gandcrab | d7db27fbc0721000c168e3bf726bb9bd7f10c18c7ed49d3618e6b31e50191ac9

Analysis

max time kernel
60s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2024 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RNSM00408.7z
Size

30.3MB
MD5

487d488a75593b71d0fc2b45a1f7d730
SHA1

fa9519a8b9f19146202340447fe8a4575dec4677
SHA256

d7db27fbc0721000c168e3bf726bb9bd7f10c18c7ed49d3618e6b31e50191ac9
SHA512

e0147341d939b6f108da49322017faf10b621cdf190b7ba1d2a986aace5caed931cf8617b29415c46af47e755654b54ce88bb84edd22f086d21095f169a280d9
SSDEEP

786432:LK/D9g7EtZFDeJQZWIaFA4W2LKU12ZOGuTmvWBeOtMbXQ/:GBDtZEZFzV9NuWg4MbXi

Score

10^/10

gandcrab xorist aspackv2 backdoor discovery ransomware themida upx

Malware Config

Signatures

Detected Xorist Ransomware 3 IoCs

resource	yara_rule
behavioral1/memory/3200-299-0x0000000000400000-0x000000000066F000-memory.dmp	family_xorist
behavioral1/memory/3200-3214-0x0000000000400000-0x000000000066F000-memory.dmp	family_xorist
behavioral1/memory/4112-3235-0x0000000000400000-0x000000000066F000-memory.dmp	family_xorist

GandCrab payload 2 IoCs

resource	yara_rule
behavioral1/memory/1148-196-0x0000000000400000-0x0000000000460000-memory.dmp	family_gandcrab
behavioral1/memory/1148-202-0x0000000000700000-0x0000000000717000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Gandcrab family
gandcrab
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0007000000023e79-2355.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
1508	HEUR-Trojan-Ransom.MSIL.Encoder.gen-4e96bc3985a6bbc0edcc12d1419597b0d3989c6ff3f38884d7a28ff482a1fcda.exe
4524	HEUR-Trojan-Ransom.MSIL.Makop.gen-9622591e352c6c972335d1253301a82b82a54a1fa36065a269bb2552edaab0a8.exe
3296	HEUR-Trojan-Ransom.Win32.Blocker.gen-4e2aa3d570b2e8c60bcd80195037ea40236d0bc3d4179aed6adca240523667f3.exe
4448	HEUR-Trojan-Ransom.Win32.Encoder.gen-927d883586d52f97c7073b1e6d45ca9c303c49de0d6789776cae8f0e16bbdb4c.exe
1148	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-6d2334d382797f2f181ce2c1cda7b49bffb43fa0f522576d8d48b21348ed393e.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/5648-3353-0x0000000000BA0000-0x0000000001243000-memory.dmp	themida

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
56	bitbucket.org
57	bitbucket.org
60	iplogger.org
61	iplogger.org

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023cc9-208.dat	upx
behavioral1/memory/3200-299-0x0000000000400000-0x000000000066F000-memory.dmp	upx
behavioral1/files/0x0007000000023d02-383.dat	upx
behavioral1/memory/4112-440-0x0000000000400000-0x000000000066F000-memory.dmp	upx
behavioral1/memory/3460-3205-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/3200-3214-0x0000000000400000-0x000000000066F000-memory.dmp	upx
behavioral1/memory/4112-3235-0x0000000000400000-0x000000000066F000-memory.dmp	upx
behavioral1/memory/3460-3996-0x0000000000400000-0x0000000000428000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2580	1148	WerFault.exe	115
3220	2804	WerFault.exe	124

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Makop.gen-9622591e352c6c972335d1253301a82b82a54a1fa36065a269bb2552edaab0a8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Blocker.gen-4e2aa3d570b2e8c60bcd80195037ea40236d0bc3d4179aed6adca240523667f3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Encoder.gen-927d883586d52f97c7073b1e6d45ca9c303c49de0d6789776cae8f0e16bbdb4c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-6d2334d382797f2f181ce2c1cda7b49bffb43fa0f522576d8d48b21348ed393e.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3992	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
4884	taskmgr.exe
4884	taskmgr.exe
4884	taskmgr.exe
4884	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
4972	taskmgr.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4896	7zFM.exe
4972	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeRestorePrivilege	4896	7zFM.exe
Token: 35	4896	7zFM.exe
Token: SeSecurityPrivilege	4896	7zFM.exe
Token: SeDebugPrivilege	3296	taskmgr.exe
Token: SeSystemProfilePrivilege	3296	taskmgr.exe
Token: SeCreateGlobalPrivilege	3296	taskmgr.exe
Token: SeDebugPrivilege	3516	taskmgr.exe
Token: SeSystemProfilePrivilege	3516	taskmgr.exe
Token: SeCreateGlobalPrivilege	3516	taskmgr.exe
Token: 33	3296	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3296	taskmgr.exe
Token: SeDebugPrivilege	4884	taskmgr.exe
Token: SeSystemProfilePrivilege	4884	taskmgr.exe
Token: SeCreateGlobalPrivilege	4884	taskmgr.exe
Token: 33	3516	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3516	taskmgr.exe
Token: SeDebugPrivilege	4972	taskmgr.exe
Token: SeSystemProfilePrivilege	4972	taskmgr.exe
Token: SeCreateGlobalPrivilege	4972	taskmgr.exe
Token: 33	4884	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4884	taskmgr.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	1508	HEUR-Trojan-Ransom.MSIL.Encoder.gen-4e96bc3985a6bbc0edcc12d1419597b0d3989c6ff3f38884d7a28ff482a1fcda.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4896	7zFM.exe
4896	7zFM.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3516	taskmgr.exe
3296	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3296	taskmgr.exe
3516	taskmgr.exe
3296	taskmgr.exe
3516	taskmgr.exe
3296	taskmgr.exe
3516	taskmgr.exe
3296	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
4884	taskmgr.exe
3516	taskmgr.exe
4884	taskmgr.exe
3516	taskmgr.exe
4884	taskmgr.exe
3516	taskmgr.exe
4884	taskmgr.exe
4884	taskmgr.exe
3516	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3296	taskmgr.exe
3516	taskmgr.exe
3296	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3296	taskmgr.exe
3516	taskmgr.exe
3296	taskmgr.exe
3516	taskmgr.exe
3296	taskmgr.exe
3516	taskmgr.exe
3296	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
4884	taskmgr.exe
3516	taskmgr.exe
4884	taskmgr.exe
3516	taskmgr.exe
4884	taskmgr.exe
3516	taskmgr.exe
4884	taskmgr.exe
4884	taskmgr.exe
3516	taskmgr.exe
4884	taskmgr.exe
3516	taskmgr.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 3516	3296	taskmgr.exe	101
PID 3296 wrote to memory of 3516	3296	taskmgr.exe	101
PID 3516 wrote to memory of 4884	3516	taskmgr.exe	102
PID 3516 wrote to memory of 4884	3516	taskmgr.exe	102
PID 4884 wrote to memory of 4972	4884	taskmgr.exe	103
PID 4884 wrote to memory of 4972	4884	taskmgr.exe	103
PID 3848 wrote to memory of 3268	3848	powershell.exe	110
PID 3848 wrote to memory of 3268	3848	powershell.exe	110
PID 3268 wrote to memory of 1508	3268	cmd.exe	111
PID 3268 wrote to memory of 1508	3268	cmd.exe	111
PID 3268 wrote to memory of 4524	3268	cmd.exe	112
PID 3268 wrote to memory of 4524	3268	cmd.exe	112
PID 3268 wrote to memory of 4524	3268	cmd.exe	112
PID 3268 wrote to memory of 3296	3268	cmd.exe	113
PID 3268 wrote to memory of 3296	3268	cmd.exe	113
PID 3268 wrote to memory of 3296	3268	cmd.exe	113
PID 3268 wrote to memory of 4448	3268	cmd.exe	114
PID 3268 wrote to memory of 4448	3268	cmd.exe	114
PID 3268 wrote to memory of 4448	3268	cmd.exe	114
PID 3268 wrote to memory of 1148	3268	cmd.exe	115
PID 3268 wrote to memory of 1148	3268	cmd.exe	115
PID 3268 wrote to memory of 1148	3268	cmd.exe	115

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2468	attrib.exe
5580	attrib.exe
6132	attrib.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00408.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4896

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /1
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /1
    3⤵
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /1
      4⤵
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:4972

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Users\Admin\Desktop\00408\HEUR-Trojan-Ransom.MSIL.Encoder.gen-4e96bc3985a6bbc0edcc12d1419597b0d3989c6ff3f38884d7a28ff482a1fcda.exe
    HEUR-Trojan-Ransom.MSIL.Encoder.gen-4e96bc3985a6bbc0edcc12d1419597b0d3989c6ff3f38884d7a28ff482a1fcda.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\satan.exe
      "C:\Users\Admin\AppData\Local\Temp\satan.exe"
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\satan2.exe
      "C:\Users\Admin\AppData\Local\Temp\satan2.exe"
      4⤵
      PID:4112
- - C:\Users\Admin\Desktop\00408\HEUR-Trojan-Ransom.MSIL.Makop.gen-9622591e352c6c972335d1253301a82b82a54a1fa36065a269bb2552edaab0a8.exe
    HEUR-Trojan-Ransom.MSIL.Makop.gen-9622591e352c6c972335d1253301a82b82a54a1fa36065a269bb2552edaab0a8.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4524
- - C:\Users\Admin\Desktop\00408\HEUR-Trojan-Ransom.Win32.Blocker.gen-4e2aa3d570b2e8c60bcd80195037ea40236d0bc3d4179aed6adca240523667f3.exe
    HEUR-Trojan-Ransom.Win32.Blocker.gen-4e2aa3d570b2e8c60bcd80195037ea40236d0bc3d4179aed6adca240523667f3.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3296
- - C:\Users\Admin\Desktop\00408\HEUR-Trojan-Ransom.Win32.Encoder.gen-927d883586d52f97c7073b1e6d45ca9c303c49de0d6789776cae8f0e16bbdb4c.exe
    HEUR-Trojan-Ransom.Win32.Encoder.gen-927d883586d52f97c7073b1e6d45ca9c303c49de0d6789776cae8f0e16bbdb4c.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4448
- - C:\Users\Admin\Desktop\00408\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-6d2334d382797f2f181ce2c1cda7b49bffb43fa0f522576d8d48b21348ed393e.exe
    HEUR-Trojan-Ransom.Win32.GandCrypt.gen-6d2334d382797f2f181ce2c1cda7b49bffb43fa0f522576d8d48b21348ed393e.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1148
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 488
      4⤵
      Program crash
      PID:2580
- - C:\Users\Admin\Desktop\00408\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-a5229db02ad2a3349d1681c5fedf7b331e51a58dbcd1ebca5ae05ccd01e1d070.exe
    HEUR-Trojan-Ransom.Win32.PolyRansom.gen-a5229db02ad2a3349d1681c5fedf7b331e51a58dbcd1ebca5ae05ccd01e1d070.exe
    3⤵
    PID:2120
- - C:\Users\Admin\Desktop\00408\Trojan-Ransom.Win32.Blocker.kpuo-fd26a2febed9c4e1713389801038e4944a17701a62e22d8c7b14658dfb52eb8a.exe
    Trojan-Ransom.Win32.Blocker.kpuo-fd26a2febed9c4e1713389801038e4944a17701a62e22d8c7b14658dfb52eb8a.exe
    3⤵
    PID:2804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 532
      4⤵
      Program crash
      PID:3220
- - C:\Users\Admin\Desktop\00408\Trojan-Ransom.Win32.Blocker.mpxk-2bba0e165e5788283a362b5ba764a211647840dfa0e4854515ba69a2f5de7255.exe
    Trojan-Ransom.Win32.Blocker.mpxk-2bba0e165e5788283a362b5ba764a211647840dfa0e4854515ba69a2f5de7255.exe
    3⤵
    PID:2040
- - C:\Users\Admin\Desktop\00408\Trojan-Ransom.Win32.Blocker.mssz-259e54a16e192d2d330b16963b3a9fa66c9a80b9cb97a47e58ddf63501e5eb0e.exe
    Trojan-Ransom.Win32.Blocker.mssz-259e54a16e192d2d330b16963b3a9fa66c9a80b9cb97a47e58ddf63501e5eb0e.exe
    3⤵
    PID:1480
- - C:\Users\Admin\Desktop\00408\Trojan-Ransom.Win32.Blocker.mstl-b812c73e30983bc80586c4eb63340f3f8ed392624eb6f294fde0b0249d2debb5.exe
    Trojan-Ransom.Win32.Blocker.mstl-b812c73e30983bc80586c4eb63340f3f8ed392624eb6f294fde0b0249d2debb5.exe
    3⤵
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
      4⤵
      PID:980
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"
        5⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CDS.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CDS.exe
        6⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\crypted.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\crypted.exe"
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\CDS.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\CDS.exe
        8⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\crypted.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\crypted.exe"
        9⤵
        
        PID:6104
- - C:\Users\Admin\Desktop\00408\Trojan-Ransom.Win32.Crypmodadv.xux-2276db097f6d181e1013a6c1e53d554c67373bcc138b877a6d481d40aba10e7d.exe
    Trojan-Ransom.Win32.Crypmodadv.xux-2276db097f6d181e1013a6c1e53d554c67373bcc138b877a6d481d40aba10e7d.exe
    3⤵
    PID:4448
- - C:\Users\Admin\Desktop\00408\Trojan-Ransom.Win32.Delf.st-47d862ac539fb97ac01f51ad5ea686e3bafe7c3888219fc464ed0947c1e79080.exe
    Trojan-Ransom.Win32.Delf.st-47d862ac539fb97ac01f51ad5ea686e3bafe7c3888219fc464ed0947c1e79080.exe
    3⤵
    PID:3460
- - C:\Users\Admin\Desktop\00408\Trojan-Ransom.Win32.Encoder.kuo-d9ebf0ddbb51aaf9c8af02fb373e1471084fc7e9538737a54c899127fe71252e.exe
    Trojan-Ransom.Win32.Encoder.kuo-d9ebf0ddbb51aaf9c8af02fb373e1471084fc7e9538737a54c899127fe71252e.exe
    3⤵
    PID:1756
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D481.tmp\D482.tmp\D483.bat C:\Users\Admin\Desktop\00408\Trojan-Ransom.Win32.Encoder.kuo-d9ebf0ddbb51aaf9c8af02fb373e1471084fc7e9538737a54c899127fe71252e.exe"
      4⤵
      PID:1636
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM explorer.exe
        5⤵
        Kills process with taskkill
        
        PID:3992
    - - C:\Windows\system32\attrib.exe
        
        attrib +R "Email.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2468
    - - C:\Windows\system32\attrib.exe
        
        attrib +R "Dateien\Windows.exe"
        5⤵
        Views/modifies file attributes
        
        PID:5580
    - - C:\Windows\system32\attrib.exe
        
        attrib +R "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
        5⤵
        Views/modifies file attributes
        
        PID:6132
- - C:\Users\Admin\Desktop\00408\Trojan-Ransom.Win32.Foreign.olkx-24ee1a33b2abf30897100dc8d6e50f8e72e552de9af8e4b278de8f9dabdb48f3.exe
    Trojan-Ransom.Win32.Foreign.olkx-24ee1a33b2abf30897100dc8d6e50f8e72e552de9af8e4b278de8f9dabdb48f3.exe
    3⤵
    PID:2668
- - C:\Users\Admin\Desktop\00408\Trojan-Ransom.Win32.Petr.atr-00d25faaaaa1178817d40ac2ef1099fa517e9e716ecedc588c86cd6ed37eb356.exe
    Trojan-Ransom.Win32.Petr.atr-00d25faaaaa1178817d40ac2ef1099fa517e9e716ecedc588c86cd6ed37eb356.exe
    3⤵
    PID:916
- - C:\Users\Admin\Desktop\00408\Trojan-Ransom.Win32.Phpw.acx-30ad38c06eb1e40c4b026df32b4f05a35f9e450cb17c15220d2266bf983f5418.exe
    Trojan-Ransom.Win32.Phpw.acx-30ad38c06eb1e40c4b026df32b4f05a35f9e450cb17c15220d2266bf983f5418.exe
    3⤵
    PID:3308
- - C:\Users\Admin\Desktop\00408\Trojan-Ransom.Win32.PornoAsset.cuof-b01132832c71bc2dd3b8a2c9b0ead14d02e89e2e7df3e32ae649d3b60abea4d8.exe
    Trojan-Ransom.Win32.PornoAsset.cuof-b01132832c71bc2dd3b8a2c9b0ead14d02e89e2e7df3e32ae649d3b60abea4d8.exe
    3⤵
    PID:1796
- - C:\Users\Admin\Desktop\00408\VHO-Trojan-Ransom.Win32.Blocker.gen-587f997dc021a5a504902c97ca0be84fba7f1f169c4295f66e1eab3202d5b955.exe
    VHO-Trojan-Ransom.Win32.Blocker.gen-587f997dc021a5a504902c97ca0be84fba7f1f169c4295f66e1eab3202d5b955.exe
    3⤵
    PID:5648
- - C:\Users\Admin\Desktop\00408\VHO-Trojan-Ransom.Win32.Cryrar.gen-a42fb80c93138d0c05b283e2e16ac13db46a7f12ea5f33ef7585f09747f92abe.exe
    VHO-Trojan-Ransom.Win32.Cryrar.gen-a42fb80c93138d0c05b283e2e16ac13db46a7f12ea5f33ef7585f09747f92abe.exe
    3⤵
    PID:5984
  - - C:\Windows\system32\net.exe
      net.exe stop SysMain
      4⤵
      PID:5420
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SysMain
        5⤵
        
        PID:6124
  - - C:\Windows\system32\net.exe
      net.exe stop WebClient
      4⤵
      PID:6116
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop WebClient
        5⤵
        
        PID:4916
  - - C:\Windows\system32\net.exe
      net.exe stop SessionEnv
      4⤵
      PID:2888
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SessionEnv
        5⤵
        
        PID:1956
  - - C:\Windows\system32\net.exe
      net.exe stop CscService
      4⤵
      PID:6076
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop CscService
        5⤵
        
        PID:4612
  - - C:\Windows\system32\net.exe
      net.exe stop BITS
      4⤵
      PID:64
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop BITS
        5⤵
        
        PID:5728
  - - C:\Windows\system32\net.exe
      net.exe stop netprofm
      4⤵
      PID:5368
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop netprofm
        5⤵
        
        PID:5344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1148 -ip 1148
1⤵
PID:2840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2804 -ip 2804
1⤵
PID:428

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x468
1⤵
PID:1004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
698d13b58064ebf7a342625a1d997187

SHA1
464309331098f1671fcde03afc3d9aa407eb7d58

SHA256
1d6b0a7482ba20cf172c1936071100fc2da71d2c82d58bf1e3ad71c5a91b6ef2

SHA512
9a61fa746a4c0e229118758ce403d2b31b4b799ff4b4cc9f53a93ae5a2b3247efef11cf59230bdd5bd8acbc391de8b3d19683be25bc3759e6248460a6cd4490d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
5a6d1c5b9b89a7ef08219cdd15638f3d

SHA1
fac944dea5a021ec487380247d9c6a58d11996e2

SHA256
4c0ba65fecd991ca0869da5fd06112a35fc51f745f4dbce5e8e00bfe86824f48

SHA512
394c28581b78111ee11b3001875684167354a29e6b56df85d9bf95799769969767d813f7b9e289564129be8b5e1228ba1b02a5dc9c7e60eda101d6536450973c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark2x.gif.Hacker zasifroval zaplat.crypt

Filesize
26KB

MD5
ff42156e6590fa450c6f90d1aa37e2f2

SHA1
b4cee2a47e109d748b2652d681ee874b3e69357b

SHA256
2fb3bc95203ff5f989c8e5ecaef780984be2073e4aedb28514c781f3a9e110b8

SHA512
c4a301e94968110eeabf121061dd537a1e969d376f8230a04ffee16ce7c71a5a453c25a85a48aed7373ec54d0641c4a6c9aeb474ab340b62c711ec1a37c2ea39

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png

Filesize
7KB

MD5
5101b6fe61134337f48e29f6eeaaa9e5

SHA1
0a746c6b360f0f0e7979d80014d97635ea5864fa

SHA256
38adb229a1a76729c38d82af32888dc13afe2b226ba9ec674be31a97155311a1

SHA512
5fe720fbe6f559276bf9b54c547b1304f01f292444544fc3fd6f65792ecbfb96e21c28d92cd13d740017aa2b45d4fa3de778680a25a40449e689f0d989a62431

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover.png.Hacker zasifroval zaplat.crypt

Filesize
388B

MD5
bebc5506da6687d4b79afd57df73cdd6

SHA1
46a9747525383f2df484fa833bf6a73eaaa9a813

SHA256
e7dd8cc8018f0b1d22e12b108384734fdc55e1f0a71b07da593060f55834b4b2

SHA512
51be2aea008c681eb6d5e65d9cdd2c4ac42d3f8be80b0de450248f195073d22aff21771303d8e6baf106915b4d2518843a4557af7d8afb6fae7da264399c0787

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
381baf311534588e274564af334ca09b

SHA1
10566e94e316d8cdf44a6dae7b7fff9a27b1e982

SHA256
30f6adbfd91da041ce3039bde37a0179f021991073f320d9ba28adf6b7f9e5ce

SHA512
e0ac1614bb2e80cd136294c6f6a90389afafa0fb96327f0db9fa550daaac526e7eb848b79c6137872fc39d64a91ef348337295b2bc9fef94555b68337ba132d8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
07da780a84c54172ba2c6d888b054db7

SHA1
1914b9d373fa994dc9abada40c02847d55fbf145

SHA256
8bf93a832a8a5c02bfa107a33003c1f5c78a35266509b72a4e288c7752fee6ab

SHA512
b4cf2aabb437ba926c939b0b41ffcf560ca9fdecdde824b8ec1e23ce1af4a427ee21132de2d8081444cf37a1be3c1b641dfd439493acf8e37d0bc552999ffa9d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png

Filesize
1KB

MD5
90f9260b4f9dada9f74f1d467a41d60f

SHA1
51d1101e60a8f9fc2e44b22c7e53a73d2badb383

SHA256
b72f0c22455f0e83e6eeb2e61752c38874ddb158e5fb6080888401cd684f88d5

SHA512
655e95a019e1d665e1ffee19fd724cb5d9859475bfaeb26c57e4fc61801b4402d7b5f95808e0368ac04cdd64dd6ef2d9976646c80895d924864d541cd1d1b5d0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_2x.png

Filesize
611B

MD5
8e2a0a8a893ac2079ad9d381492bd37f

SHA1
7be199de923fe9ab9364053fdf2de118759b4d91

SHA256
c56b39aa45bc60be7ccb97df8b9daa657a2d63ce7d853a8cb2879c272de8ff09

SHA512
75aa23a565282a81a4558ce1a1e8e8c0ebb4aa13a23e8bfb528cefcaee21b9219e2147606e3ae316f77ac4620686fd002b566ae5049705455e2ea8beec5c426e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
714b048e98cd6ec228da4f5d2bd3939a

SHA1
f980617a989585147741671b4e9b6fd2b6bef236

SHA256
5e447d97b13731ab2c1728fd7aaf0c92acd25dab6a3fc0508e410661c5935a91

SHA512
44e96376884bf9105a283fd94c4a1bb72d0933a97c8a8594b5214b0da52c00ebf83b897a8bc551812b576af144a5e9311b224e709b9713c7ed44157ff1f093fe

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
b239aea4c0bb680cd6a4e629384a9932

SHA1
adc97c1a239780520ff9ac28d7148105626d2dcb

SHA256
0fca8e5d56cf762b4d3185c5ff91b5940120a22b63f646da4b91f56f77f4f5bd

SHA512
29884a167bfcc9935b7f7dcd2432e6281b1c6dc641a15e54d6a42e6ba045fae9df5b414db4a2961405edc43f58c406f4bbb4c553c488258f74e9160b040d6ab5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
d3054165180c9543dbe82a708c54d280

SHA1
d7255bb7a822c2155a83fbb2e3ce04e08399f2bf

SHA256
3195631685e825d0c996c3bbf68066d410047710a5770af067b812c7915919a3

SHA512
6c3a0dc76d6a703e9b57725e4f9ba98a6c8e2bf0bb00c8226b6b1be84dee4f6656374d944a128594a4286f2616189dd435bd790e95e49455d1cfbc5bbd47c023

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
0957759ed889b5243ef89a8aa734ee88

SHA1
7d7c2bef122ff4b3217f8aa24778ed18e931a45c

SHA256
94463870045d636eb9efe057bf0fdfee89a4c78e7aff4abae7f46874730e4951

SHA512
d2369d306e2dd10663c1380168dfad8a4bd940f841b9cf2221b60400cfee596f441bb6c38d9d2939e7a457889d96bd6125dc1346ce79ea707e337836a9fdf2e8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
180863c2f9b46ae64c7d5e62b1fd5e4a

SHA1
2c1498fbc918a5769676a50124d002532f03a718

SHA256
701e6566881504066d6fc8e1f96688b787c2e0fc8a15695a06268b0757bdf6e0

SHA512
a465bc092f89e4dc30f28a7a0581ca09859f04ac02731c4344e02bdbdece96d4837cdcae7572d8fc0819093d801e199bc5c451c42be87afbb1e3809e790a26bb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected] zasifroval zaplat.crypt

Filesize
370B

MD5
ef4c20b0f4a34933f0b651a4852aae2a

SHA1
a2aaee93afa319136ea54209e413fbd329b4d306

SHA256
17ef9eabe4c2ebb67b565cb52dae25356fac68a968679d86493185b4fa2d56a7

SHA512
48b315650800bc2046b02db62d975fb60daf98e98c1e0e26a286f595e4c3a387dbfeea1bf28eaef0439aa28c5e4328cf216c96ef02b584fb9ec217de8d85beb8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\text_2x.png.Hacker zasifroval zaplat.crypt

Filesize
1024B

MD5
4cbed78f957e01cabef9c276131232ac

SHA1
88f97d7ff0add67b5babf8b59aca06d31c37f589

SHA256
b4365149cf6c0fa1a556a99894dbe50e470f88e74028f4935813e9d1e5561772

SHA512
bb57904bf68b593b3c9a65e3684aa09f9e527084bc426b9efe01a440df3d4afdbe365d9ebc3ffa2fd8b9132f52bf05e69fcf02c3cd9bd9f92cbd045c5a7a4df6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png

Filesize
1KB

MD5
578fcd6727ee486850b4e0d822793d1a

SHA1
db7b8a6086d2249d29b2018f4406208631c2aa90

SHA256
4f76a7e17b658f4065265a714fac2a8ff82db2942ca76aab18b2335f66f326fb

SHA512
4d5ea607b621f396ffd07885c8ffdbed87261818865a9c00e250db201c66083b805bf7dd1fda35a7457f58390501f230e977dad3f6872a95c5e3c58f30a84292

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
b660f52085c85f020cdc2b9a9a90866a

SHA1
ba56594fd3eff235c56782da00f72a1997efab44

SHA256
283cf32cd4d388dc116b78862a1c92675eac90453bd0e869cf9dd9be822c090a

SHA512
b0006172512e2f5e69a0e2131d01c4e5ba41a965120c305d7e05d7365e8829df191253d5721ccc47bc3e1bf247da1b5865429023ef027c2fff37c9102666a66a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_ie8.gif

Filesize
7KB

MD5
d893bb154ef91179c34b33401f15d81c

SHA1
1a002c5721dbfeb52ead2877d676e58b89107941

SHA256
5b7d50e3f05f46a3ea4d705086731c8e906aedb240d4c574e481fa0e64cb9eed

SHA512
69718e6a70654fd4ddd450f858f1a7cdfc540bdb74d62cc07c34e3e3ece9596282ffc72daee32a63726bf9fe3bbca00d4cebc0b9217cf8a389b37c525addd011

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_retina.png.Hacker zasifroval zaplat.crypt

Filesize
15KB

MD5
644bdc0708cc6259bed0aa5a96eba0f9

SHA1
5288e803363ad1c30bc138f8dbebb26a0e0d9525

SHA256
394140a42d5f5bc3d31b0c37131edcd0f8fd1f9945a3645d869b219776f3305a

SHA512
c4b07dfc33e2eeb9e245969de7baedf67466a28a8389a9ad5101fe4e545736f266037cbd2e6cde05ab49bf0619a6f6e72f89990b215fbc175ec67c5946f67f8b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
eb4740bae77b7e578f58dcf737e5f2f4

SHA1
f298bd13bb677a1023c95c101ad666f72e0e9c23

SHA256
a80d6ac108e5219e4d3c5800fa5ef965ab7a45550459b3eea84da27c2f40989f

SHA512
89338a998a510f613480fd8e80a92848ee2ebd20ca999e90e3cc69ae334a3397675678f0fa8ed5960964f50dfb73772e61483876023cb1c7b83f27fed111e53c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png

Filesize
7KB

MD5
c699fb3c9b964849e1d298359cf24f9f

SHA1
475748c7601194b42a697deda349503410d03613

SHA256
8e1182e4b39057058fbf74ed9fc9f7c871f291597dc99d05e20f55f729d1b403

SHA512
12a726e4c131f943c728052adca1a40b946d1d725cd4002490e8447a10dcfac18cf5a3711f187fcce67777b62f664c090c8be8e275edccd39ccb705edaff4aa8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png.Hacker zasifroval zaplat.crypt

Filesize
17KB

MD5
6937aacf8294e734098fff5232d0e5eb

SHA1
e6683780968c952de8a221797c308c17d0556d5c

SHA256
77df8a7e4fc3cfa273adc61ab79440359b17a2222f4e09ef07ceaf222fe3016f

SHA512
23c62e05067379260c5f1330555594fdb033e495af7bfdd7ee6072c8fdc63add84f2ff5df0ead720e50a4499eb6917933bdbe3eed56c45df2baf8343166af86d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_retina.png.Hacker zasifroval zaplat.crypt

Filesize
15KB

MD5
7b3cbb9f00288e8746157406687c3c2d

SHA1
37de0d47f4af655c7a09c6715a8d3e8db020657d

SHA256
825e194b3b84703c951492e7225123d2ea671eadc1b9b8a491cba39c92a83874

SHA512
40edbd4d907bed9bdb1b766cf898df459232b89fc8ea38d638588c7618c50790cd111b9776e10788a85e441013c110a6a83bc9e1ce8e24304ee64b640c116f31

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png.Hacker zasifroval zaplat.crypt

Filesize
19KB

MD5
8ef942a206fac1a09b52f4c817652830

SHA1
4d04d1b8420be1c1668e998b9f635919fb8898da

SHA256
0f057410ed2479f9136ff83aa79f669b5c475d1b15e73716a3603ed109741772

SHA512
f24a50853dbccf151afa846b4c87322b4b508124b16d54837b09512dc3848af4a7f43f8a602282308a0023a58956521b29a4e3c3659cfa4f3ace60b35f56cf8a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\new_icons.png

Filesize
8KB

MD5
a56ea0b1736ebe1acc6b8e2aefe4fa2d

SHA1
fd08f0020687a9bfcac5a6dadec88992854cbe8f

SHA256
82b30766488001d3a4a08ecbd01745a036d74289a2b6e2aa0dc7dbc58ff6642c

SHA512
0e5f667957da11640f0346107b07189d045a8c273df3d85574589b5258c0ab6aa9326c41498edfd361531b1943491dcaeef61f06e107e9216bde545050afde1f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\new_icons_retina.png

Filesize
17KB

MD5
5b1072cd9f09bc98de420bafd63a62fd

SHA1
0c34a0744aceac2232f73bfee838d8a02e650ee1

SHA256
934acfcf6d43363fd224b95148d8bfc4ca802350d9be592ece8a1efd076e0b0c

SHA512
8e2e10cbb670bdd55f6a0ccc6d95b80a5142877e09d7693b8074358de32cbfcc59f880eb0a92bdae35248bee0f791f4d5881428fab15482532f8dd0f33be357d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_ie8.gif.Hacker zasifroval zaplat.crypt

Filesize
7KB

MD5
0aa4e81ecae248a9a188dd121a7bc0e1

SHA1
451cc83a9ffe3a64f165f7959d0eeeebb8d8fb5a

SHA256
9f566549054639e6501ff3f5004db807423c30497ed00e2b50e3b85520857620

SHA512
2d4ce724a381eae888ee5f9d40459f6949d202640e371e5328a0ed69ef19531201d5f6454f601274c3c685e744a08f168176e8965fc332cb961d55472193c499

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_pattern_RHP.png

Filesize
179B

MD5
d1be6225c7f4b5209ea148f64a9478d9

SHA1
277d1e98c338dc14f381a89d7b547ce301755d45

SHA256
3e54902d6dd3b935b44068bf57edd01db557da20104e6c6bb3f9aff5ebe7083a

SHA512
0376cdd685e55c70acb404d3c7a96089d5553cf0f0f80d18ab35af152b7a5709b17a419834b656dced3d8c4d51bbf4cbf13d4055b40ffe9db3d13eff56facdaf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_patterns_header.png

Filesize
703B

MD5
e1f767feff8c53b34b13686f031adc0e

SHA1
5c6ac6f7a96f430793094b91199c219e6e2c5d24

SHA256
47dd46c43680ab3667b7f34d74d33483707b5f88dffcb3368e9d7d4e89c0541f

SHA512
8f5049acaa809b1aaf233b143e706726fe0a4dfbbcb5c880ea907bf31d9082c6919e616bc2f818ab805158803bf0403b17600976987f869622199d82ffe01701

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations_retina.png

Filesize
19KB

MD5
8fc057a0f65d298209ae80c9bc5fef6c

SHA1
7858a86b1d0c0ffe3dfcd50ae7cf3564497151c9

SHA256
52ac8d17a59ecc7cd77bb8aeea28a5bcea4df375b641c2b9cc1a2c9317b86f44

SHA512
6a62be505f1957fb1bd65e44f2cc3913513956ad1cdc86ac6396e68460f1f043ad2a721fb608bf19e89e83f37ddc89f12ac834cc93d78e8cd4582c1e51c3a6dc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\new_icons.png.Hacker zasifroval zaplat.crypt

Filesize
8KB

MD5
2c77e4cca685bddc58536921e16690c3

SHA1
3eae4ea4bc34a5101962463bb78f7d0d4a53a7b6

SHA256
90f49d800766db4c15b2120f97f32e92adfda65a0c895e04a064458095262978

SHA512
1553c56e0b0e09be603114e3ef311fd1f8f46a3c2251609e4126a2b8fa575758b91f182e302c502642354ce20295a6e137a075447ed0bb9cec55946b51a3c16f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\new_icons_retina.png

Filesize
17KB

MD5
5e1a827090ff531e4bddfd3c214668c8

SHA1
e6982b296dc36002f8e83d81c40239c8e9c752dd

SHA256
e0e17a5c0a22e587f1b7b1dcc03a46014e328d7eb520efec6a2ee3464ac97a9a

SHA512
8f342daed47bc610f94cdd01aa58e916af211f7cb28926aa8e23d8461548c6524068c8d1c6d72a9e7cf24774a59f3ae33a76dab1f1b907f3f64b1a7fe2b9a6b8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.pdf.Hacker zasifroval zaplat.crypt

Filesize
379KB

MD5
f04c5dc888a890acdde756e61f154727

SHA1
0148374b9c86b28373ec633c40bfaabd902e0b67

SHA256
22bef9a0bc8647486d9fe3df3d560759938a4781e8477f636ac1e7230f79b84a

SHA512
d8df5c04e6749a5d862fff09c1332e8bda7404ba6e5e36fe6ac969824b0d8d980387c6c159f870ece73c58e25ab69866d5afabc7823812633502884dd5d89b8d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\example_icons.png

Filesize
683B

MD5
3ac26d47fffac30a0a755f016e9edb0d

SHA1
93c39cc30326579c51e02d96045f58431336a4ca

SHA256
89a7e3aab5c745c1f5d0dc4898da8b8c4ec8dc59f3f08ee66ab33a1f2713ee52

SHA512
ff41ddf72f57fa7783145f28e19fce91447d199faada5c39af59c7921cffbe2816b7adc095b4cfdea62915d16ce3f3d1fc35fa5a015824a316b1182695040ccb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\example_icons.png

Filesize
683B

MD5
512240e3b65122920468ec8cbb8e089f

SHA1
be3e261de80a4827c89b7122e464f00bc62dea0f

SHA256
f1423f49f7cc236f13fe3069b0fd0a67f2a87756d98c16234aa2da28d1bf2bdf

SHA512
b026086b420b343e523e81781a2d2f4ce16fa795c064904f8a831df8697b5e770e34d636e5ac1d10a62a412158918e14b03d76d6a73e5a05a980c5c261764464

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\cstm_brand_preview2x.png

Filesize
4KB

MD5
70c70a07eef83a92bf6f543f3b9bec16

SHA1
9a2495ff5c4b5909396393ce8f2839b40d3f7ebb

SHA256
36ac06f2641283506a34e00869f1ddcf280febb791fb4a12f57e6955b0696eba

SHA512
3b28be6cc3d41f74ba600044b60b65a0db78180a3eda586b8aa1958a8c097e21d6cb6c3eabbc29f74dd2b70c57068125ae881dfbc33d3a4fe0482c2a05c876ab

Download Submit
C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt

Filesize
1002B

MD5
9a804e9927367fca59ba748c62d5d560

SHA1
aa5240418ff3ac1edbd3ea8342b3e318ffabf4fa

SHA256
5d7908f88fad373d1a677bb6b23111d8001860abdeb0c6ab1362dc0b9b936b46

SHA512
6622c4853c0a7a15c51d38b41dbdba037349399e73bf308d4ae81d5d30b45c32e69c68c54074b5ac612c02a7a532afe6227ca49eb6c3369c0b16de08456d56bf

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

Filesize
4.0MB

MD5
0a65a3222a3b30af6f0d173f6d13a035

SHA1
b6da35ced24f70eaf8565329278d1dad17eb1aa3

SHA256
047ede98fed869cc48124a6d362493f7eff933c42f87872a332d4eefa7085733

SHA512
139c50f96a8fad366ceafcec5e5b51cb45046543b19a364c4f202c9950c18f10a35d1fbe750c292ab592a8fd7b7c88ff499457dc767f8dca17a6a31c37c4bada

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
23KB

MD5
77a0e0732950435440e872e870084a4a

SHA1
fa18601dcc6c898de492a14c2fb61abc2f60d8f2

SHA256
c15cd531776a0d43b68d944d21c827ec304de0962353542fda0254e6a44ab032

SHA512
9aeb6a853f13ad5a424fbb516b599b3d2141877dc3f8bc32602e55cad2a12a82e4f59203286bc53698f141f0882fb6736d4b539a837f4826d4f174173f28d035

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
44KB

MD5
c5209f90bba1c28cd2045863b91eda2e

SHA1
980e82d46a5ebe93e1ec80ed4687adac27b42315

SHA256
4e6f6c81635399e6392882b35a36403daf17eae0578601175041791bcd47060c

SHA512
924f979c66ae32147d5413c80809db40392cc81fe7018ce11af706eca33ec52572b3494cb7192d12a1e8b48a2274cd0498e1b21718da77ac8e55f0c4a1c5589c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
23KB

MD5
579bd6229c71d2dcbcf3a73afceb6e2c

SHA1
b36efb4faffa56dc4c6385a1ed0b6666385bab55

SHA256
45dcbe289b90767a855c015080721c585d7dc553031dd7c41efc1ef759dfefad

SHA512
451c3d1abdcd3a44e698ca254573ed13d89e629eefaf0570e77266273659c73911d04b7d9646313659a9ee532db92b0fba4682246511e3b3cb7c53b0734cad49

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe

Filesize
23KB

MD5
751169b63d1a29ad461f2fb99451215c

SHA1
71ad1bef039f94b5112607601396dd051312bf88

SHA256
770d3a345ec099029170a9844ed4a574fa6275326e4740d3bec1ab2dc51e9203

SHA512
4a341e25583ccb6a8fe95a24a46448226b4c6723bd62abcec982bb32a2ba21490ef5dd4cb03352ad3338713244f7ee58c231347fc61d21029f429cb9e886e7f3

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

Filesize
161KB

MD5
3ac3124fef80ec002a2978213b2f95b6

SHA1
f67b7016091687a8d89b473aca4c601c50cb4d53

SHA256
4ee78599ce777bb856b03b631384f1988a93add8061d6f940faa6fc39966dc80

SHA512
2c9c5a7e81d8dc214f875d55dd022bdca7789e2386ddafbfb2f7ae584e7682edef8bb78cabbb6a04572cec922885d9f0013dee5218ffb70facd8928b1451d0ea

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe

Filesize
465KB

MD5
6fbd4681f05889c2eb2d4896a34c97db

SHA1
a9e0994b3707824ad9e84693adb558d44b56dfae

SHA256
3cb3cfc0622225cdd31a264b9f4a7c76a2f4e05b014d7f4a8ff07d3dcfec903c

SHA512
ae527f03227c0adbaa1aed383576fe8a7bb9c5f29810ec8ccc0f6f27b140b6f0a98e368ac02d7547600763a58cf6b5c7d8c9aed59930d991ff888bb865d73563

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jjs.exe

Filesize
23KB

MD5
554fc1c74f229e20b86f40ac058874e4

SHA1
c2c3e9e31541609192735661c55cebc428e80bf8

SHA256
0ddd36b42a40adbdf55a7e49b36091bff33d8a4952dd9d34e39d69d4147d5b39

SHA512
065f59117d7e22248d542c3f8b42c01f78174a27494a5bf6ed7bb22bd02ff45b112090123033cf5de9fa9eb0d6aaa21ea264d3f6110e1676aaf4bfd17e794f31

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jmap.exe

Filesize
23KB

MD5
c94477bce2bf28b455f5820c12b0a1d4

SHA1
6db01a4738e72f45e5848fa591e4fad2ac2b4cc4

SHA256
a8de2a80a53df0837ca674db530cf3c61e1fb79b232a718cec38ad6a58903cbb

SHA512
571bd9fd08bf0e585ff15d023f06c9c69a5dad6b7a24ffda1f30e82080ea8ad97c33ad30aa26414b3b8db8b43763eca8d8a80bb82d158d52ed76934d899eadc6

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jps.exe

Filesize
23KB

MD5
02809610fa80d0375efab7a78d9caf5b

SHA1
27b6fd88595607732ccf51598dfeedb6743b195e

SHA256
f50097de7e052e383ad8ececd937982bd862507a9f79bfa858f35676cee7b246

SHA512
c558865998dcfbcfb33ff085ae6d58bb277ddcab51b3e1889f8a7e14dc64f24917ed9e0a80e0525a700f80c2524ad14f7938170238334167ac3b0d8c9b32563c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

Filesize
23KB

MD5
4e9b5d3870bd88ba5ba12f9e0fe3bddf

SHA1
fe90e12159e3b9ec099f8b1deaac2d8b8dde615c

SHA256
ebf82b9b3fea4d392039400ac95858e3de07f330affe50a755e9b25aaf00500f

SHA512
2cd5329f217e9ef42a15770d342961ea9eb30851af6f93e6b3f60398dcbb1750be83eaf513054d796066a21193cfd6d3d6031e55088b46e8c3c720a2a2a0b91a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

Filesize
23KB

MD5
2cbcfca3680247f20eb845af6faa7f48

SHA1
09ae18ef0ac0eedca77090293584d98835b8e5e9

SHA256
81edffdef7d7c7f27cfe9e8e2fef56d4a8bacc2a4c8506f5cb599dcf2201ce69

SHA512
4d3e87ff57db77b2aed4c3b61a26c634fa2508192cd98153b40131bb965f1ce38004735e44999cfd3db330d3b1b9e4f2d0b29da62d6eeb260ce5ccaad6b7be7f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\orbd.exe

Filesize
23KB

MD5
0fd80390daf58fc77ae1eab0396d6a6d

SHA1
68134cfa019d516144aeeb9a8a1bf44c1ceebff2

SHA256
c79d7b1b675b1c5e3b947f92aefdd019fbabf7e850dca480fba68060668a1e2d

SHA512
deac6dc05535f394b24199f016b3ee04f28913a312d3ad9e0057709d3297ea62c9b3a1f42599d0fa39dd82942acaf9a44fcaba24da137474518ec09c422f576a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\pack200.exe

Filesize
23KB

MD5
3beef277b60bc33e5d68cc76f20029db

SHA1
7416ee9ae0e0bfda3ef2956e88249a867717b63d

SHA256
971f23e1f85a6cd5ad6fc1d9b60bd827d8d364deb405ed6a6a54c034d4586342

SHA512
defb9d6a69e2d5398c3d7a1c2ef98f46f5bfed9f2f3bc33f65bb1e2cd96abec2ae73fc477a6ca0e343a34ab2c628443bc9a9ceaedc974262ba32cad9d17849ab

Download Submit
C:\Program Files\Java\jdk-1.8\bin\servertool.exe

Filesize
23KB

MD5
07a327b101082bb7a9cdc1ca9d12180f

SHA1
f93ebcf29b6c48e0729a7b9e1589d9cfad4a67d8

SHA256
0670d86abc1349f4f07438bd18d8272afb185f386b9aafb909b07cb08f4120b8

SHA512
f162c08e0afecdc20cf4fa52e20e5db16b43e97e26328c7918f827c06381481a044dae94c5ce8d2950b3016165e5714d3678ff20242b667bd208753a579e5190

Download Submit
C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe

Filesize
44KB

MD5
61a60742adfc293a02fd3e1942b67e01

SHA1
9bc06afaf55c44dcd1a890ba73c0f305c2c09df2

SHA256
1993877357c00d296345fc0ce651eebe3125da783d9dde653ddc083a96fad3e2

SHA512
5c70fec791309b043931a4b0f9e140619f815fba17c5d51ffe1362dfcba4e3d60af9159cb9941c2bd4b4cb66711ef8cac91da1bd4a90cdbbec584b6b6a26a727

Download Submit
C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe

Filesize
465KB

MD5
67b127d6d7e800e3a483ebb1adf89347

SHA1
7300b09736430fc2802ed0ceac3bd5f5ca95d5de

SHA256
a593de5a0d2ff9be76c99b062cae78cefd6e3bc1dbec8c5853a3730fa559624f

SHA512
999cd05c65294c928442d8468f486780133873674f9b9082437252535fd0cadfc664d17d0a96ba845b7db0ae897853ee2b0c41bdf125ba440f9642ddd3f7fc95

Download Submit
C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe

Filesize
23KB

MD5
f0e64bbcb1c30998e2e26af7d27bacdf

SHA1
01ce867da3089820ba3ba11ece80bcb71c869280

SHA256
e5fd6f3bc41734a8ff0367d17c5c683cae9a6eb7b902c61451e2e918adbc77e4

SHA512
9d7d044a78651b7b34b727b6d1977f6aa25cc9642211a59d0aff78fcdd4f777ad29daa9efe9eaa3fbdce4eecc1879eb1e17d1022aa77e9c15b45109a214c1425

Download Submit
C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe

Filesize
23KB

MD5
3126c4f2e8f4eebb55262af55aecf322

SHA1
8f4ece2235d550f888a7ab12571d43eff34878f2

SHA256
56ad30e81a9ff3881ca119d4b75cf510b7b2f2aa755e233fa989808a17f2090e

SHA512
a72bffbdcdbe31f42586ba1ea872b835424b8107478321c93c2f1e63bce34d005eb607fd3f0a3e13ddd1c1a965951cbc8d21992189a484d127b581abaf72cf42

Download Submit
C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe

Filesize
23KB

MD5
10de22e1711fb0bf302bf1bfdda0bff6

SHA1
b005e611666203418fb2383e0522faa3b4d1c53d

SHA256
6263b181a131e52f56a766b596e19f7d9b3138268fbfa6db0c56f1dcc6b07309

SHA512
c92b6e7f5852de978d39e8f86ac5b40c90c2d2a56ab779a3d0eb692d50812d4c457906d73c3b84bc0da65fcf2fed424159783701108cf33bc32dd787a60204b3

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif

Filesize
8KB

MD5
820e6f40437fbfd4accee640f5094ec6

SHA1
685482cf04c3769cc724ff738d63ccc4666c6bee

SHA256
3b4fe3a61bf1ad7731adfe9c0b4f72739dda6a56b4eedd12a43f7cfc3c2ff560

SHA512
275a011dea267a74d8856455647cc709763aae8f883b20725485bd907f218e25bdd65b020898289d29f316a82c18231ee5ac8c63a7e40a962cdc175d27b1f530

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]

Filesize
14KB

MD5
a1c975db897a468f832351ea894ec4c9

SHA1
17bb1f34a0109610cc258436a86d2656ff15f612

SHA256
27e282aaa148a9bcf1ea3bbc03257b3d4c95e9275756a50aea2aaed01e29ed1e

SHA512
bc341633e29029838a0f193d0a9dfa50ec8a126e17e1985d5491a7393d8a5cadde3d801fbf6c18afb8ffb9c6f1cfc71c3bbc3169942c53e574902d7c371c84a2

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif

Filesize
153B

MD5
e4fe3bb85f3727ae827759b150bfd2c4

SHA1
06346592e4c99739e2a7b0954ed5ab8ce2618c66

SHA256
002a891ca8609d1baf0eaf98c489594fc3e7bbdd4c1adc91201b19128e6b19b5

SHA512
4aef2346fa77e1885a7b7280a9938fbb804afa8c19fa80cfd45471e3b7e58ae066133da4ea273f40cd213b89b9057ef7dedf0a33ae967f4f01993ebbf9a13af9

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif

Filesize
165B

MD5
59cd36766284e1d294dbd3d068c11dc9

SHA1
3c0617ccf038e7827bc1219eb7bd0af66cf90a9e

SHA256
acfc15d9e0ea61d13e4b754a8d107473cc52dc13132afce23d7b4ad30bc46b56

SHA512
d620edbb9f28c9dbc423539fc3897ee1c1bc29e63a25587c200514db8ec7f1ecf01ea8cb231d343eaa3099e95004e1eaa45c0f99eaa9635f4f626765eb14b1e8

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
153B

MD5
9186487cbf48ad34ef72573282c98a69

SHA1
47c7a621eb33e614ffa84217f05f71ce58cdbb33

SHA256
abc80f7a7a070c91e297b8a19025ce1bc54d405eeb9412a008815aa74e7fd69a

SHA512
9cf10b6b3a46d90d7774779350001465b80b6f62ad879f1c38537e83049559ac54ca6e3a3f1489eafa84022b62356c9c14cbad0210d878d56eed254d691aaccd

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif

Filesize
147B

MD5
ff238c2dcff3971ad378140da6a564e1

SHA1
ece5a9659bfec55f8a2d7e7af5239a3cc75c5ae6

SHA256
f04a8fdaf694808a3fd7e1e0d905331bf9b42fb899ef6a21bc31c87e29857e53

SHA512
b1032f5695da77f647e20867062b8202404c020d6d3d1b06639ed9e1dbcfabc03467df3e5487321c9a51db95bcf002641e9272b0138d2f9fd7b9618d9e5f0d34

Download Submit
C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
846ecbddaee35ed4e55dd40ec5bc4519

SHA1
d1d59af5562f2804b40f0c00168eae0bad7648dd

SHA256
21d2e5f94e386fd42a3308f89b7e2af3c76ced3170fca33bc3f3ba3f4e0d657e

SHA512
5fdc1e1890897be01bfea1dda90bf53e5bdd7faa698f43bc1bb79be2630fcd7a911872986c4105e87fec8cbeceb85574c73c36a9c5cc16a9e145788bc2b3a2c1

Download Submit
C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
a7fd866fa06de846e20e7458bca4e28d

SHA1
45980b125680fb9f89fdfdc67fb65e0310799ec6

SHA256
d19c80bccedf46da3888ff2e85a24c80c807e6d4b8997fdfddeadf0eb837660a

SHA512
15b63956dbb8cfd8479cd9b9022ff59c5f0e3c40c7c5e7a07804215b50f8707e2b2b6bf00d7c9d2534fc8fe3cd2c4cee42b93570f9dd91c52c95915c7bd93c83

Download Submit
C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
a32b97a450b40979b962667d8ee3220a

SHA1
116eec5c6f4c40666e6b84271c4949da7a538479

SHA256
4b1e4d478864aa7a5cab0c9f8497f4ab22d34494647633a38af657cc39a12260

SHA512
068a07e175e08bcd4c317635e852c9eedec48b68717d1bcadbe5cd625b483cab695567ac735ffc528004a6f5a697123f6df955e0e8cd0773b9e2e8d2a2b7e467

Download Submit
C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
03005e2ff5dfe4198af7a5d4a3e0df6a

SHA1
1f8d32c65262fd75be064c989c2a4701ae1e4120

SHA256
ec1ac3263e00f46c5c862554a79e7b69f1ff37cf99098493069d1983c5c6a2f3

SHA512
e2dcc82785fabb38443881836cfaf5e4681762711d95ee88a6e5fd7f506a3e070d76c69a2367eb9e86108567b0128bc481ab84177e96a77c04f5d7f9a75a0e31

Download Submit
C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
14ee2861fadfb09ebdddd0e282a46fcb

SHA1
dfa8abd1abd227dde9378024a60bcf680d776b1d

SHA256
7f68e54c515c0461b78e59f5d4f8a7349df96bfa6007f2390039252594aa90c5

SHA512
8bad0c0ecffac041bd4ca46d5cf729d58deefb02afa6b6c46fbb49a5ff93ac9c8a627a114ae98a7e4a64bdf69f1dc01246250886c2b0d805eaa3215d98d405e6

Download Submit
C:\Program Files\Java\jre-1.8\README.txt.Hacker zasifroval zaplat.crypt

Filesize
46B

MD5
5f381cb34e7f56a4a83782b0880deec1

SHA1
635b9c9c72e15468ab790fc468154dc5b6be8d91

SHA256
272ef892a1e0d2afa89b59a285f0837109bd5727c63ac292f9c6adc5810c5726

SHA512
19200698fd1c118ab695edf305f745575e7420d343c5409ad2823576943c70560547dd76e2961f53aa4317c83144a9d501042e7bbafddab033add8a5b0a461eb

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
db18da97bc38ec453770f47797720654

SHA1
7fb33231d092a2f87528ca97cdee237e7867d86c

SHA256
a3c6b05fb461c9fb1cbd714448ebd3e91fa71998b1a1c54ec5a1d28d00a5bb58

SHA512
fa7abde8c7ad467cd3aaa650fb36792adc3f5060ce9bc8138bd85226f5a249afe90844b35b71eb5163403caddee6305a34b56126b67da2aeffd8ccacc3555a6c

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
4df0336052a135a6cbf8edc16cd000bf

SHA1
cba16abbfead19afe33c21f35a5f34ebefedf599

SHA256
bb6ca6c234fb1b54c9dc765b1871d670f295af0e3a808703bc0bfa2c17353f93

SHA512
443217e5b7c1752cdbe73d5691f62b347597d9798c79a4f5ebdbbdad079f5d23d6a2cd0adb14b8aeb7927f8e49091275c90049ed6025e616a1365160851dbe59

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
d8b2d81071778d7588d967526af79adb

SHA1
5a056c5f3b209dc4cc3a16d482ff3ac472e2d3b6

SHA256
4a8e317b16c5bfe6b9b25987246b25c72539fbfb4c47018f5a0c22dcd3351564

SHA512
4790e92b069348c5e943b8fe38ee84ace43bb06019300741d23b54ce7573a2f6b1ffb3342c5237116a909832ae192a5a8b43a48866edc08d4a2b540d138a5521

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
e9adb6a5167e41087db97fd04501937e

SHA1
9b4898884b9515c12276bcf3d4bfc82eac3779e1

SHA256
9cd2ae751432c887ce816ad07e09c9075a98b8ab464294c7f1dcf2527e5b65f4

SHA512
3395d0fb165ce3549c7b2246fdc88b1f7715b7878fbda6daac283b5137e72169a71636d15bb43ec9a825f0187aed10485feb993cc9bdb1006d015cd3c95faee2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
522664fa9314efa3a1db6656ea542453

SHA1
9fb2752d691b1fc000e286e698fa3b7f822b6130

SHA256
ffa808b3c93f04ae6912336dfa9e95c5f7c7508dfeca8efbaca6c8f71183187b

SHA512
8ae4bb440692d0c05df9c32225ca7774bc4c76b60824b57912e79ce0721c788efbba0189ae52d306c1ef2fed29ef4cd7bf580c889c56db35d053fe1d6bea6c35

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
5f71771aba909ea3a526890aec286624

SHA1
32aefc106580fc192b6bf680e3b557c9b6c8dcb2

SHA256
682d1dc89406bbf5aa445f48c6ba74c503428ad97c0b59b8d02d8194eec76a3a

SHA512
edd4f1c091c4cc0e4fea3200a076142bbe1138cdc19eb2ee5b21ce4d273db92dadf7d5d24ca6b4682ea9969fe8ff8ff4cf899508a031e4c0ee3608bb133eae43

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
4ff19bd5f613c06152fa34c2479f78af

SHA1
5efbd79dfaddfc51f71816445812cf7300c2a0e5

SHA256
c737dd6c36f17172bce40488bcbcea2610bb4818b440fd46ae4692acb461c843

SHA512
3046fdb2daf9b842dbcc6cdb48484826cea3e9f53128ca8f161d6c69770b41122cd00655ccf471f9f260b3611f59d3ab700c0b5bf870983f5a04c67d518b9ff0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
7f4b14cca8bec387ea0a8ed2fc1f7b9f

SHA1
01a74a8a567b8d6da03760657433b5dc68fb855f

SHA256
6da051e10ba9c91f4d3ca1d86a8ab54fb525ec644450453888084647ee163604

SHA512
57a186cd0fd08a704cf8888c125bcdf4c32fb4669d39305121b43290b25be5fc9a3b5a8497e6779d57dd1017e1596f14a8b97c4f5066dd658e6136de43adc079

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
c47a689c6cc8487d481bcfb361c3da28

SHA1
db371806b094137d6863f0c834265112327dfa9d

SHA256
9ce97b9a8369fa122f8e6e3aa0ef48d64a59fb09e0436e06627826f0b768a494

SHA512
ffc2a801f7fc03209fa40d9a87d600f4adb40cf3333ea0a78efc454bfd69517daa7edb9af46a1539dc501eb3e6b935482c88f8ba625cb31b80fb13b859da0356

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
bcffa89a81fd4279deae167f1eae3e49

SHA1
fe9af5eb2b8368a8e00e77b5211708d6b75ad32c

SHA256
7ee4e4b2341058c8308d44de277ba043563dbd2ed7e721d136b3fdd0b0de6f13

SHA512
c06bb2c4c22925e04ef339369fdff0238976fb02dbfa38839314eb7b37616a7845a91f79b15041172417ab17f168c560552215b93d005b26606250ec4d196786

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
0a14e7b1f90fc8b413cbdcb309841df9

SHA1
35e26242dd079d293d94c885f7f0be093ce561ad

SHA256
07e93bfb26751db2a3c3f7fe4bb4d81a79c726b06696ac6088c5120525866fa6

SHA512
8625580f3b09d397271eb4118dc89bb5f97c6140726e09600aeeaf7ace8afc380c37ff29f425191b4150aaa0b78a901ae599f5c481b1ce92d260bf34d5d1bdf1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
0d7200c8d8efe8c0fde0fd146e3676ca

SHA1
0cb54373c54b23c871ebb7a29934f4be83c921fc

SHA256
32eaf5a4eb6d86c3de851b791508468a1871479d9fd12d98643fd78dd098d42e

SHA512
5e6c2461bad73ed6fb14aea64819c6a65d54157d88a502fd4d364951038800a1cea2c729fa41c9115570ad392e5a1a68d350e475f0b2ce1962085e8f0cf09ac4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
5453b84838471b51fb9212b43b9cfab8

SHA1
0eedb71fc33dd2ea108fcd782abef46a560737d7

SHA256
3a71a2d1c7e51d4f892d889aaefe0fb1c08e928c7110506f2095a947bbe25ca2

SHA512
b3ba7c2808aff15978931807585ef69968c67b55220c1fabcf3d20f4d0e6a6691d7312d9f86e289f27128e4d9f042a463e5a627ac08a8c4b153c45167af451eb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.Hacker zasifroval zaplat.crypt

Filesize
1KB

MD5
0e32d9eec3caed124475ad619fa2e68b

SHA1
354e14ba27dc7694e174482f83fb6bdcb1557ca7

SHA256
bb4337f7845f1c27b3f3b1c9524089fe8dfb24a25a6dd51df29a7aca3d4ac851

SHA512
3bc8802eb96277ba9a12570417423d02f7a825ac38664842da94e5878c108af5b363dd9f26b423676b2311f5bbfc7b457fa854de8bb960f2c730961d89359e8b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
5df99ef79df61d4276bd6ecc56cadb00

SHA1
6f55a6fc151cffb0a1434d4204917fce301cbe12

SHA256
45d37cebdc589b7c38906c0ed78c60ef5f2b2c3c7ebe9f9a60aab5bb69a4dfcb

SHA512
34e89756bf61920412f5af8afe58006e7fe64731cdd7ddbc2f22c33b456fb59cc582fd6b1e925569bca2821a5912a58954585879ff0b2e2f26aca31a6a5724cc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.Hacker zasifroval zaplat.crypt

Filesize
11KB

MD5
407bed44087b9a3671611efe8cce4046

SHA1
3c4cade71204c122d97e8bb12e2f5620da03e8e1

SHA256
47da24ff61a82e99e6059cf52732462ca876455587507863d272293c90123513

SHA512
623724ca40f7c575e76a1d3c0821d1b1ef8d8cb24389d4f77e293a9173746498ac89fb16230cb272b706fd0366027e99f01364210704fe80be13b462d7769b6b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.Hacker zasifroval zaplat.crypt

Filesize
1011B

MD5
f9647972ebc8e52e736f9194a43706b3

SHA1
8ca81412a4c36cebd89701b65709155a5b2ceebf

SHA256
ae1ddae778c2e23516a7314f3a9786c23a41934d1a6b7d583975513dd80c47fe

SHA512
1107e40202c82d18ef48c41a973f35610457b6a4127cc1a12d2481abcf73fe431989d99a56965035b92f63d6087aa1f10cad38da0826456399d7cdb4a0293f81

Download Submit
C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] zasifroval zaplat.crypt

Filesize
11KB

MD5
2d36d7de07404c6adc2ed8f579e4697c

SHA1
0826b59abb7009926a3ac2b92995fbfab590d271

SHA256
844fe3bc61d69dbe6f1db71c766d8c9c74753ddced722c46c0c2ea029689e8d5

SHA512
aa594bcfa4ed3d82a08a09be4b06a4cf4b4cf2f7367f15d08518452b9fd2be3e5fa30cc337e1a0df5368686514aa6181f3ae5a343be835706f85c77bd825049d

Download Submit
C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif

Filesize
168B

MD5
128a17b2948962451347ddf443c7221a

SHA1
2aed7dad0ef081a1c6a221028b048c7b8ce0795e

SHA256
a48285089b3f6337ad7654a3b8aa51390088c8681bd709d5d703dacbe528492f

SHA512
aa606ef13752186602c8e9e787e03ee97751796f6202f0b965c469e50b0ca0770db6cdafffa645bfab5d5b29f36910a508c026590456c9935a2d7c48c9057c94

Download Submit
C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe

Filesize
1014KB

MD5
602eb29bfc2e514b691f381f16094287

SHA1
c88782b8bfd936eca5b6f62f2c6c8bc2ded40c98

SHA256
583cf12f30b3a36accabb3ec89b416c3ddc454630bd46b6ecb2c179355ffdee1

SHA512
9e21dcfc54eeebc3cacd07f4b471c8d3a7f779cc7411b09565d5632d45c1fa4fe10d804a6e00df47acfd4e48814f834837044edc29e222d63670b23b80c1c7b2

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
93KB

MD5
30540af82082fdd788727bf355c5ddb1

SHA1
c9518e7d7353d74883ee3d9f5a69718ea58ba802

SHA256
e8e235e8a9e9028342fe17ae3d5eaf81bfe01929a39e6be0ae27c25adafda15e

SHA512
d05b6114f91e3051ede179f9245246650ecbed77b3c6fca5e12f0297c83d7ca7d5293b36fa1be8b0c912d7fae6fe5d697b0dbbe99662d3674dd0c0831a418a5d

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe

Filesize
6.3MB

MD5
ba4990745692dca10c37533321b3d6df

SHA1
12a352935fc4d6e257c0e0101b0411c9d3c4d1b4

SHA256
713d3198c1ac6809d140f5f0e6ca2f3b4bdb57f050fdab15e7d298c422f642bd

SHA512
28b8b47690381b3bbaed1fb394d221582519964abae589b6455343de09d59d74cb5dc1f18498fe64bb056b8520d2378d2b2dafde3ebad25110ce2e94e17839a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CDS.exe

Filesize
6.1MB

MD5
424bf196deaeb4ddcafb78e137fa560a

SHA1
007738e9486c904a3115daa6e8ba2ee692af58c8

SHA256
0963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2

SHA512
a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\crypted.exe

Filesize
3.2MB

MD5
5ac56dae03b49feb7f442b38bfd7270b

SHA1
798388cece6ae5ddecb09245d0aab4795d22395a

SHA256
28db0612182329d9af34d5045330a7c2d9c329c37795c4124ded5477e4205126

SHA512
235275175e4c23dbb45351cb21e9d9d2ed15235aea0d594bd784d53624fe38a8f4caadcabf90ed74b8b9eb9ea769b720af29c982468b3d2962b0be2c74c71fa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\630_10.png

Filesize
2KB

MD5
340b294efc691d1b20c64175d565ebc7

SHA1
81cb9649bd1c9a62ae79e781818fc24d15c29ce7

SHA256
72566894059452101ea836bbff9ede5069141eeb52022ab55baa24e1666825c9

SHA512
1395a8e175c63a1a1ff459a9dac437156c74299272e020e7e078a087969251a8534f17244a529acbc1b6800a97d4c0abfa3c88f6fcb88423f56dfaae9b49fc3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\CDS.cdd

Filesize
13KB

MD5
3e7ecaeb51c2812d13b07ec852d74aaf

SHA1
e9bdab93596ffb0f7f8c65243c579180939acb26

SHA256
e7e942993864e8b18780ef10a415f7b93924c6378248c52f0c96895735222b96

SHA512
635cd5173b595f1905af9eeea65037601cf8496d519c506b6d082662d438c26a1bfe653eaf6edcb117ccf8767975c37ab0238ca4c77574e2706f9b238a15ad4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ap1.dat

Filesize
3KB

MD5
93270c4fa492e4e4edee872a2b961dde

SHA1
7b3c079d55d00aa5390662f0a2059e60546ed003

SHA256
25d49cbbd65d48ad462455f1143f73ee997df8f747e7d2213daab18e321c028b

SHA512
3d12721eb229d9227efc51c8e93d5f3ff6cabc305b643b764fcd6da76c031db4c8218b76b1f6158891995f23ce323c13826f59477924361cfb0dee2b9f94fb42

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ap2.dat

Filesize
3KB

MD5
fc2a595f574b1ead82a6dcf06492c985

SHA1
400626784368fb9825a954ab8e14238054a277d1

SHA256
ee9a4903a8df90eff4c5b65a8073e564a3581cf73772a72eb82396e69932e769

SHA512
06506e70170a85a2d697550bfb555a19e210e93b972a38a482448cf8eca335605583d04f74f5fdd2911203c58aaca2f55b946c2dfe754ecf17c6b1763b7e37db

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ap3.dat

Filesize
3KB

MD5
967fdfe0a01c083804673b4976ad6730

SHA1
5d05ade6dd0d1d67ea7879cd8f7779ef53abbd4c

SHA256
72eda9d49bcd0cd3b540f75c4215714378afbb1ce40afcbb7a0b246ab2a44f21

SHA512
50acacf15fa4cfa8319f789fb534cdb4a8d559ceb3e5e832b32015ff2fbee2c3902abfc83bc2493d57298ed32d0aeb6817e077758c4c2c956432b1d3f3c738d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cdd.zip

Filesize
436KB

MD5
1d5698b4e2dd3435d103865e881aa2dd

SHA1
d1cce8983325f009f859c24904ac3bc6c0d082ad

SHA256
064167b67acebca10b61531c2b8a6bc1539406f15002a2f56f3f8ecd29b10890

SHA512
088b3a42cc13c10f3867b13243170a97b9aaf7c1bd16d574f27ddee53e0ced62c5a643df2b03840676b621db6b001aa14e184ca6b27e657fbe5697bad43e7c4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\crypted.exe

Filesize
43KB

MD5
b06fd9f5b27a42980ade9892042b9f03

SHA1
55c1280ef3b67d43003916de5490a2787bf2c99c

SHA256
976bbe6a6609e451d13a7ab0f37afd0148623e247a2c93ec1a1cb13983fa87d9

SHA512
5ecc83c77326d6959b28a11472f5bb9202a1454e5525517f26e3eca0dc596541191172df9dab2579ede2af6d2d560a4e33f92e8b204f35492871e695f9baf474

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fs.settings

Filesize
5B

MD5
68934a3e9455fa72420237eb05902327

SHA1
7cb6efb98ba5972a9b5090dc2e517fe14d12cb04

SHA256
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa

SHA512
719fa67eef49c4b2a2b83f0c62bddd88c106aaadb7e21ae057c8802b700e36f81fe3f144812d8b05d66dc663d908b25645e153262cf6d457aa34e684af9e328d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lua5.1.dll

Filesize
322KB

MD5
c3256800dce47c14acc83ccca4c3e2ac

SHA1
9d126818c66991dbc3813a65eddb88bbcf77f30a

SHA256
f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866

SHA512
6865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lua51.dll

Filesize
11KB

MD5
7fa818f532effd80cf7c1c54676e5a0d

SHA1
05ce44c8d0672c9f3ce66436c592442377e69dba

SHA256
1c2d1ba8425139d45de89192d2ae4982e9581f8ae0f22b8497aa0055080237ca

SHA512
38baed895bc71bb890e91a92909f6e78ad34569ce6c7efd8bd9db50080da22697a085f98a3465c3e31165fb9029644e5a0f6bc5ba17d71d7f0dcd31784f0811d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uhwg11nb.uig.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\satan.exe

Filesize
211KB

MD5
1ee5c6140b8d0d212d306653ba781469

SHA1
aeda5d7cd228c14c750daa9994fb0b33ac268b2e

SHA256
8054325668510fed20f63a2956f202e7a45649a968f146135edbbc631fec0d2d

SHA512
4285256c6d7876e8bf2b6f04df6a95bf032aeb7ac8ff3007a9288ab55bbe976558efa99a307f0467dc5651b1aaa49f62f40b1e0f241b894978b0c3fd1cc92bb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\satan2.exe

Filesize
211KB

MD5
0c2cafe71b945122d782aa6b64c713fe

SHA1
ac1bc32a997f12928693c77df98436e1058cf7ec

SHA256
1e2325130cad9527d5472e59dadcf9b391449ab4456ffa7353a885023444b718

SHA512
12a1d80b9e9dba444e46c919e9e7269a5a6e39ad019c5bb91f0ed5f6bc56cdd0c1d909cb575dff5f0b6eb20223a1b94abaeb593ad2b589e21d1f84ceeb07d808

Download Submit
C:\Users\Admin\AppData\Roaming\highcheck3.exe

Filesize
15KB

MD5
e7822ca0edd9dcd5151d1a2b51bdc323

SHA1
db584b5acc31fd453fffe6c2308893088c04cc91

SHA256
4cbfffac38dc15905aa4ecbc938c8678ffe8de2e922f1d7090b38f11e9226142

SHA512
bb0dee0180ff5633c3d1d9bfe7e890434b3bc6f17c8e1ce49963144803659b43b6ccd6a6eebeb7616bd9648191e97fb4fbec5389bb4829c8b700445aa8a3b077

Download Submit
C:\Users\Admin\Desktop\00408\HEUR-Trojan-Ransom.MSIL.Encoder.gen-4e96bc3985a6bbc0edcc12d1419597b0d3989c6ff3f38884d7a28ff482a1fcda.exe

Filesize
729KB

MD5
865461b3fe4b1cc165846627bdcc479e

SHA1
22d379134e23401f2e2dce818206de7ff125e1dd

SHA256
4e96bc3985a6bbc0edcc12d1419597b0d3989c6ff3f38884d7a28ff482a1fcda

SHA512
87a79b736cacde43665bffe00312501eb41e255c3805f2ad57d617ea2375886af0ddc4f10afa41ad37d21a2743eb17c4d9a2740b1a9f08dff79db67f85c335d8

Download Submit
C:\Users\Admin\Desktop\00408\HEUR-Trojan-Ransom.MSIL.Makop.gen-9622591e352c6c972335d1253301a82b82a54a1fa36065a269bb2552edaab0a8.exe

Filesize
1.4MB

MD5
30f14b81538ba289beaad4076fed7293

SHA1
2ccc031e309cc1757c91d911eca10a7897012cec

SHA256
9622591e352c6c972335d1253301a82b82a54a1fa36065a269bb2552edaab0a8

SHA512
0effea5654a74f08815af8ef99c93e544c0bf9acbca4d654c713d4b6cd5843b91d23b006978c6a11064eadedc21eae423887476df5cac04aefb07e93e390f426

Download Submit
C:\Users\Admin\Desktop\00408\HEUR-Trojan-Ransom.Win32.Blocker.gen-4e2aa3d570b2e8c60bcd80195037ea40236d0bc3d4179aed6adca240523667f3.exe

Filesize
1.4MB

MD5
7217a1a648bf3bae4ae4951b182a2572

SHA1
c8b5036843e02fff74e696621d5a4d0e6fdedc8a

SHA256
4e2aa3d570b2e8c60bcd80195037ea40236d0bc3d4179aed6adca240523667f3

SHA512
8e3f7fce79722bd77b5b305bfbe12b3641a03a478c0878cfbbe5da220903964703ef03a11f3c4db6e54218cab87fcd9a726e8f0481a3c1554d9d182c29636a72

Download Submit
C:\Users\Admin\Desktop\00408\HEUR-Trojan-Ransom.Win32.Encoder.gen-927d883586d52f97c7073b1e6d45ca9c303c49de0d6789776cae8f0e16bbdb4c.exe

Filesize
2.7MB

MD5
3ff706a180a4d3853624b326ca147cbd

SHA1
2928b0bd7159fac917c00c64c02d4e56c119ccf2

SHA256
927d883586d52f97c7073b1e6d45ca9c303c49de0d6789776cae8f0e16bbdb4c

SHA512
0381b3fa23e3fbe1d80c74b8d979f7784465cc3aee2b51f205e5e64209b36a712813c8982923a782c67ab43ba16ebc064b2dd76da9ccec2d22645718f1389d85

Download Submit
C:\Users\Admin\Desktop\00408\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-6d2334d382797f2f181ce2c1cda7b49bffb43fa0f522576d8d48b21348ed393e.exe

Filesize
322KB

MD5
033cecaf3f00086f321dbef50dc0dd9a

SHA1
ef95c9514e2bdb5b8157af818eb7baf910259b93

SHA256
6d2334d382797f2f181ce2c1cda7b49bffb43fa0f522576d8d48b21348ed393e

SHA512
4af3471dc29d5a0920513101b8b36ca561af516408404d04a99fc93daec5d6c3c332f22c1909c0f6960395cac0159fad27e395dff4dc6223ea7bf0be92e83460

Download Submit
C:\Users\Admin\Desktop\00408\HEUR-Trojan-Ransom.Win32.Generic-e474501b0a67caf99c1f0ff2e36f8de4914ccbbdae2e75fb02f0d7b07f1aec55.exe

Filesize
751KB

MD5
dea4b22560f501ef60b6e6935c63241d

SHA1
e8f61245fe83aed637dfb1a3838d31c743ddf6fe

SHA256
e474501b0a67caf99c1f0ff2e36f8de4914ccbbdae2e75fb02f0d7b07f1aec55

SHA512
4cead7a26f72fb8767ec3910d5f1c7b092bf525e53c1ca9ec6228f82481bff2ad3d4515317710f4d7397b9688c8329dbd27b6c065abbd0216489dabb5599e283

Download Submit
C:\WINNT\Temp\08-06-12 PowerPoint Shortcuts Exercises.ppt

Filesize
231KB

MD5
0861b4ecc3b72ad686014ad2bfda8a8f

SHA1
e8493f36909c840e2f5c88b499c4e1f858def635

SHA256
68f42586019a6d2d846321fce7a5bade081d48dd1997b9119557aa170f1ca2ea

SHA512
f858722ff99d10a538e9e66f6fd936a690c695b52405f0cfd54190c889d0b3dd3db36c96039e418dc019135f1dd05ea1d95a5b9012f3e96cad0ee79bc1ea7a4d

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
370KB

MD5
01661fc09f469621d9c8d1f52d5b0650

SHA1
5a300a72397e28aa9b89e5bf99e60a6fe972ee8e

SHA256
a5229db02ad2a3349d1681c5fedf7b331e51a58dbcd1ebca5ae05ccd01e1d070

SHA512
ce6f9d88b337a3abc1a38c39c7e8f76ca2a31edf9a081f11c589f0cafefa13ec95acc1ce43c45076c40c1163884a60c2d8837a6bdaf5dd9022a336f007718393

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
memory/916-3238-0x0000000000400000-0x0000000000805000-memory.dmp

Filesize
4.0MB

Download
memory/916-3215-0x0000000000400000-0x0000000000805000-memory.dmp

Filesize
4.0MB

Download
memory/916-5196-0x0000000000400000-0x0000000000805000-memory.dmp

Filesize
4.0MB

Download
memory/1148-202-0x0000000000700000-0x0000000000717000-memory.dmp

Filesize
92KB

Download
memory/1148-196-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1480-3761-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/1480-2672-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/1508-113-0x0000000000620000-0x00000000006DC000-memory.dmp

Filesize
752KB

Download
memory/1796-3322-0x0000000002900000-0x0000000002901000-memory.dmp

Filesize
4KB

Download
memory/1796-3319-0x00000000028D0000-0x00000000028D1000-memory.dmp

Filesize
4KB

Download
memory/1796-3316-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/1796-3315-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/1796-3314-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/1796-3328-0x0000000002960000-0x0000000002961000-memory.dmp

Filesize
4KB

Download
memory/1796-3318-0x00000000028C0000-0x00000000028C1000-memory.dmp

Filesize
4KB

Download
memory/1796-3327-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/1796-3313-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/1796-3326-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/1796-3317-0x00000000028B0000-0x00000000028B1000-memory.dmp

Filesize
4KB

Download
memory/1796-3325-0x0000000002930000-0x0000000002931000-memory.dmp

Filesize
4KB

Download
memory/1796-3330-0x0000000002980000-0x0000000002981000-memory.dmp

Filesize
4KB

Download
memory/1796-3320-0x00000000028E0000-0x00000000028E1000-memory.dmp

Filesize
4KB

Download
memory/1796-3324-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/1796-3329-0x0000000002970000-0x0000000002971000-memory.dmp

Filesize
4KB

Download
memory/1796-3321-0x00000000028F0000-0x00000000028F1000-memory.dmp

Filesize
4KB

Download
memory/1796-3323-0x0000000002910000-0x0000000002911000-memory.dmp

Filesize
4KB

Download
memory/2040-2575-0x0000000000A70000-0x0000000001453000-memory.dmp

Filesize
9.9MB

Download
memory/2040-3211-0x0000000000A70000-0x0000000001453000-memory.dmp

Filesize
9.9MB

Download
memory/2668-3207-0x0000000000400000-0x0000000000677000-memory.dmp

Filesize
2.5MB

Download
memory/2668-4077-0x0000000000400000-0x0000000000677000-memory.dmp

Filesize
2.5MB

Download
memory/3200-299-0x0000000000400000-0x000000000066F000-memory.dmp

Filesize
2.4MB

Download
memory/3200-3214-0x0000000000400000-0x000000000066F000-memory.dmp

Filesize
2.4MB

Download
memory/3296-52-0x0000013854610000-0x0000013854611000-memory.dmp

Filesize
4KB

Download
memory/3296-47-0x0000013854610000-0x0000013854611000-memory.dmp

Filesize
4KB

Download
memory/3296-50-0x0000013854610000-0x0000013854611000-memory.dmp

Filesize
4KB

Download
memory/3296-51-0x0000013854610000-0x0000013854611000-memory.dmp

Filesize
4KB

Download
memory/3296-49-0x0000013854610000-0x0000013854611000-memory.dmp

Filesize
4KB

Download
memory/3296-40-0x0000013854610000-0x0000013854611000-memory.dmp

Filesize
4KB

Download
memory/3296-48-0x0000013854610000-0x0000013854611000-memory.dmp

Filesize
4KB

Download
memory/3296-41-0x0000013854610000-0x0000013854611000-memory.dmp

Filesize
4KB

Download
memory/3296-42-0x0000013854610000-0x0000013854611000-memory.dmp

Filesize
4KB

Download
memory/3296-46-0x0000013854610000-0x0000013854611000-memory.dmp

Filesize
4KB

Download
memory/3308-3236-0x0000000000010000-0x0000000000F5D000-memory.dmp

Filesize
15.3MB

Download
memory/3308-3360-0x0000000000010000-0x0000000000F5D000-memory.dmp

Filesize
15.3MB

Download
memory/3460-3205-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3460-3996-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3516-62-0x000001E0EBB50000-0x000001E0EBB51000-memory.dmp

Filesize
4KB

Download
memory/3516-53-0x000001E0EBB50000-0x000001E0EBB51000-memory.dmp

Filesize
4KB

Download
memory/3516-55-0x000001E0EBB50000-0x000001E0EBB51000-memory.dmp

Filesize
4KB

Download
memory/3516-54-0x000001E0EBB50000-0x000001E0EBB51000-memory.dmp

Filesize
4KB

Download
memory/3516-65-0x000001E0EBB50000-0x000001E0EBB51000-memory.dmp

Filesize
4KB

Download
memory/3516-60-0x000001E0EBB50000-0x000001E0EBB51000-memory.dmp

Filesize
4KB

Download
memory/3516-61-0x000001E0EBB50000-0x000001E0EBB51000-memory.dmp

Filesize
4KB

Download
memory/3516-63-0x000001E0EBB50000-0x000001E0EBB51000-memory.dmp

Filesize
4KB

Download
memory/3516-64-0x000001E0EBB50000-0x000001E0EBB51000-memory.dmp

Filesize
4KB

Download
memory/3848-93-0x00000221E1D70000-0x00000221E1D92000-memory.dmp

Filesize
136KB

Download
memory/3848-104-0x00000221FB300000-0x00000221FB376000-memory.dmp

Filesize
472KB

Download
memory/3848-106-0x00000221FB2C0000-0x00000221FB2DE000-memory.dmp

Filesize
120KB

Download
memory/3848-103-0x00000221FB230000-0x00000221FB274000-memory.dmp

Filesize
272KB

Download
memory/4112-3235-0x0000000000400000-0x000000000066F000-memory.dmp

Filesize
2.4MB

Download
memory/4112-440-0x0000000000400000-0x000000000066F000-memory.dmp

Filesize
2.4MB

Download
memory/4524-123-0x0000000004CC0000-0x0000000004D5C000-memory.dmp

Filesize
624KB

Download
memory/4524-127-0x0000000005310000-0x00000000058B4000-memory.dmp

Filesize
5.6MB

Download
memory/4524-131-0x0000000004E00000-0x0000000004E92000-memory.dmp

Filesize
584KB

Download
memory/4524-189-0x0000000004DC0000-0x0000000004DCA000-memory.dmp

Filesize
40KB

Download
memory/4524-199-0x0000000005020000-0x0000000005076000-memory.dmp

Filesize
344KB

Download
memory/4524-206-0x00000000058C0000-0x0000000005C14000-memory.dmp

Filesize
3.3MB

Download
memory/4524-120-0x0000000000300000-0x0000000000460000-memory.dmp

Filesize
1.4MB

Download
memory/4524-1416-0x0000000026610000-0x0000000026622000-memory.dmp

Filesize
72KB

Download
memory/5648-3353-0x0000000000BA0000-0x0000000001243000-memory.dmp

Filesize
6.6MB

Download