vega.ap-b7f96fbb9844cac5c7f4ec966683f3564bbb9a2f453927e1c579dcb0154f5f83.exe
                                                                                                                Filesize

                                                                                                                812KB

                                                                                                                MD5

                                                                                                                5181f541a6d97bab854d5eba326ea7d9

                                                                                                                SHA1

                                                                                                                16d9967a2658ac765d7acbea18c556b927b810be

                                                                                                                SHA256

                                                                                                                b7f96fbb9844cac5c7f4ec966683f3564bbb9a2f453927e1c579dcb0154f5f83

                                                                                                                SHA512

                                                                                                                c282d9d6479c10fcc9fa6f674c901df1f1ad94b9354f6e427a7b445d0efad84efed6d7c29a0bc2a37b5ea07ee9a359f0e922d7c24f061258ae11fe4c44e9e4fa

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\00426\UDS-Trojan-Ransom.Win32.Crypmod.xvk-338dd780ea34a04619568845e036d97ff23758c54d65704c81b37a59c66275e7.exe
                                                                                                                Filesize

                                                                                                                5.6MB

                                                                                                                MD5

                                                                                                                362f5a087c17175ede18d1731a9a83f0

                                                                                                                SHA1

                                                                                                                fe7b4f0ebba453383bf10d7cd3b11dd8197796a1

                                                                                                                SHA256

                                                                                                                338dd780ea34a04619568845e036d97ff23758c54d65704c81b37a59c66275e7

                                                                                                                SHA512

                                                                                                                d5d2c00e1208eb62450e17e239b9816f291bec9e0cb219d7162bd56df54d7d8c12c2926773537885eed21d46cd91a294dca84fa5649a77f1f1d7258e6ff5763b

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\Desktop\HOW-TO-DECRYPT-4lrb9.txt
                                                                                                                Filesize

                                                                                                                3KB

                                                                                                                MD5

                                                                                                                e219d6141d6864bd23bbc64fca39a8a8

                                                                                                                SHA1

                                                                                                                f55127d37f440ea8509be76acce97805cfade756

                                                                                                                SHA256

                                                                                                                73a693216763031fb5e9c6c915f4b0f735252601b7b649e948eac181ace79bf2

                                                                                                                SHA512

                                                                                                                dc550054bfaf06f2f47c22ccbc8b00a6361b731683184880bb88122cc4c8e9fbc186a271fd203bc96eddbbe02c5d1c41603b4fd5e6a95db77cd4eddd3fe17b0f

                                                                                                                Download Submit

                                                                                                              • F:\$RECYCLE.BIN\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini
                                                                                                                Filesize

                                                                                                                129B

                                                                                                                MD5

                                                                                                                a526b9e7c716b3489d8cc062fbce4005

                                                                                                                SHA1

                                                                                                                2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                SHA256

                                                                                                                e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                SHA512

                                                                                                                d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                Download Submit

                                                                                                              • \??\c:\users\admin\appdata\local\temp\y_installer.exe
                                                                                                                Filesize

                                                                                                                203KB

                                                                                                                MD5

                                                                                                                b9314504e592d42cb36534415a62b3af

                                                                                                                SHA1

                                                                                                                059d2776f68bcc4d074619a3614a163d37df8b62

                                                                                                                SHA256

                                                                                                                c60c3a7d20b575fdeeb723e12a11c2602e73329dc413fc6d88f72e6f87e38b49

                                                                                                                SHA512

                                                                                                                e50adb690e2f6767001031e83f40cc067c9351d466051e45a40a9e7ff49049e35609f1e70dd7bb4a4721a112479f79090decca6896deac2680e7d107e3355dae

                                                                                                                Download Submit

                                                                                                              • \??\c:\users\admin\desktop\00426\trojan-ransom.msil.blocker.aw-f4ca0ba460f6423e6168c27d45dc590bbd79774be4aee3804e0b5ec961ab97fa.exe
                                                                                                                Filesize

                                                                                                                684KB

                                                                                                                MD5

                                                                                                                2743eb749514cba78be4cb413a013357

                                                                                                                SHA1

                                                                                                                4360a36d62d45ddab595161154624f5b97a77bac

                                                                                                                SHA256

                                                                                                                f4ca0ba460f6423e6168c27d45dc590bbd79774be4aee3804e0b5ec961ab97fa

                                                                                                                SHA512

                                                                                                                d2b84c8edc8ffb12a6bf56309bd69a40f7bd3dbf13f26d1961a14d8cdbd9999db2f8fe9847b303095a004bd2998c3d4e671bcffb0cbf1522ff7eb70ab13b272f

                                                                                                                Download Submit

                                                                                                              • memory/632-1865-0x0000000004B90000-0x0000000004BC4000-memory.dmp

                                                                                                                Filesize

                                                                                                                208KB

                                                                                                                Download

                                                                                                              • memory/632-1980-0x0000000007610000-0x0000000007676000-memory.dmp

                                                                                                                Filesize

                                                                                                                408KB

                                                                                                                Download

                                                                                                              • memory/736-946-0x0000000000D20000-0x0000000000E1E000-memory.dmp

                                                                                                                Filesize

                                                                                                                1016KB

                                                                                                                Download

                                                                                                              • memory/736-951-0x0000000005780000-0x000000000578A000-memory.dmp

                                                                                                                Filesize

                                                                                                                40KB

                                                                                                                Download

                                                                                                              • memory/1556-805-0x0000000004370000-0x00000000043A4000-memory.dmp

                                                                                                                Filesize

                                                                                                                208KB

                                                                                                                Download

                                                                                                              • memory/1556-818-0x0000000004540000-0x0000000004546000-memory.dmp

                                                                                                                Filesize

                                                                                                                24KB

                                                                                                                Download

                                                                                                              • memory/1760-80-0x00000251FA400000-0x00000251FA41E000-memory.dmp

                                                                                                                Filesize

                                                                                                                120KB

                                                                                                                Download

                                                                                                              • memory/1760-78-0x00000251FB380000-0x00000251FB3F6000-memory.dmp

                                                                                                                Filesize

                                                                                                                472KB

                                                                                                                Download

                                                                                                              • memory/1760-77-0x00000251FA3B0000-0x00000251FA3F4000-memory.dmp

                                                                                                                Filesize

                                                                                                                272KB

                                                                                                                Download

                                                                                                              • memory/1760-67-0x00000251E21F0000-0x00000251E2212000-memory.dmp

                                                                                                                Filesize

                                                                                                                136KB

                                                                                                                Download

                                                                                                              • memory/2004-60-0x000001992D420000-0x000001992D421000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2004-63-0x000001992D420000-0x000001992D421000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2004-59-0x000001992D420000-0x000001992D421000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2004-61-0x000001992D420000-0x000001992D421000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2004-58-0x000001992D420000-0x000001992D421000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2004-62-0x000001992D420000-0x000001992D421000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2004-53-0x000001992D420000-0x000001992D421000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2004-52-0x000001992D420000-0x000001992D421000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2004-51-0x000001992D420000-0x000001992D421000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2772-40-0x000001554DFF0000-0x000001554DFF1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2772-48-0x000001554DFF0000-0x000001554DFF1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2772-44-0x000001554DFF0000-0x000001554DFF1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2772-39-0x000001554DFF0000-0x000001554DFF1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2772-45-0x000001554DFF0000-0x000001554DFF1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2772-46-0x000001554DFF0000-0x000001554DFF1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2772-47-0x000001554DFF0000-0x000001554DFF1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2772-38-0x000001554DFF0000-0x000001554DFF1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2772-49-0x000001554DFF0000-0x000001554DFF1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2772-50-0x000001554DFF0000-0x000001554DFF1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/2940-94-0x0000000000020000-0x0000000000074000-memory.dmp

                                                                                                                Filesize

                                                                                                                336KB

                                                                                                                Download

                                                                                                              • memory/3112-1205-0x0000000001960000-0x0000000001972000-memory.dmp

                                                                                                                Filesize

                                                                                                                72KB

                                                                                                                Download

                                                                                                              • memory/3112-90-0x0000000000CE0000-0x0000000000EFC000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.1MB

                                                                                                                Download

                                                                                                              • memory/3112-1560-0x0000000001940000-0x0000000001948000-memory.dmp

                                                                                                                Filesize

                                                                                                                32KB

                                                                                                                Download

                                                                                                              • memory/4000-1370-0x0000000000400000-0x0000000005678000-memory.dmp

                                                                                                                Filesize

                                                                                                                82.5MB

                                                                                                                Download

                                                                                                              • memory/4000-1705-0x0000000000400000-0x0000000005678000-memory.dmp

                                                                                                                Filesize

                                                                                                                82.5MB

                                                                                                                Download

                                                                                                              • memory/4000-997-0x0000000000400000-0x0000000005678000-memory.dmp

                                                                                                                Filesize

                                                                                                                82.5MB

                                                                                                                Download

                                                                                                              • memory/4200-162-0x0000000005990000-0x0000000005BF0000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.4MB

                                                                                                                Download

                                                                                                              • memory/4200-188-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-163-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-164-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-174-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-168-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-170-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-166-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-173-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-176-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-546-0x0000000004F30000-0x0000000004FC2000-memory.dmp

                                                                                                                Filesize

                                                                                                                584KB

                                                                                                                Download

                                                                                                              • memory/4200-186-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-184-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-190-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-199-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-203-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-198-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-182-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-161-0x00000000053E0000-0x0000000005984000-memory.dmp

                                                                                                                Filesize

                                                                                                                5.6MB

                                                                                                                Download

                                                                                                              • memory/4200-192-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-159-0x0000000005140000-0x00000000053A0000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.4MB

                                                                                                                Download

                                                                                                              • memory/4200-180-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-178-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-201-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-207-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-209-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4200-206-0x0000000005990000-0x0000000005BE9000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.3MB

                                                                                                                Download

                                                                                                              • memory/4432-144-0x0000000001A30000-0x0000000001A38000-memory.dmp

                                                                                                                Filesize

                                                                                                                32KB

                                                                                                                Download

                                                                                                              • memory/4432-123-0x000000001C1E0000-0x000000001C27C000-memory.dmp

                                                                                                                Filesize

                                                                                                                624KB

                                                                                                                Download

                                                                                                              • memory/4432-108-0x000000001C7A0000-0x000000001CC6E000-memory.dmp

                                                                                                                Filesize

                                                                                                                4.8MB

                                                                                                                Download