hxxps://github[.]com/kh4sh3i/Ransomware-Samples

Resubmissions

06-12-2024 18:24

241206-w2jhxs1jax 10

06-12-2024 18:22

241206-wzy6lawnen 7

06-12-2024 18:15

241206-wwd19azqas 9

06-12-2024 18:09

241206-wrmgtszngy 6

Analysis

max time kernel
101s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/kh4sh3i/Ransomware-Samples

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1168	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
2768	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
800	c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pr = "C:\\Program Files (x86)\\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe"	c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pr = "C:\\Program Files (x86)\\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe"	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pr = "C:\\Program Files (x86)\\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe"	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
53	raw.githubusercontent.com
26	raw.githubusercontent.com
28	raw.githubusercontent.com
31	raw.githubusercontent.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL010.XML	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml	c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL087.XML	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\METCONV.TXT	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL078.XML	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN096.XML	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL087.XML	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml	c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.XLSX	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.JPG	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml	c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL111.XML	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml	c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1228	4328	WerFault.exe	112
2828	3992	WerFault.exe	119
3464	636	WerFault.exe	123

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133779829483982382"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5080	chrome.exe
5080	chrome.exe
3420	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
3420	0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
3280	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
3280	e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
1756	c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
1756	c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5080	chrome.exe
5080	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe
Token: SeShutdownPrivilege	5080	chrome.exe
Token: SeCreatePagefilePrivilege	5080	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
4328	wmplayer.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe
5080	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 2928	5080	chrome.exe	83
PID 5080 wrote to memory of 2928	5080	chrome.exe	83
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 2292	5080	chrome.exe	84
PID 5080 wrote to memory of 4140	5080	chrome.exe	85
PID 5080 wrote to memory of 4140	5080	chrome.exe	85
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86
PID 5080 wrote to memory of 540	5080	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/kh4sh3i/Ransomware-Samples
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb6d9ccc40,0x7ffb6d9ccc4c,0x7ffb6d9ccc58
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1964,i,6730244528347787211,7952958553054002923,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1888,i,6730244528347787211,7952958553054002923,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2068 /prefetch:3
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,6730244528347787211,7952958553054002923,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,6730244528347787211,7952958553054002923,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,6730244528347787211,7952958553054002923,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4588,i,6730244528347787211,7952958553054002923,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4884,i,6730244528347787211,7952958553054002923,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:3348

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:872

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2584

C:\Users\Admin\Downloads\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
"C:\Users\Admin\Downloads\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3420
- C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
  "C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1168

C:\Users\Admin\Downloads\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
"C:\Users\Admin\Downloads\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1756
- C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
  "C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:800

C:\Users\Admin\Downloads\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
"C:\Users\Admin\Downloads\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3280
- C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
  "C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2768

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4328
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1916
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 3740
  2⤵
  - Program crash
  PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4328 -ip 4328
1⤵
PID:3684

C:\Users\Admin\Downloads\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
"C:\Users\Admin\Downloads\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe"
1⤵
PID:3992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 440
  2⤵
  - Program crash
  PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3992 -ip 3992
1⤵
PID:1344

C:\Users\Admin\Downloads\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
"C:\Users\Admin\Downloads\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe"
1⤵
PID:636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 424
  2⤵
  - Program crash
  PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 636 -ip 636
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\HBITIBXZVA.CPZ

Filesize
83B

MD5
26fe2c37c683a4ca072e59e0635d0b57

SHA1
064b60d67d04840d6aeffe6fbcb5b4d72eca7c7a

SHA256
4c512feee4d028829f8251897f36e44e6e5b7c377ef9630f07a9f1321489c917

SHA512
6c96df744fb23a9aef55deb7b40ad5f5807dd1d36f02cb74191eb528e3d4e83b28d09d2a3fc6bc791b094eb2c76d6cb5159b0000fe7914ee046b4c81ac968ec9

Download Submit
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml

Filesize
22KB

MD5
850304a07f28273c863360bdbbd029dc

SHA1
e6414bf118d301de1f606dc8c2db44c81fa5caea

SHA256
146b443fc7a38fee2475dd1b4702dadbcef0306414a4dbd422cc26b1fe2b5338

SHA512
5138ef4101eb4a251dc6ee110884ae5a27f680e6a8bb6fc3dac1ab7f04084231e990c3b9005ff141a46352005d8196ecfcfc97b45a08494021ed141155a0d9f9

Download Submit
C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml

Filesize
142KB

MD5
91ea81de856c1d1885f746d983381480

SHA1
828330f17365686dc819b46730f7916ab400f625

SHA256
2355d6d73189dc6b9f488841d0a848a3d11c8792ed032849c8ad2dd96bcb5527

SHA512
24867b48739a71e3e4c3a62804c41b249097992339d7a639b01d96f28cb509ad16cefad4625e7627e6de3da7a1875acedcddca35135bb753db5638d1f88f0f38

Download Submit
C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\manifest.xml

Filesize
20KB

MD5
54c957bcc62e1dd636d67bacd17bab86

SHA1
65bad6e5e23c1514a42f4c9e211d3bf272f50749

SHA256
f5991e1481c2e8bbab088289b3162a25b028efdf9d210a8430d43ce6350bfa5a

SHA512
0bbb2061654cf7641569550fbe5ba317c67e0ee4f890a8fb3f02a8c88b43c10d0bdfa241c617d75d208ffd8933e09792541f851ee8abcb2d33762129c000d5d0

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML

Filesize
27KB

MD5
69cdee76021854e81850cd86c972e5c2

SHA1
18853460a1ff9fe8899ebf2d9be80e9383056a82

SHA256
3552afa5b1fb21a6b9ace77226faad8568091317a0f94b30580e71c0152bb56d

SHA512
47e3bd90453855f826204765ea6de1dedfb209ec0e3f6da64f202040c7955c4808a9aa88c332578b8c6b112caaddb7947d4b7bf3cd0da46b01b7ba235c6504f8

Download Submit
C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml

Filesize
20KB

MD5
85fb2e0b1b0e878f3e0564a6f14cfce6

SHA1
65bdd43c6703135968c4375b1525d81433538d5d

SHA256
b46d0e248d28b5408407d678c21b6acdabddf27ae1260df2efe1719a648086cf

SHA512
d03e3ae7c747915b364f9bf313c77219026f9b37959dd921b1046a80bf91a30fec42ed8005578c2d986d357a9cc3184b0887ab5586c219b54412f1b0288a176c

Download Submit
C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml

Filesize
3.4MB

MD5
f044dd7ff1083c911ec8fc789b47de64

SHA1
d4285d891b778a305741d0b891ee2fb877801257

SHA256
8831ad821797d809dba557ce5a6f5f804cf2f42d7b54e88196fefad59ed7ffd9

SHA512
38ad5722b97148d092f387e79a5c7e53aaaf7b22ff64b7b0f06404966b2d1f785cbe4e69e18f22007525e886552b671736c89c00dd8a46b05227e114169ed427

Download Submit
C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserDeploymentConfiguration.xml

Filesize
20KB

MD5
85cb533f73e2cefa31573070f0bbb69e

SHA1
5d3880efcbe6d15a6fcbb4e87ce70735312bb86a

SHA256
896e5e92147aa422c8b96c8434d1a17f4989039e125b918bd4961a2fd8936cb0

SHA512
75198f5a13a2cd445b38f69934e0dd4b06e9186cfc09c2b9e1570a1593c82f516b834fddebfa5a535c15c032c372f1fbf94bc653890b81d4dbd6fed0bf717830

Download Submit
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\0890ad2f-b74f-c384-f684-9c33f8f67924.xml

Filesize
22KB

MD5
af66b3e6daa08e48d23398a065864167

SHA1
697bc2231c9c5e66f803832d1a66a719a7b0c77c

SHA256
3dd1f9f31609bcbb362a8c912ae2dcedab02f68b12ab04beb669ca5f54980c35

SHA512
86f96e0087a52d4be102ae99b899d984d230c79bf982ac60e7c771e86b84278289dc2d4a243bbeaaf561d5d81b4ad1b1b8909c3e6841fcff3891b8487e10dc4e

Download Submit
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml

Filesize
22KB

MD5
3abd3ff7cd5c3653b35145ad544964c6

SHA1
dd90bd17a9b130e8e6603bebe56ef92fdee06437

SHA256
94d2a8b3b08aff00ecd6b841ffcac09e36467f4095e03d7e31dd063e5e5eb3b7

SHA512
81a4f7f954f360ff6a6d9a8025c314ca23ba5111d9e558df9c7c0b2dd1d74b7564075fe42444e551ee4a5463a8a966e63167a753a509ba22dc7d33326951ca01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
eb2e2cd50760407e00f5e48d9ca25e9e

SHA1
81e34ecd6a7fb7562b767f3b1e8404c1c16132d1

SHA256
362aaf4bbf21733867d37e226cf95c865b7a586ecd6e7ae2b91e18830cacc6b2

SHA512
ba6ec185136ac86fd002fa49c4093f49e4340b1b27283550b343932ff8e7e73674eb1759475b0bdfc34d0221121fc90da1b5793abfea1cfe0bdc6ff83c6c79bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
932f50ad02fea2c6ea7e1b38c8c25603

SHA1
9b55e17490250dd34405bc39737edaba88daa48c

SHA256
2fe277e7df0903825da427c0b91c44d0437e4f6192b2bcdfedeb2b4dc697f113

SHA512
cda8e34f3a7fe8da959a2a5191e252bd378d29df5aab0e12ceb850327cbcf6599c0bb36f3855aac6a1b32bdf1ef43ac86fa4068bd539f15757a1cf08d7e3dfbf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
6bbed250f61b4fba6caa2fd5e1d634ac

SHA1
50f089b7e564c1e8d079845b5a37bb715bbac139

SHA256
324e2c9aff1e334ee594b20c900c6fa137e4626dfa8a8dfd45ea2b3013b3727b

SHA512
dca556f5415752b6df2887b5e727c5d2fee110e2e9a3a6ab24532675eb7fa4ada6936c17779a3ec4755e88a5f3625994bb9874c239bfdfddf1ea5281d413330f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG.old

Filesize
19KB

MD5
e0ae3f82935d0786be674ac2009ca36d

SHA1
ae7dffcadb6644071911f843f285b8ebddc4ae74

SHA256
04aefd605b91c6035998274290511e17c2a8484b4918940e246f4fde96039a45

SHA512
ee5c77f89caee6159d7494dcec0200039ce1cccbc5f602bd1d72f3466f725e499e4778db8af137aac2ffb2ca61bcf349ca9b1fd417c9d33bc87ce0f54ddcf32f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
175365312163ce39794b84442a805de3

SHA1
ae6cd4b7f2ba69036e7ee0e09b4b4e26e7e528cc

SHA256
9bf16a1e505281fd28cd678703aceaa52a1b018bc8c6a50a76e0632de96054a7

SHA512
3ca18bc480566274b626251765faa0b960efaa8453bafa99f3781341815a9ca27962d2f6a3fc8330ac3e3d94dedfafab3c6db32ce550c225dc9b87cb825f69fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
bf3959d61d337c03591e45a1848cdc6b

SHA1
d2de17f8cec6bf5c378541f808af68fcec0a7f69

SHA256
e45fcd920f652ab216fb6bc82742cce5371c8fc2c3fce4e79c43dc59209a48a9

SHA512
20a3ef38870e0c494079ba55e0e224ef52ca22ee38a0e7f56292f790b13547f30f242e23b7c1acbfd1bde8822726b50710aa4e77b2872e683a222c93585cc1cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
b8ddbfa46d27d44064c3b1bf4144b62f

SHA1
ae80db65c660d0e7cfc9bf5e31ef91124e66b071

SHA256
9c2bdccdceb729ca2021c11161af3748832b46137c60c5761ff3795d27f37dfc

SHA512
de46f1215ca43131c2cb16e94042bbaba66a4f4b140ac7305a3f8fac083beb50ec157411b7a5e4e9659fca045506d4236fa67690a2c7bbb54f9a0046bf619db6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ad06172634283864d7834d08f7370991

SHA1
6e047224c07bf20358f6be5567b6cae6f623cd3e

SHA256
194f086e49aa4447f74d562277c59386f990d38214fc631c814a363b1c46cf5e

SHA512
cb79928cef2a99518d0f9e5ede01231c9060cf867f8b8513dee413fa08903d75953b165889cd697074cc289dbefbaf0bf0b0b7a74e3bb6065821236d584b54bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
33d41cd23902cda90e7b241abaaaff93

SHA1
d90f2dc319abf5c7e075c53afd6ed72f039d2bf4

SHA256
5e01e83c67290924ac0f6996c0b02172286d9d4e14a094541429680d88c710ce

SHA512
9a7344899b17dae6ffa3a0a09f3cb8471acf593b268c1cf0fdb13cf8e03910c3380da6f1b9ce6b3864855cf3c492d6ac082fc24110f308dc409a5f27c093b055

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2f2467a3272c2752b28bce2ab3d81d1f

SHA1
be49129dc17386e5a3523890d33e1d72e75dc1dd

SHA256
13802abd5f89819ced0942c09040836d3770cca43f52688e64e142c100dae539

SHA512
7db01a6103701ae22492b0d87d12b6e34e156ddcd9d385962cfc8993946cc0cf163785a6882c50858af39810d22973314cd5f694388926a1f01bbd4754cd8d4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
87931b6c1c939d37f42bfba388f9a7a7

SHA1
453151e96fa6d4c05f22ce1cff86df80823cabb8

SHA256
6125ebd6e7b8fb73493f1bb922dc50e0e31fe29cba7412c288db91448de75ba9

SHA512
a75987a112ea2f9f272ea82439521e15b760395e2424d66496f1470f656e409b904f8274e58d7c275f68b17d89fd71cad7f20f9b102ab8678ac731f7eb562546

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d3834fa789c101d07b2a9f5b47c5eba4

SHA1
443a25deef5eee204d718ac9a3cdbf62d93c7925

SHA256
8c1b562143e50b4c2520fe5b8dc192984b8fb8e586e5badc9c85262470ba1152

SHA512
fa89df4873682a3928544bf4a6c9452927f7a7c974e7543f6fe73b1c35b67c9273f9b6d95688abee48ff6de7d817ba089c85694fde43cc0ad7cb73fa04bf1c96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d119ea78450e635fe404da3b359a9acb

SHA1
fadf5a224ae4c3d7f6cd1fb8c618b22478935b20

SHA256
e2aca244feac311ee4d7fee11d43d9ac4c52cf1be5238e359ee8fcf2b395bc86

SHA512
d8d13ad3bd93375a4bfe66b92e21fe4cf5caa889dbee84d615b426e2f1bc67544a7e6ff2e38eada89ac886cdf811f27aaeba6575ee9ce7801bab9f5d9b968609

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
81e1ce6da2ed415f1de54df0c9b1e580

SHA1
0ba773f876c5d681402999fe5b3a5c9b590ee021

SHA256
157d530a8df47d3621018d00128e1fdf29767241f3aa78035d185f60c8e2ee32

SHA512
0d0de2fc0595d59d35b2c4a58135e1e6528895844c3d3a61a50335dea8fb1d1037ab4ce7b0ef8a476a49fbab4a27dd80ab5fd6566f3873874abd74df2a75315e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f5ebea105603e457c5290ea78fc876d7

SHA1
4bd9f8c925059d52f309e823fdfd04b5df775cfe

SHA256
7bfc6667d1c4da52dd1e4f265a53d4cb5e8acb770d8b0d84a74a0728345c4730

SHA512
cdd064d40c76753fcd435b8461e9571af32121ac751bd2991acd3c2f3bbdec671138310716857cf02995934e0d49f31a216909a82a117c5c1009b7a835623a8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
6c2e62f9e6993b3bd5c13c4a33377c1c

SHA1
e258a9f3c0eb16db2fe87ec8741287f86dcab9c2

SHA256
f63dc9b515c4a4375bd3c9a3ce3b99b7088f581db6e72f4712b23be5e46803be

SHA512
749ec53c5181b7186b0903cc47202811ff6847fe1bb505f1468b8863f0e21b3894f8e174096f492f590b518ba32fd364aa6d2d61b11e084273de1a1bcf8d533c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
20f9d4bb96c85d6da77269d25c17da49

SHA1
617f46878f464e8a1a94bb5b6b7af1d24edbf9fe

SHA256
d5680fe02779fe850ca34ca87053b471282e83588963199b47e26d501ace38d5

SHA512
f7ed84297ababe55f6149ff68bc7bff17b835202486fea78e567f42ea14d20aedb316e89440949e6616ddbbc0f22beb789f6497ec841b74c5c61c2d29492e8bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
776bf0f3bff83dda5ca210d737b7dd32

SHA1
b83dd1f63c1d1b6556bc4ec98d27a40c6a648722

SHA256
5ad7a7840f07062324c3f851fd845d36842d69bfd5e0bdf1e277a31370d83465

SHA512
1f33a438b658d0096bce6ed11fc1c1aadbb182c80b8cda6683c6c4a97a9c13c72315d4eb23009f22309efd35e19797f6cf9636c6dfc1bacbb55c97c148a8ae9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
451ff7fb9430ba5c5a8dfb8d06076397

SHA1
e868bda987bbebefb71fb05c391ff3dcd4f2a555

SHA256
8559eb245e750d75145a1f7a723b7ecf0a6c8be311c020635334265caa0f41fc

SHA512
fa4b6b3d38929523a116bf6ec9a5cc1afc2521c219e5ba8f3fb025492632e5ed2aaf7e372320f0d70ec414d52628a1849268391d67b6e24db23ee6e46b272620

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
deac7152c3e0a569edb779fa8498f3d4

SHA1
0c1d1ecd3976e1b067c29a3d0219bb7b32fb2b01

SHA256
23df3e13f8547c70a195c06339c849274a15ab4253df77e4ece02321fdb9c685

SHA512
0d9c4a4cc907a676ef7eefbe93c507283c09484a8c83e78b59af524a4fe869a4a0cbf4d8529d931dc849ecf3d1b5fe525f04bb85eddfe564ad0d21e5de38c15f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
29KB

MD5
50fcae8ce7bd7fab498f418e543d8e3e

SHA1
8bf4e723e3aaf0db866073afa64bc14660ffd95e

SHA256
447a8e675b311d801dd41d260d8f791ecb23f802362eb096f572c7198611d8e5

SHA512
e3ff1ced8c578909345e8b5d7d7e098fac4bf6cae0a3bb1dbb2b2d6318a4c4ce86e76b40d7f8b17d0b65bfe2f252e7eecd7eafefca8b27621595340cef78523f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\66LLJNCU\www.bing[1].xml

Filesize
19KB

MD5
0d8273719c274fd17fd6c615fd427b6a

SHA1
8aaa6b3f8b35afebec5aa23d81dfc271d2302285

SHA256
157e35a26df821165d8f6044b0bc2a8a12eea17eed17c975162a61d78086f033

SHA512
e44e62fcca9c751fe92ccd91e1662a4c0c5b67f5cdfbe75356055c327690f9fc8fbefac9750e997ae90ccc7bf6b5a3c05a90a954b0a91dd656859b0994d0b857

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YOZOSN6K\microsoft.windows[1].xml

Filesize
19KB

MD5
aa07bcf9e6c8ffee7295a7364d50d4e1

SHA1
525736b23be058a6b0a2881135c5379b1251d038

SHA256
89dd99ef849f928f9693756534ff2e5a1a478cf61ac18110e6dd1532458310a6

SHA512
73e6261809c77f6bdcd491d2891a5a9d3e187be6c29f5ebf5b91fa16715dd01f8d6e245378a37581e8946503667ffa9137724de5eb5278955a2c915b8fbe14a7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d51ed2ae-9c12-4ad8-9193-481b24b3d00a}\0.0.filtertrie.intermediate.txt

Filesize
48KB

MD5
b89fe034bd9fe9dc69b7bd8fcff3e232

SHA1
d9da090d98726e0d614e6335982366c60749769b

SHA256
4da5fcea7121c7892c671fe2b8ae02aa59cbc325c4cc9fe66350a73c220684f7

SHA512
934817d3e9e335c5975f8c6f12b9418ff466ccd6a9e64315448d2036c777f123177871469192ec8f9df1dc6c82907b23f3b18a5b8bf4f9918c3a7aee999dd0e1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d51ed2ae-9c12-4ad8-9193-481b24b3d00a}\0.1.filtertrie.intermediate.txt

Filesize
19KB

MD5
c036d4b12606b88896d3060d228f56e6

SHA1
4750c1d5d325a08f91e4d987bb3533d3ac83be47

SHA256
687049f389d6dd612fdd856d103c983fb73f36454c588756c4a400993c754638

SHA512
e4d3697ab38ccb39c95c58415d1bdfe375a51aa387e6728df5ddb130feeefb479396f77877448e984f5fec2bcc3e13ac802d80da39726456e0eaa89942a296d7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d51ed2ae-9c12-4ad8-9193-481b24b3d00a}\0.2.filtertrie.intermediate.txt

Filesize
19KB

MD5
b8c519848bccb10510b95a8995ebb99c

SHA1
77120ffe9944f4c4d4c2f6ab0d1c6da10fe3c3a5

SHA256
9a2ebfa94415f64f32035d60ddd5803209c42a1afbff8823821fd2151b61dcbe

SHA512
3a9e9853dcd900d55ea12a8508ef886e9faebfa6074512587383dc5ae7283500b07d62013e87f8a94f55650d99bec469bf69e02442bc265a65b45880e9575b50

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{e4a41fe1-9bc8-424e-9819-503ceaaeae89}\0.1.filtertrie.intermediate.txt

Filesize
19KB

MD5
dd37a3c3dd91841e952971fee9f3fd61

SHA1
2baa87e79de2e9668b44d6707b3929b0d68775b8

SHA256
8bb399a2ff8bf8a20c7125ecee39997c3a5d8e63097e68556f89515a185a6fe9

SHA512
1487b4b510ab94999fd89cb57f7cfa252e031c231cb3116255f622a434ead99483d4b6903d0f854eada95fbdd2d3c7950ae29cb59d44b85bf1447a6c183c2163

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{e4a41fe1-9bc8-424e-9819-503ceaaeae89}\0.2.filtertrie.intermediate.txt

Filesize
19KB

MD5
22610843ee2809bf3bce50cb95ddfd0f

SHA1
a7ac4564a0e4badf39dde7d71a8c18578ce3455a

SHA256
c6c4235760147915672d31f5ee3d5bfbf0f81cba35db69cbeb7c4300e4f046d9

SHA512
a01368532f335cfb46bd3b0f9ec00f93281ba2c7abd5db3f4bc57e494412a606a81ce8dc5051b198ec4afc0620eca2b3e2e3b6f43bff166b70bdade96ce7f120

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{effa0606-8acb-413d-aea6-39359a1bc261}\0.0.filtertrie.intermediate.txt

Filesize
48KB

MD5
19046ef5bb6eab8dece5fde3418b9062

SHA1
4b761217ecaef1420c9fa19dff3a1491d4869d13

SHA256
34038465c244b5ff431a0915fb02b4d7db33e3086f52c4e73ee8f3ea779bf741

SHA512
e055d8ccdeceed8acd978ea924ee1290a33244f326195a90ed31d0ac42f3781163b358653eaa1f3eeaf99719937497b498f4ba17e54176dc672bec33dfa838a5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{effa0606-8acb-413d-aea6-39359a1bc261}\0.1.filtertrie.intermediate.txt

Filesize
19KB

MD5
1553437545da1e79152b3b6c258ef31d

SHA1
37225606ed288797ac5c8de16ad0ec2fb47e7576

SHA256
955ccfeda5f8e1d229f9c7a18b4330bdc242079ab5acdebe6cddc22f6c9cf4df

SHA512
c413af076bbc438ccf1838bb5c49112f0940901ca4d02c8636c86260e671190f2bb8e438b7e8dc5b4c8d2d45147d5f49208344efd2479d054190e63603f823b5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{effa0606-8acb-413d-aea6-39359a1bc261}\0.2.filtertrie.intermediate.txt

Filesize
19KB

MD5
7ee7421b3f8ea326556e05df5884f9e3

SHA1
cebeb3aee52971fc3be56d973cd36fb03d3a4330

SHA256
f9aa21f7e33341b8981daf5380c2faf8abf6393acc31663eafc39fa261889875

SHA512
531c9435bac28afb0fa8e6cd3bf6ef8b29cb53d64f644f97938e5b4dcaef83718dd087f87985a6eacc3d03b0bc9cdde744a8d00a4e603eb8be64828e27205edf

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{1b978ce2-bad0-49a7-bea4-b5463170261f}\0.1.filtertrie.intermediate.txt

Filesize
19KB

MD5
1a158d60055250223e1a204ee79d4957

SHA1
68503c9329747d79f3650d3b16e70bc87eff6dfc

SHA256
43e5297817d81249725aace328e84965c8babd6d6b1b372a10c3ae8fb60f12a8

SHA512
2d59c5d8d4fd698c2d648b0f5ec83161c0c73eaed31d9aff1358c679f6574168e99f342f35f7ea11477689d2d4bfa177c987b196799d69ce18d67f574a67cd75

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{1b978ce2-bad0-49a7-bea4-b5463170261f}\0.2.filtertrie.intermediate.txt

Filesize
19KB

MD5
0199f6c5bc8d3c8c933b3ef02e297692

SHA1
9b468f4bb4b8c1fc95beacd6121a3bd0d9db61b0

SHA256
49ee19a68fd725749e55396071c4021f3594bae6e229349b98ee832bcfb13f0b

SHA512
0272d8b04a810c641816cc8b4f996d8ad4b8628d4c90909153104014bf87aa686161222104f995b4877d1de2e6c4d36fa27a90c15b27578100f82a874cf88e9c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727655568993544.txt

Filesize
97KB

MD5
25770154848f1fc896a85b2d0fbe93ab

SHA1
0d03a735ee6e51ac2cc5ad58ca4a716dcb7dc2c2

SHA256
213ea18f3327cd9271e1842535117da1079d94a2514161a7d23a0f2b85f60cf6

SHA512
a6434e4c6ab321e4416364e7cbee18fff322f9cfc6b63062911be64daf872f02a1689f4451624cb632383b1741ea4328b1e111e7803d5c07def2157d4cbab6be

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656325443828.txt

Filesize
97KB

MD5
048d6922dab2904af241694f540e73f0

SHA1
0629fff2bf53aebb53dcd4b6b928867934fe6d86

SHA256
ae6bbd484b55b192958132b06c8032e652289dcba292a2ce27939df67fcdbdca

SHA512
0c6c7ee5c84a5585e814421883d380f07d5f432ca123a97fd7382a92839dfa1bd744614a3d68ad4249343d78b4330141aad89f1912bd56f18970654fe170394b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656867584287.txt

Filesize
67KB

MD5
14626ce3360ea5550deab522e4b3700c

SHA1
6d5d84e6ae414077a4c078ac51e3e579ea873884

SHA256
f623ed6db67536ae3c314b96e476fbc823b6f3fe08743ec253b5c73fc0ad0f3e

SHA512
07f3bb241299b1000173e1d2b6d53ff9a114647ef025367f97f1ec5f75560eba8e942b0b16c3d26e24b4e4c475606f92125a1601b7939391907f692fa324e079

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727664505006447.txt

Filesize
86KB

MD5
2f7d40e5cc89e44420e1dda64658aa87

SHA1
7aa26b6f0cf555542ca6d49dddbf8569f56e99f5

SHA256
20ccb1d37365ae83942302265e82cb70144e4c61191d95f2895771045d3283b8

SHA512
da5a7db6f82fab7b8cceeafc7f3e1332c134e5c9451a0eacee0acf18dc9ff3945170e991cea39e9b9c78958b652841aedd1c574eae67e3668eec937da4554fef

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665107442487.txt

Filesize
94KB

MD5
2936a555b72ae318bae12bbe7d9b0bfa

SHA1
6d4da7475a6fbb0acdd2253c1a0a9824b16c75f8

SHA256
7f0d2dcaa6bfd204e36e01fdc893c0d0934cccb70f2b77e4a66ff26526bd77e5

SHA512
8f9e7f35983e21e7dede36e8856c0e3c07196588dbadea7fa2e3fbfe1a8b15a35fab606e1d49c1f20c0f69124d28bce789c0a5b5c0952fb7dcf3df9add1c96d2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727692396790496.txt

Filesize
94KB

MD5
ea708a9811387b4d7d19566667528f1a

SHA1
09c299ff205d178668be20c7e35bada8660edb04

SHA256
e24bb45ac2baf60ffddcbb8e0024a426067cc194bfe21041f55ff7848cc2b2b0

SHA512
7e9c1584ad4c6fdd86aebcd0025e9581dc281f2d8f31ef20c653d7237c9b8282ccf3740153557210bc9f5d3f579f9ab11a5fb4c76145fdb2627ab1f41f626aa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe

Filesize
370KB

MD5
2aea3b217e6a3d08ef684594192cafc8

SHA1
3a0b855dd052b2cdc6453f6cbdb858c7b55762b0

SHA256
0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab

SHA512
ea83fcb7465e48445f2213028713c4048ac575b9c2f7458a014c495bddb280be553a22b1056284efad7dd55c2a7837096755206581c67bb0183e4ac42160011a

Download Submit
C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe

Filesize
370KB

MD5
a890e2f924dea3cb3e46a95431ffae39

SHA1
35719ee58a5771156bc956bcf1b5c54ac3391593

SHA256
c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a

SHA512
664fb8075712912be30185d17d912dae148e778627e852affe1b1080bb9c8d5917e7b3c1d194e62ac6919c16235754f776523ba7ce95af38be86b61cc3e3d162

Download Submit
C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe

Filesize
329KB

MD5
adb5c262ca4f95fee36ae4b9b5d41d45

SHA1
cdbe420609fec04ddf3d74297fc2320b6a8a898e

SHA256
e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573

SHA512
dad3541217a7f1fde669441a3f987794ee58ae44e7899d7ed5ebdf59e8174e2924441ea8474701908071df74479a4f928b673c2d9086c67078a2a861b61ba754

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
3e8ff154ccb80d87d48bff0da59aa61b

SHA1
1dfc14a03e001b5493330cbbb696c64e161d7f7b

SHA256
09fcddb45b02d84d44c280459c16ba06f9f1202cf53904fd8633fc133fe79dd6

SHA512
ee7c2a50ec3a515f06d5332c79bdeb562ece0b17e0f4003270b62f28376e35ea7e4734122c4f3df564f6ddfee3a50acca93597301d5b580c217750ef51b737a7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
1KB

MD5
db4478b8e1c5637877ff98d21124e8ea

SHA1
f68458448b660b8289d4b5fc53d69b52b6d96872

SHA256
fab8d0b4f7e2b02a5d8ffbd7d9f56a6c4720762e20b501438e22cffd566fd0fa

SHA512
a9d52a7e8886a4624b834afb027a79e90b35683f115091b228f360db422715bcce7e7608961050e7d6149b381a8a8eb2dc1f4990a9ce359aa5b050d30184599d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
0c10252c208c70271f067316ac8c782d

SHA1
8e41c486723a7d2e1ff2e476882ad6ee25393802

SHA256
8b570dc69fa377a786207d2975ecb57391765c953c2316e36ba289c58a4fb487

SHA512
ec70b8d6ffb89bb989a23b0cd8342ce3942497b36b00600de8da1dad698e07e0370d9fea48a270faa5b3b2ef593ddbcdfe1cbd8d18b6c6ab164556254f60257f

Download Submit
C:\Users\Admin\Documents\DebugCopy.wps

Filesize
432KB

MD5
f7743c1812d56f0a946e1f8b9ebad719

SHA1
24f2008c4f1525356169f6ba1d64c9584141eb2f

SHA256
939c3961cf7db0bb0fa5f9bb8854b42fd917ed946d1ec4646b952efaea70e86b

SHA512
44aed476f99b03cefc7f8048e17f0899a78857118e9cf937ea767f4457a24b5f5d76a828d85bae29cd9db80a1515f44c5cfe053e9a590bdc3f95e45e7e704635

Download Submit
C:\Users\Admin\Downloads\Ransomware.Vipasana.zip

Filesize
638KB

MD5
8d2c4c192772985776bacfd77f7bc4d9

SHA1
3b923b911d443e321e551f26c9588b16a994d52e

SHA256
1733b199a7063443c167e3caeae7dda2315f590341ea2152a9b132e1ad8e94a8

SHA512
6c24f2fe498cf38e3f3d66b62915e6fbc8c2746a1d4c3c3de270f994b02e1369b9540099c12d150712574ececbe63c8c9f28877d8aa4557fbbb7890d5a0de6c1

Download Submit
C:\Users\Admin\Downloads\Ransomware.Vipasana.zip

Filesize
638KB

MD5
10fd79c172f1b0e64c5826575e295720

SHA1
5feb43b412ae0a88f9040cc66ceb57b564f90cfb

SHA256
760ccff9aa3c4930621fde21a05ed0b16a652dfd926e18172cb3c001c16cf4e1

SHA512
8d7d4f93cc3033db798070a7ab7b43e2e1ba714f8c52078b7e3354beba4132fad83856dd81575732ecd658091d82435443ef77a50ba805b64a889f2bbf9ed1c8

Download Submit
C:\Users\Admin\Music\TestBlock.avi

Filesize
627KB

MD5
05dd69f6e5b4889650035d56f23ba966

SHA1
d13c2f2f05876ece60a1dbc03f935fa5d31e596c

SHA256
ea7532127dcef496f60feb63a5e0ade8bdb83cc0a9a12cb9974536d9277f72ed

SHA512
748c7188184bdc4b0efb1188d2f8cad03840aa16f76c7e3a541d2ed45a50fae6b74224dea8191105244404a4036efcff2c06b614cc642d046a509debfcff7108

Download Submit
C:\Users\All Users\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserManifest.xml

Filesize
2.1MB

MD5
fbc1212c5dfd8fe813705a498561fbaf

SHA1
7c41fb2db0630572ef5d5d7cedc38b61ef48b2da

SHA256
3cdb54c86f2208a624ba0eabd40c501e0fb1fc0fb108e36805dcf1b8624882f3

SHA512
cc01f2ee718e4a775a631373fa7153219b1403da44d3b718fc97911f488338209b0a456cfb19bc176f4c45dd75ec820c0d91c8496ff3623e7d8a7158be9959ea

Download Submit
memory/636-2571-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/800-2489-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/800-627-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/800-2095-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/800-1363-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1168-625-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1168-1361-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1168-2090-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1168-2487-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1756-312-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2768-1362-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2768-626-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2768-2091-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2768-2488-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3280-311-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3420-309-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3992-2451-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4328-1663-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/4328-1654-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/4328-1653-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/4328-1652-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/4328-1664-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/4328-1655-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/4328-1656-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/4328-1573-0x0000000008800000-0x0000000008810000-memory.dmp

Filesize
64KB

Download
memory/4328-1645-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download