Overview

overview

10

Static

static

10

The-MALWAR...er.zip

windows11-21h2-x64

Analysis

  • max time kernel
    378s
  • max time network
    387s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27-12-2024 04:14

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    The-MALWARE-Repo-master.zip

  • Size

    198.8MB

  • MD5

    af60ad5b6cafd14d7ebce530813e68a0

  • SHA1

    ad81b87e7e9bbc21eb93aca7638d827498e78076

  • SHA256

    b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

  • SHA512

    81314363d5d461264ed5fdf8a7976f97bceb5081c374b4ee6bbea5d8ce3386822d089d031234ddd67c5077a1cc1ed3f6b16139253fbb1b3d34d3985f9b97aba3

  • SSDEEP

    6291456:wNl3aFW2h9/fiTwCzCLS6iilVkLZgAEtknRzq:wDaFd//Orcpi4VkL6AfRG

Score
10/10
chimeralokibotagilenetcollectiondefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://blesblochem.com/two/gates1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Chimera 64 IoCs

    Ransomware which infects local and network files, often distributed via Dropbox links.

    ransomwarechimera
  • Chimera Ransomware Loader DLL 1 IoCs

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

    ransomware
  • Chimera family
    chimera
  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Lokibot family
    lokibot
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (3294) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Disables RegEdit via registry modification 2 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs
    defense_evasion
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 26 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master.zip"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1376
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3488
    • C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\CookieClickerHack.exe
      "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\CookieClickerHack.exe"
      1⤵
        PID:2848
      • C:\Windows\system32\BackgroundTransferHost.exe
        "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
        1⤵
        • Modifies registry class
        PID:4052
      • C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Spyware\AgentTesla.exe
        "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Spyware\AgentTesla.exe"
        1⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4960
      • C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Spyware\HawkEye.exe
        "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Spyware\HawkEye.exe"
        1⤵
        • Chimera
        • Drops desktop.ini file(s)
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: RenamesItself
        • Suspicious use of AdjustPrivilegeToken
        PID:3016
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -k "C:\Users\Admin\Music\YOUR_FILES_ARE_ENCRYPTED.HTML"
          2⤵
          • Modifies Internet Explorer settings
          PID:1084
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\YOUR_FILES_ARE_ENCRYPTED.HTML
        1⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4212
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffba2623cb8,0x7ffba2623cc8,0x7ffba2623cd8
          2⤵
            PID:2548
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,3365244310957878805,15661664107909245161,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
            2⤵
              PID:988
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,3365244310957878805,15661664107909245161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2716
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,3365244310957878805,15661664107909245161,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
              2⤵
                PID:3328
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,3365244310957878805,15661664107909245161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
                2⤵
                  PID:3920
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,3365244310957878805,15661664107909245161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
                  2⤵
                    PID:1720
                • C:\Windows\System32\CompPkgSrv.exe
                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                  1⤵
                    PID:3424
                  • C:\Windows\System32\CompPkgSrv.exe
                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                    1⤵
                      PID:468
                    • C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Stealer\Lokibot.exe
                      "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Stealer\Lokibot.exe"
                      1⤵
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2160
                      • C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Stealer\Lokibot.exe
                        "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Stealer\Lokibot.exe"
                        2⤵
                        • Accesses Microsoft Outlook profiles
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        • outlook_office_path
                        • outlook_win_path
                        PID:1976
                    • C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Annabelle.exe
                      "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Annabelle.exe"
                      1⤵
                      • Modifies WinLogon for persistence
                      • Modifies Windows Defender Real-time Protection settings
                      • UAC bypass
                      • Disables RegEdit via registry modification
                      • Event Triggered Execution: Image File Execution Options Injection
                      • Deletes itself
                      • Impair Defenses: Safe Mode Boot
                      • Adds Run key to start application
                      PID:3468
                      • C:\Windows\SYSTEM32\vssadmin.exe
                        vssadmin delete shadows /all /quiet
                        2⤵
                        • Interacts with shadow copies
                        PID:3496
                      • C:\Windows\SYSTEM32\vssadmin.exe
                        vssadmin delete shadows /all /quiet
                        2⤵
                        • Interacts with shadow copies
                        PID:5040
                      • C:\Windows\SYSTEM32\vssadmin.exe
                        vssadmin delete shadows /all /quiet
                        2⤵
                        • Interacts with shadow copies
                        PID:2192
                      • C:\Windows\SYSTEM32\NetSh.exe
                        NetSh Advfirewall set allprofiles state off
                        2⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        PID:4764
                      • C:\Windows\System32\shutdown.exe
                        "C:\Windows\System32\shutdown.exe" -r -t 00 -f
                        2⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4904
                    • C:\Windows\system32\vssvc.exe
                      C:\Windows\system32\vssvc.exe
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4316
                    • C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\7ev3n.exe
                      "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\7ev3n.exe"
                      1⤵
                      • System Location Discovery: System Language Discovery
                      PID:900
                      • C:\Users\Admin\AppData\Local\system.exe
                        "C:\Users\Admin\AppData\Local\system.exe"
                        2⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:5044
                        • C:\Windows\SysWOW64\SCHTASKS.exe
                          C:\Windows\System32\SCHTASKS.exe /create /SC ONLOGON /TN uac /TR "C:\Users\Admin\AppData\Local\bcd.bat" /RL HIGHEST /f
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Scheduled Task/Job: Scheduled Task
                          PID:3948
                    • C:\Windows\system32\LogonUI.exe
                      "LogonUI.exe" /flags:0x4 /state0:0xa3a34855 /state1:0x41c64e6d
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:4584

                    Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Windows Management Instrumentation

                    1
                    T1047

                    Persistence

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Winlogon Helper DLL

                    1
                    T1547.004

                    Create or Modify System Process

                    2
                    T1543

                    Windows Service

                    2
                    T1543.003

                    Event Triggered Execution

                    2
                    T1546

                    Image File Execution Options Injection

                    1
                    T1546.012

                    Netsh Helper DLL

                    1
                    T1546.007

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Abuse Elevation Control Mechanism

                    1
                    T1548

                    Bypass User Account Control

                    1
                    T1548.002

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Winlogon Helper DLL

                    1
                    T1547.004

                    Create or Modify System Process

                    2
                    T1543

                    Windows Service

                    2
                    T1543.003

                    Event Triggered Execution

                    2
                    T1546

                    Image File Execution Options Injection

                    1
                    T1546.012

                    Netsh Helper DLL

                    1
                    T1546.007

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Abuse Elevation Control Mechanism

                    1
                    T1548

                    Bypass User Account Control

                    1
                    T1548.002

                    Direct Volume Access

                    1
                    T1006

                    Impair Defenses

                    4
                    T1562

                    Disable or Modify System Firewall

                    1
                    T1562.004

                    Disable or Modify Tools

                    2
                    T1562.001

                    Safe Mode Boot

                    1
                    T1562.009

                    Indicator Removal

                    2
                    T1070

                    File Deletion

                    2
                    T1070.004

                    Modify Registry

                    5
                    T1112

                    Credential Access

                    Discovery

                    Browser Information Discovery

                    1
                    T1217

                    Query Registry

                    1
                    T1012

                    System Information Discovery

                    1
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    Lateral Movement

                    Collection

                    Email Collection

                    1
                    T1114

                    Command and Control

                    Exfiltration

                    Impact

                    Inhibit System Recovery

                    3
                    T1490

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Program Files\Java\jdk-1.8\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML
                      Filesize

                      4KB

                      MD5

                      c452b6ab5fcf2f46692d3b2e9a63a2df

                      SHA1

                      3b8ee5ea327fcfb0f0d8e7c8660373c5777b21e7

                      SHA256

                      19c3e66dbd632d2081bafae5b94c3583601c6e532650bc521d4ea58474c359d2

                      SHA512

                      8578c8da31b1caddbe841c07652887c83027c0529158c62a9506736e28c694422547082a71f375a5c4f9630e185d88cea3b49628798c9929473f9045b882b495

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      Filesize

                      152B

                      MD5

                      e11c77d0fa99af6b1b282a22dcb1cf4a

                      SHA1

                      2593a41a6a63143d837700d01aa27b1817d17a4d

                      SHA256

                      d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

                      SHA512

                      c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      Filesize

                      152B

                      MD5

                      c0a1774f8079fe496e694f35dfdcf8bc

                      SHA1

                      da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

                      SHA256

                      c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

                      SHA512

                      60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                      Filesize

                      5KB

                      MD5

                      0fb5f3b3a746b927fa29db329c2d98c5

                      SHA1

                      65d7d9aa03dc70759c40543d260d22a80b004db6

                      SHA256

                      bc6781ae601f5cffcf6e7a5233fe37dc11deae5137ac627707fb8f96710e7e22

                      SHA512

                      5e55b3cc7da8337a03fce4d96e5676ab87e23d8ca600453f20dc6f1b8e043ad9600ddebe2d16f30b7040ca5c4c0bb1823b9d91be800d995de5a24c74a75a40f7

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                      Filesize

                      5KB

                      MD5

                      6374f3b67576d9f47a2803c736fbb49d

                      SHA1

                      d89bc5cb0c21273d814bf633d5974d36decf6763

                      SHA256

                      4b3dd7ebe2798d304951b9b3cb684bda8e9e29e6cbdc86b1d79e6233ce2943c5

                      SHA512

                      1b1c8dcf0994936a5bdd51f745b8a4cf7387d46e3e18fe25eebb9628a3f37e8f7d07c14bbacd1cca79f6a8c29234a59f25d90be4cfc2c7a48f1cd355aaed169b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                      Filesize

                      8KB

                      MD5

                      85f6b19b50c2b98608a8573e87415e68

                      SHA1

                      962600c656de188c9425cf550c5b376fcbaedbf0

                      SHA256

                      978c36cf1303c59948861839f83b6cdff50a30cd1507abc9c67fffb3c8ed7315

                      SHA512

                      2c037d811111a93bb6db609830d17dbfbdc1b9b527cc604229ff08cc232ddf888e8620cdbdb3c3f546ed79bce347497795fe4b60cec3410d46cb4e709aeed5dc

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
                      Filesize

                      264KB

                      MD5

                      f50f89a0a91564d0b8a211f8921aa7de

                      SHA1

                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                      SHA256

                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                      SHA512

                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                      Download Submit

                    • C:\Users\Admin\AppData\Local\system.exe
                      Filesize

                      315KB

                      MD5

                      f72f443db1e56e4498c7aea8c75a99d7

                      SHA1

                      6f0ab3787e45a19900bb4eb283098ec09c35d3c2

                      SHA256

                      ab599a0b6f5ad0e68f7f8ba589830aacf44e59a9bb15a12c21e833f2b0ce8f08

                      SHA512

                      36e5113d7a020a8eaf9950f124eb6e6b214975fa60bfb39633e1c233b9e1c044927230c7cd72d5cc73406613eebc61c41b76e13caa1b7928e466472b4f29c5ef

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3973800497-2716210218-310192997-1000\0f5007522459c86e95ffcc62f32308f1_43ef074c-17c1-4956-ab3f-c3b0c6ae62b9
                      Filesize

                      46B

                      MD5

                      d898504a722bff1524134c6ab6a5eaa5

                      SHA1

                      e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

                      SHA256

                      878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

                      SHA512

                      26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3973800497-2716210218-310192997-1000\0f5007522459c86e95ffcc62f32308f1_43ef074c-17c1-4956-ab3f-c3b0c6ae62b9
                      Filesize

                      46B

                      MD5

                      c07225d4e7d01d31042965f048728a0a

                      SHA1

                      69d70b340fd9f44c89adb9a2278df84faa9906b7

                      SHA256

                      8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

                      SHA512

                      23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

                      Download Submit

                    • C:\Users\Admin\Documents\CompressClear.odp.crypt
                      Filesize

                      1.2MB

                      MD5

                      9fa48bb6f4c0a362bbc15beb7341ecc2

                      SHA1

                      8a88205803f0036c405cb4e8aaa1d7056750ebb4

                      SHA256

                      7c0c1d492f1563c9b066300c3aafb2e02986b03ceade3da1e4819387e0e826c3

                      SHA512

                      1214dc2a533a8c5aa0692c6c082e3efd6a9618d9750af523ec7d411e5a47c7b7794b95230ddf626c79d640ce12d02e8fbcb7706d3dacbc794101fcadb28d7d44

                      Download Submit

                    • C:\Users\Admin\Documents\CopyAssert.wps.crypt
                      Filesize

                      1.1MB

                      MD5

                      b6572f86a60753a0808859bfa783a560

                      SHA1

                      e8800976891b1241696d2e5670e9878c53c264fa

                      SHA256

                      4f42679b0cdba9ed6c37c572629ef950a5cad8d04b1c6a7d3a15babde8c1415d

                      SHA512

                      4a7bd9409c5d6e7dd4ca76d3d486de88521fab79a49caa32d57341d25ce0691d0ff49631b5bfc5e53ae70ce64a01c46fb3d9a2e1c4cea8fa7f9b86262d7b6bd0

                      Download Submit

                    • C:\Users\Admin\Documents\DenyRemove.pptx.crypt
                      Filesize

                      1.0MB

                      MD5

                      37044bbad2632d2ac828c9309012b473

                      SHA1

                      132c96151139a372e07400d5b7ed5686f76aefb7

                      SHA256

                      e7b9758ff533d81d882ba3c8bc87931ad3d36f3f7935cffd7ae0ffad2e57bb85

                      SHA512

                      b435b0aac445bfc81760aebdffe742bcc6f07ec1aba85016a8448e49a396a5c23687cf6d9589d8b2f27bf91adba7743dc9a9daf259bb0ebaa17e0f3a69289d26

                      Download Submit

                    • C:\Users\Admin\Documents\EnableSearch.pdf.crypt
                      Filesize

                      580KB

                      MD5

                      a961d9cc4f00ff129d123242c5d7eaa0

                      SHA1

                      4df0b27913415759e0534428558b30785dd726fc

                      SHA256

                      d8d6751df13fd70da8b5f5c693bf99d900d2b4f959c9b96323305384e10de5ff

                      SHA512

                      ec7bf53852a2f4ab125acffd0492127d3f05e12b08b59e3e9a7f026e87381a9e03ada0345b2c973b4517ceed77d411ac47977c47938047d72c3553b819bee9b8

                      Download Submit

                    • C:\Users\Admin\Documents\GrantImport.xlsx.crypt
                      Filesize

                      13KB

                      MD5

                      717b6d37dcb25f5504c299690c5121cc

                      SHA1

                      abc1343faa94aad53c522187193c2628e94e4a5e

                      SHA256

                      15de865011d6d808a84d4fe141cab50a5127b86d5a8483b4104fa08415b4cb0e

                      SHA512

                      eeeb966fce5dca54b5c985ac311a509944ad7fc4290b81884089d63fbfee26d0a45d86de266220a8777ed804f930ea5423464fac2ccc0e0ac8290a51bdc680c4

                      Download Submit

                    • C:\Users\Admin\Documents\HideTest.docm.crypt
                      Filesize

                      522KB

                      MD5

                      24cd078c83db810a407ac0cebb3c2bf8

                      SHA1

                      a965fdcde90389c42bc8111afe34d6845cfd7f0a

                      SHA256

                      1fc1be3882f16b9ae104678f0627c8c3db1b92869cb82a1e548d95cf1a9a971a

                      SHA512

                      e3ebb97510c7eb6c6a95d76948f8cd19b396ef0030025e96e48d82054c10973fd90ddf489b1a61ad7f95c72fbbd25a8168525bab9141c26a25c63f4a271117e0

                      Download Submit

                    • C:\Users\Admin\Documents\JoinGet.csv.crypt
                      Filesize

                      667KB

                      MD5

                      09c6160adae1e6ae279e851cd148bfa3

                      SHA1

                      9388d3a20e3f58d2b76b8982188e88cedc83db62

                      SHA256

                      8a3aa67470c69cefcc5ec7bf7ef021450e769519ee2dcec5f959d4d75bd82f74

                      SHA512

                      ca026f21cc704e34aa748f05e83b38c739960df141c8139d2b10ae35fd0d4e7c7e383e6d55ace6d11db56c0b3eb52729293f035e4ada523a0c3b0c3cfd278213

                      Download Submit

                    • C:\Users\Admin\Documents\OutResize.xlsm.crypt
                      Filesize

                      986KB

                      MD5

                      0135e3603cfcfc5dd0c3ba2c371b3b2e

                      SHA1

                      9794359beba600b486e9ecb5b4dc89e51ed84d89

                      SHA256

                      7ffbcfb96afa37115e0b0d60f02006b36903df0172d0e997067e08a789348fa2

                      SHA512

                      c5fa850dcbd80f6a427f4da379c9880d89779839199ae985435c01de6d97c0a7f33709f70ff92a22a05a3cbf02262647dda2151fef4342687bf982f13c793267

                      Download Submit

                    • C:\Users\Admin\Documents\PublishDebug.pptm.crypt
                      Filesize

                      638KB

                      MD5

                      0a90940c639bb6c19002383016045683

                      SHA1

                      46b5e223824e60b861707ff187e52b8ea7117480

                      SHA256

                      b27b34d5d9fc768cf4deddea0898d042ca369512028b2b44cac02af63b1438a1

                      SHA512

                      975c1475773c0222b211bbca6ac48017d6b667589118262896ae3279a8bbe8d2978a956ec6447a860166ef74b101cde232805dbe3fedbc1cc94a89f1ea8ee3aa

                      Download Submit

                    • C:\Users\Admin\Documents\RestartRepair.txt.crypt
                      Filesize

                      1.2MB

                      MD5

                      8e5140999b73ff55e2179e34e347b330

                      SHA1

                      a16a404f727827f3df47acb681a16ae52a5ac2ff

                      SHA256

                      1874188f09993ad10913c0466e5d52415377fb5bdae4cbc0d08d608d6fb1daf5

                      SHA512

                      ba8680ffe89fb43a037afd9652ffd4a245007e5fd4a53d99508fdf35ae1b4f67d7bb5c48e30a11556f8137e3447f5c01fe837c9c327114d8f08289b8514a9671

                      Download Submit

                    • C:\Users\Admin\Documents\SaveOut.pptm.crypt
                      Filesize

                      870KB

                      MD5

                      a4153b7f0cd500ed6c3ee75c4f251cd0

                      SHA1

                      c0cf56fe37c660579298a6838374d7a38c3cac55

                      SHA256

                      e12ee44dac49220d942a4e7c258f2f42dc6536954ddccc84d2833a0b0020f70b

                      SHA512

                      aba35405d71a2febad7996d76ce6ac925d2aa6f32752e41c67146125171e4d17f52c8f0245badff4626aa762264bb15dc580efe46141d0f44961975ed61bade1

                      Download Submit

                    • C:\Users\Admin\Documents\SelectAdd.xlsm.crypt
                      Filesize

                      1.2MB

                      MD5

                      2b25397d7631df80198fb706c46d9890

                      SHA1

                      5276a7c44c9b8de14bdbfc844c50fab991c10305

                      SHA256

                      5219cde4ff9906725d7c8bf7605a8f65fc3bf0877d4a0d2d2a4f1b035790a18c

                      SHA512

                      591f1c030e34707fa4f147bf34caa3cd1eb301e0b0f7229b7f0ac377fce6c89cd71dd67c51312eb365cedde2c06a36c41a6c51cb2183b6cc5bc77dd942114421

                      Download Submit

                    • C:\Users\Admin\Documents\SplitCompress.docx.crypt
                      Filesize

                      14KB

                      MD5

                      4521285388eb77822b089733e176e614

                      SHA1

                      6cb9ae24f67214d0d427bad667966a5c59142f2a

                      SHA256

                      a51c48eaf1c71fc01c4ffa24b27eee506ca9ecb88e462da8f9bd693f814bd4f1

                      SHA512

                      46847bab85a8ad80d1a57024e78d51eaeef184fcdabb381b8207e7a4382e13ee291cc9cb06510e52668bb51680a0cdd8cd6fe2856a6913a06529bb7f87f25599

                      Download Submit

                    • C:\Users\Admin\Documents\SplitExport.xlsx.crypt
                      Filesize

                      13KB

                      MD5

                      2a4063e1de21f46c7deedc31bd6b5412

                      SHA1

                      9abca40a6da30692c11d8932ad20ed6fa83d58c6

                      SHA256

                      158e7939a701dc9bfd3461481d43cf3ca4a7c59e8e8ecbca405a1fa2496d009b

                      SHA512

                      976180b43d6258fab992fa44d4e0d9c0789cce958c248a909ab16f96b0c24b07bbc0fc01d086006cca192640af8861d8bc12a64a64217df1b5bbe92d1c9f9a25

                      Download Submit

                    • C:\Users\Admin\Documents\TraceEdit.ods.crypt
                      Filesize

                      1.3MB

                      MD5

                      a141e561c0b8378ef11103029fe9ba42

                      SHA1

                      81a5d4137eeaed94a82f5c3f2ba8f6bf37f3c9a6

                      SHA256

                      7a7e72286505ffe6e90d62e71c076dfcc693055c8650913e76e07d88edb70749

                      SHA512

                      a7898dd0cbcb2d6e0a9fbb2d5862efd93dfffd8b7fdc5d06a2a5877b1f7353ccd731c8ab16198d5cc0bbd485634b3c3198e3ba7b3cd45eb0c14e00b528da95a4

                      Download Submit

                    • C:\Users\Admin\Documents\UnlockLock.pptx.crypt
                      Filesize

                      783KB

                      MD5

                      e837d0e6083fe95c83af3694c38a370c

                      SHA1

                      cdfd2a8b6f2594b437fd543e1292edc01258e7d7

                      SHA256

                      c3ce75142dbc9d7c14aa709eb0f18b61ff728b6c05488426fcaab19e07aa31c6

                      SHA512

                      1c79394febce58d6587bcaec255819a3bf891af0f1324c895bede6b2699c4407ec71e3853f3a82856c398aed5e6f1e77202eceb5793189fc6194499f455ea58a

                      Download Submit

                    • C:\Users\Admin\Documents\WaitTrace.xps.crypt
                      Filesize

                      1.3MB

                      MD5

                      e672fd72fd67c952483d659ce4534938

                      SHA1

                      75ab1ab5fc3f5c2f5257fa06c263335ef9658b33

                      SHA256

                      2e49e027a726d1739065ff71c0adff484a841b5a98f4d46a02f7069b2857b86b

                      SHA512

                      d146fd8ede82fd3178c166977760b2b9171c5b7c7abfa8b100ebefb5e4c3103855764c9058a2f094a132772da8f4546aa7e831490665393f75cbd9689f2bcb60

                      Download Submit

                    • C:\Users\Admin\Documents\WriteOpen.csv.crypt
                      Filesize

                      609KB

                      MD5

                      efcaa159d8a854e7d1d14ec7a14d511f

                      SHA1

                      0b02a85144d8d66a3259ff23ae61d39e88ad08a5

                      SHA256

                      cdd7b0852a6c1808bd1b88ba57950ede380c2406e0be5d27dc9f7f49ad080754

                      SHA512

                      4d4a9a7bd65d837f5fb393a3c99d8c8ace963dfb68b01dd90d9255bd7e005e2e86d866197c1b28007cb127e055a16f902c2c87e38d595ab445891cfb2abfe9d4

                      Download Submit

                    • C:\Users\Admin\Documents\desktop.ini.crypt
                      Filesize

                      1KB

                      MD5

                      4660a6ebd19a25d10d6e253f3d4ffb2c

                      SHA1

                      58ce48d37ec42d00a29c45162c059679934a8fb0

                      SHA256

                      35d78af01e70ce74e54bdbed5a5b2272335b562914372bad7a8aa8d10df3a29b

                      SHA512

                      b7790ab842690888443aefe60661f6044a61801f3878b592378c964f6a05fff52985976c9950b82e796cca721540eb7ad5b9afa7c3701196c3a4c0c280e6527d

                      Download Submit

                    • C:\Users\Admin\Downloads\ComparePublish.html.crypt
                      Filesize

                      319KB

                      MD5

                      3a2b748a08317aed32dce904cb899a11

                      SHA1

                      c8975c4e0b668bf41a8d727dadb70bf2fd749da4

                      SHA256

                      4c155960a52012bd11332d45d54d02c6e5667c30cde6d4ff4a48967ed9ad4914

                      SHA512

                      6f8ec3ce521edd1056261257971abd4f8cb69c46a9c17dc8af0439bc00ada95f70247e5f6218a5962a58adeaa8d1eedac95cdf77c72f25c6a37bba687f8b2997

                      Download Submit

                    • C:\Users\Admin\Downloads\ConvertFromSet.mov.crypt
                      Filesize

                      492KB

                      MD5

                      691884031dfa26404dca21d9ec0c6fb3

                      SHA1

                      bb23b2a193a7cef6806be8b78a0988a2c6ebfb57

                      SHA256

                      4b0a4027143cf5b6a6eea0ccdbc74a97ca70baa8dc0b6a7e5187ec2880d3365e

                      SHA512

                      a10b113537950e61baeed024dea84a62fe955087f841f28164fdfe50cf3d19721869a0b5662ba263eff78f1c1bbe51d1d042067472fb8482846d50d0865da16b

                      Download Submit

                    • C:\Users\Admin\Music\FormatReset.png.crypt
                      Filesize

                      164KB

                      MD5

                      dbcb875737c5a34ec912d78e36235281

                      SHA1

                      d4d93ce733b9e90d76f837cf45de7562fcd7a9f0

                      SHA256

                      3f922e70b0b2ee1f99b56de2aa30b046b9a28d9dfc40c3560426143eb04cc810

                      SHA512

                      e69fad406519c56299545ee6e3e7ad07ad41b24a31939f5b253670ee92a041ff00a0b8bb5e69240ea54fa23a99860b4293950c6e9118b45235ae31b0c6871512

                      Download Submit

                    • C:\Users\Admin\Music\PushInitialize.bin.crypt
                      Filesize

                      210KB

                      MD5

                      e58ca92eb8749b017692abc21499e712

                      SHA1

                      ae2d06d9d97b9a2f6b8744f38431812a1c4f94b8

                      SHA256

                      5597eda9fd211a9c9b5b771ba61abf9a9d8af7eada4f5d2909c0015183e25e05

                      SHA512

                      854824e80799376b56d2782b2c579145bef0d78850af46fa821e004951690610c5ef4b007dadb2c7f59f5952099f16319ac6271bb6b18a83e2ee7951fd5bdb92

                      Download Submit

                    • C:\Users\Admin\Music\RestartRevoke.gif.crypt
                      Filesize

                      200KB

                      MD5

                      815baa37e75c3f961ccde5f07c33d4e4

                      SHA1

                      5ef49eb7a6eeb974bd8f7e5d9bb315caca825bc3

                      SHA256

                      00f33fc50bb9a925d9b33b014b04ebb03319c88b0429acdd06dc3bd1cdcecb7e

                      SHA512

                      d47ff6f5ad1da3cca217ca45f65246adb6225d45c621f025db99e7e8ae5a7d999d7e8f981cfea6ba1cfdb99c0fed4dbe8bd3fba511d3d0ef8496451c83262333

                      Download Submit

                    • C:\Users\Admin\Music\StartSubmit.gif.crypt
                      Filesize

                      173KB

                      MD5

                      8d9ca38dd19adc35b0ee765db6ba3062

                      SHA1

                      334e73af815ee3492372c65cb9d9123c5fa69174

                      SHA256

                      529ab898e020b18b2a04c1bff085d5a6be52d51f452d928e6b17ddda19e49277

                      SHA512

                      05584ccdda256e4c16ecc57120420f0e9393d774183deb3c768336219dc6cbdea509bc2d5ff9772504268d6eed8982b4318f741922bab9536aba324fb914784a

                      Download Submit

                    • C:\Users\Admin\Music\UnprotectStep.js.crypt
                      Filesize

                      255KB

                      MD5

                      648a91e7e5c634c4857853f3f2edd7c8

                      SHA1

                      b2a715cd40cd912eb03b0eacb244e55a011150d8

                      SHA256

                      22e7087be900aba660e986c96944f65dcd1e8f5a04d971705b285bc2cabb16c5

                      SHA512

                      8814ddf5fa6e488fb4c4b3f5cc9713b8e4f1a349d18be5fa08de22e191195a433af64f5191414c213f525071195bfb5589fc64bfa65ab031f89eead4e74edf20

                      Download Submit

                    • C:\Users\Admin\Music\WriteFind.m4v.crypt
                      Filesize

                      246KB

                      MD5

                      bbc81da54635bb4fc434a6504f9beef6

                      SHA1

                      be08ed40f8bb51efc3d11753737f7b8d59a5dab3

                      SHA256

                      a2f2226b22516d2728419f9dc076b295db5b13d520a16336db9dc14167551b5d

                      SHA512

                      3307289af7bc62130aed654df1a9ec1553728e6bb1088084b81de040de65cfaf962838d299d250b17c6503b8e5a7dd34d1d6db041cc3d079c15eb7367e8f64e2

                      Download Submit

                    • C:\Users\Admin\Music\WriteSend.wma.crypt
                      Filesize

                      319KB

                      MD5

                      00df5722c9065cc5bc4d059200073976

                      SHA1

                      7d4da2e6d78c50561b9fb3a4bec0f0e02d3fc67f

                      SHA256

                      acf65178e9b23b7afcf43033b8b083892607af513fbb6c7ca657830f66db07df

                      SHA512

                      8d18bd6e25588d102ab4df4a2364f87a66c1c4483f2a5ecc00d72ce7d686f267b4fc031b86465620bf3b1753b18ae7104fb5dea4e9ec182ee5d0bfe4814f4141

                      Download Submit

                    • C:\Users\Admin\Music\desktop.ini.crypt
                      Filesize

                      1KB

                      MD5

                      0382f9399eda6858cd13cc0034cdbebd

                      SHA1

                      f7a8df308ccbcf4ce75ec99b99c3d89a96422352

                      SHA256

                      369ad798d836eb15f47b70d5305c4008540f82badd1153f1c64fb5379572a08b

                      SHA512

                      d1bb4907261d38890cd9b4fd5d339e99335b599c6cf92f764d4c74e289bf2a24885b9429594fe6c0fce5b59497671034086f14e71cdc5460b76660c37ac3feba

                      Download Submit

                    • C:\Users\Admin\Pictures\ApproveDeny.tiff.crypt
                      Filesize

                      509KB

                      MD5

                      0fad98e11f68652c6aa7ed241bd300ac

                      SHA1

                      9cc2f753389cdf62b61a11008f2159656833bf38

                      SHA256

                      35a4966697aca7c8882275aa801e217b8549e4cb629ddad8cb7ce1cd0bf65fee

                      SHA512

                      15a60ef2413c59bfb7b334b62a507a2f31a081e9c3d3ae1a3f87864bd7c555eda3ce266fd26bbcb6387c63382bc2be199a3765ccf6615b77e93b5ff5a28afd8d

                      Download Submit

                    • C:\Users\Admin\Pictures\Camera Roll\desktop.ini.crypt
                      Filesize

                      1KB

                      MD5

                      d5a158b5bca51e5a1a23d7553ee4ae40

                      SHA1

                      0b02e9e83a310ebbf44cab9bf496af89e9c0ae4a

                      SHA256

                      f67a7640fc678bba1261f37a92f77d1173ffe7e28986c6747e5800704cfc4cd5

                      SHA512

                      cad9d7a7c4083748352140d977d07fe9f91900156f483c08acdd6b2193e372e3e2c84989049b8bb259cb73c5d439e723fc978af22093376d24fd2f123142a56c

                      Download Submit

                    • C:\Users\Admin\Pictures\ClearCheckpoint.dwg.crypt
                      Filesize

                      328KB

                      MD5

                      3fcba0bb11a1c4e5e1c9c3552cfa77ff

                      SHA1

                      89adeb3af44387ef862043ae6452b546a5a840da

                      SHA256

                      8441b5940116642f219f33d89e1325d93c55ad89e75b9b6f74addf753fbbc653

                      SHA512

                      2143133030ac0f4dc4cd0abe7e3250fc7dd46579e9cc508611bed41c18b1a2c766477ca63d133e45eccb2a0a1bca8c14790879c5dc9553e56fa07a5edd7247c9

                      Download Submit

                    • C:\Users\Admin\Pictures\ClosePing.eps.crypt
                      Filesize

                      382KB

                      MD5

                      33b84ce13fe8d33ffca3699468963d10

                      SHA1

                      7aa34298069848fc7bd2bb4559aad94e7df45ccc

                      SHA256

                      f3abdeff0c8ded99fae4d8864cd9da281c6c1f30ec4373ab5c49afeb3aa8510c

                      SHA512

                      63c82d807cad968d9b07cdccbd40b1d492f5bd12f1f817f3685428d35922c6521a89ecc228327802cf673dfb24ddbbf89806c4fb524fee7334c61b26f9f2a219

                      Download Submit

                    • C:\Users\Admin\Pictures\CompareRevoke.jpeg.crypt
                      Filesize

                      528KB

                      MD5

                      8e51de52b569b2c29c252d460f3d9961

                      SHA1

                      538098dc10f5dc070b850259b3c2d5a46241780b

                      SHA256

                      943fdbff35cff4dca82de3a8a1d347b02b8e57304d24e2f553356efb7211f6ca

                      SHA512

                      77d045c5fd756aedccee88fb7b7295e5a08cdc9494b04d05cd25f882a5efb73ff7930862142ec088592131e56bd152239683dfc0160d541fc832c9ca673ba3ac

                      Download Submit

                    • C:\Users\Admin\Pictures\ConfirmExpand.gif.crypt
                      Filesize

                      437KB

                      MD5

                      1d285ef10c6ebfe08f9377b345664952

                      SHA1

                      e86610202c43b34daabcb54024fc8a485d76dfd4

                      SHA256

                      48c91c32e78266883be11610fa0d43f318f3678750ec41d2ada7e075a532493e

                      SHA512

                      096e92d7225b32648136d2efa8f9bfdd73e6d22760441b34e0e4a83a2c410035ce190f7e691c78da32c4a14e5a32c689d6793f9e238504ab9d9c52419ec3e82d

                      Download Submit

                    • C:\Users\Admin\Pictures\CopyFormat.gif.crypt
                      Filesize

                      273KB

                      MD5

                      074adae8aa88014c150ddc87edc4592f

                      SHA1

                      f812cf9267d516e8299b6a40f719777f4f81f74e

                      SHA256

                      e0690a923ee3e52f37f53b9359c826a4741f3febdf44e0f9e9e64457f0d92b0f

                      SHA512

                      7433466bfcc41e2bc8d168d3f19677926239194fabfed636ca84e35c6e898f30719713a08170e09e718f9e09c37eed8fcb53413c89c61e3fc2665da8431ebb4d

                      Download Submit

                    • C:\Users\Admin\Pictures\DismountProtect.svg.crypt
                      Filesize

                      364KB

                      MD5

                      8162c616f67f6d3cced69083dd839299

                      SHA1

                      f114aa00cc40f836ffdb057e05a115966248f4ae

                      SHA256

                      496c155611428ea2e57c5e6265331426c0419a9eecb1ae47ef5b32ec1fb8b75d

                      SHA512

                      68df30026ab8898a12be3b8b45ef4043b9d87f6b98a3ee5a1402362a2758f67a732a5666d13a151691c909ac610fc70e8663d45527feab7afd60e4946a72d40b

                      Download Submit

                    • C:\Users\Admin\Pictures\ExportEdit.dwg.crypt
                      Filesize

                      473KB

                      MD5

                      d21cdcf6ca04fe81a34447a8365a1067

                      SHA1

                      d9de6557e88180eb1ba8e0990695ae767e924da2

                      SHA256

                      aa91dbbc94384c45db61b104068fb3710b53c977a6a7730c6cb1dedd9dec6b27

                      SHA512

                      96bde02f8014d8e271dd1c7a7cbad2da44d0df7b1a16702ada4a87f2280c3af9a862f4f118776d0915b3122f43da833991da0d08cbe5331bf9e654659436ffaf

                      Download Submit

                    • C:\Users\Admin\Pictures\ExportNew.eps.crypt
                      Filesize

                      673KB

                      MD5

                      da9ffaf019af9f79dfc7bb9c27f01dc6

                      SHA1

                      36c9f286fdad7013886f7495f864a3201a8528c9

                      SHA256

                      b0c187a4cde20b2624884321df824da3ba55506879a3c3e37f2e02782ad93edf

                      SHA512

                      818171477af0cb084bca2c8697aad52464878ec6793e2c6388744325c1549db74b8d64b8e4a9a542bdefb4ce0e75e157e246e9f0091c3fb86083a1afc33613fb

                      Download Submit

                    • C:\Users\Admin\Pictures\InvokeImport.dwg.crypt
                      Filesize

                      927KB

                      MD5

                      38afa4ed135ced65c2f30a9e58a8a901

                      SHA1

                      cdfff2a8bc19935fd91db7de0b0aed15a93bfd35

                      SHA256

                      547d90000586fc6300a2194660c337bbba2c6d669cad67272c96d5d752d1bc68

                      SHA512

                      80de1973c2ae12443087bf8fa9ded834b9fba25f867ccb389773cd8219e57a3ab900358ca16b9dbf1249024bd88f376d92f46b648cc6d026c8dcaacd921c174e

                      Download Submit

                    • C:\Users\Admin\Pictures\MountReceive.gif.crypt
                      Filesize

                      310KB

                      MD5

                      17f6c7b9c57e9126f5bea9445633bb55

                      SHA1

                      bf0ce4ffc2a0de486f695167e4646c289074a129

                      SHA256

                      7556dc0d3ee84ef0de7813dc774856793b8c3ba2afda4d0a5f44d90f6161aeae

                      SHA512

                      85c165918ad336b7a051a0f8050682eefdd944f3a6b6767f0f6a728d662ce241c4451eab7dedf5927534a65bb64914a17234045c41bc0d1b74f25b9f02e1226c

                      Download Submit

                    • C:\Users\Admin\Pictures\MoveRevoke.dwg.crypt
                      Filesize

                      637KB

                      MD5

                      f395d135e9ea51728689aab2b4cd93a7

                      SHA1

                      e861e0ac2f6b909820bff05b7e1c1149eea76c2e

                      SHA256

                      00538a46d35e41bf6849c61ff8eb3694ac417157dd502f8ae3d7232b80bc2ec7

                      SHA512

                      2973dc0c2d6a9bbac5d14d4f15274cb9a2dc16e6a3d949308d037ef15460f2b445d8a1663d13207a184a2bd571a04db7a27b7e8b78bccfe9ebcce140f478b4ea

                      Download Submit

                    • C:\Users\Admin\Pictures\My Wallpaper.jpg.crypt
                      Filesize

                      25KB

                      MD5

                      4722397ff88a79f7cc9812cd126c87c9

                      SHA1

                      cb88b7da99e3a6eec3ba3b4bf1ae1180c5a01b82

                      SHA256

                      91fe361f3f6ba9130f1b6db87d59b426cd8e2c2fc2591f99a9c58ecd823a5762

                      SHA512

                      f382d49cefcfa95a1788bb180c1439b8907a34892611c4fa5331677ad487f745c44f94044abd6b2c5d7be3abdea4718d182ec546606fba0dfa4154ae9255e010

                      Download Submit

                    • C:\Users\Admin\Pictures\PushDismount.raw.crypt
                      Filesize

                      491KB

                      MD5

                      32598472dca92a9c70aee2d323b373b5

                      SHA1

                      65a0a25e7918835ed92daaf972b95648e9fbf8c4

                      SHA256

                      8f8cf249fc78617b8c64691bcae39bd9cbb565bc28ba49dac0caffc30e213cd8

                      SHA512

                      57b5ee7ca2be9b229c86bcc76385c4bc47507bad775fbbae0923cae9777f2e72fabdd30c1d846dd6877fe1a0bdac28e4ca9f51e384b3faa907bf82a2ba146341

                      Download Submit

                    • C:\Users\Admin\Pictures\RegisterResume.tiff.crypt
                      Filesize

                      291KB

                      MD5

                      c6ee5ac4df33fc8fb84e1c3378bb1994

                      SHA1

                      6e36eac75427e0071b4322e5ba6683241d57cd89

                      SHA256

                      883491aa1612ca453384c4fdd6367a0d50037401725c888645880188a395cf90

                      SHA512

                      41191c17c7f2d1e50cd97637cb898660e3db26d2d6c2fa9b19628344253da4e22d54dbe08f7cc5b5c2ebb5dcf668e7676ed23642de642544352491e194ef73aa

                      Download Submit

                    • C:\Users\Admin\Pictures\RemoveMove.jpg.crypt
                      Filesize

                      255KB

                      MD5

                      d6b5be1676dc3a415dbed0a3521640ad

                      SHA1

                      fef84f2561931dd1cbd2e331f502483e2fa341d9

                      SHA256

                      ec7305c150f98373ca64721905346f17c7c2993a97592cbefe5060f8dc9f4a9f

                      SHA512

                      e38cc14faf969aa3145f5f3da9a243eaaddf8c03212cdf6ad44c9a539fd931abf56967b4bb32a0925ac193e55b64b17b6e5f082e22e1024d8a9c89dba627fffb

                      Download Submit

                    • C:\Users\Admin\Pictures\ResumeClose.tiff.crypt
                      Filesize

                      564KB

                      MD5

                      50f2ce92749c1fb762ee245371d74510

                      SHA1

                      1d0fb2b63e4ba7506202fa96abffb14b73998410

                      SHA256

                      cbe9fb3080d6e0f2e63dd45d1887892db61ad541c60cd7aff56146c69fd6708e

                      SHA512

                      3c47978904ba9092013da93968906125577175ba4498ce6caa7d3a1c72a9f10eaa6666eec6b5e47e576366128d370dabebbb6a8679f32f8fb641b2e073596ca9

                      Download Submit

                    • C:\Users\Admin\Pictures\Saved Pictures\desktop.ini.crypt
                      Filesize

                      1KB

                      MD5

                      2270d29dfd0e4b6607a203b4a75240e5

                      SHA1

                      acd86ed755f6e08e4a2848f968a54329335e213b

                      SHA256

                      532ad8a365e47658a3b4419670d977816ad2d755d48a3ea15325ce8e10db4cb1

                      SHA512

                      92a69fef50e18e3f7cef6654c8bb22e9e2d7cdea13d1e2a0da20ba4d44bb1312f3502a4516c26fafa5d95e1d1da52619ed3f20253af23ed54e4a4fc91bce113f

                      Download Submit

                    • C:\Users\Admin\Pictures\SendConvert.dwg.crypt
                      Filesize

                      400KB

                      MD5

                      1d385b33341df17c60938815d082293b

                      SHA1

                      1af175422f6dde412b4d0d90b454f88ed84fab27

                      SHA256

                      32cc62c17a9b1f4002ea26350075c5ead6661b9d0e34e8509471ab03646480d9

                      SHA512

                      4968768131de0eca88be3a90d04a87c25ee08b0a2e09f21c780b24fa858bacebb7ea5a735f8dda5f37b92111ee0eb8ec4c6a7f60579f95c0678ca3d47c962b10

                      Download Submit

                    • C:\Users\Admin\Pictures\TestClear.dxf.crypt
                      Filesize

                      546KB

                      MD5

                      13dc8545f1eecafbfebf84c50b06b166

                      SHA1

                      076d46ece9d1563ec31620d69fb79db20cbbc17d

                      SHA256

                      2024df6a51116b90756009149f80cd9a50d9730a3ea5f9790f6579e9f42a6093

                      SHA512

                      a3ce871ef0d32dde5d8252ac0b43e525ce1e1409536e03db8a59e5dedcf702c171fc333ec6bea6b8b3b68ab8fe07ed86cfc379c0aa1c6950a5b07b20a5cfe5f5

                      Download Submit

                    • C:\Users\Admin\Pictures\UnblockDisconnect.jpg.crypt
                      Filesize

                      582KB

                      MD5

                      523f67db943ea9a96a2f1daafb617a97

                      SHA1

                      e7c0430ed6b5ebdea75d993c17a16c046ac2deed

                      SHA256

                      c50b7b5a86c9603a6d2bac648deb524e1810cef15781089fa2c86a8c258721ec

                      SHA512

                      4d9de2caa3af8e9a87bb320322fd213e01833510c9beda51e53514afcf253f0bcee8bba64ef7eb1ad87b06cb63476a2e73924b0d73200810f467c18fea62367d

                      Download Submit

                    • C:\Users\Admin\Pictures\UninstallCopy.jpeg.crypt
                      Filesize

                      600KB

                      MD5

                      87fb82b0a9a963bcb5c9e980aa07a30c

                      SHA1

                      b806a1409f59dc90468dbe8096792fa0f75d6e35

                      SHA256

                      af3f46b232ad1066d126b8ba4cc213c66daed8021f5ec729fc2118e03f9509ed

                      SHA512

                      e5c02fbeb382a4c5bb5c24cd6a7d8067d79a4094e12bc4a9b49a85b04f5601a752aacff087ccd32ff7e08ec9cf49cae59f8ec7e7d081971f867e99490c074cd3

                      Download Submit

                    • C:\Users\Admin\Pictures\YOUR_FILES_ARE_ENCRYPTED.HTML.ANNABELLE
                      Filesize

                      4KB

                      MD5

                      7a70569398790b8adf45788b02805140

                      SHA1

                      ab00e859fbd10ddd58477ab189290b63a0c7db94

                      SHA256

                      ff1113e7fe32122e4940a05ec0530a20239d42d022fd2f2b31b01fa6106d6b54

                      SHA512

                      e24faa0a5479f6a1571c5abb31e495c4596bcb0bdda6e81ffd50fc7f81034f29b54a803133292dd4be6ad2d6c222fa9fe3d5109541d12dfaa8ab6230cf61ef48

                      Download Submit

                    • C:\Users\Admin\Pictures\desktop.ini.crypt
                      Filesize

                      1KB

                      MD5

                      1f37746da1129343373491459700c9f9

                      SHA1

                      36bf63c5c2c8fd57395e2d344cf47581feeb0b23

                      SHA256

                      131f805d9e6d84bb97164aca73852864f28da9f9a119808c2cbb9c06ef9bcc84

                      SHA512

                      60a73f8ceed0cc99319127449d0e582b7d5b98dc75d866416718f41df16f7251a80b13ad3f48d831b89e2a9a52c4d11c8b588dfecf1793e350b7ed199f7b59db

                      Download Submit

                    • memory/1976-8504-0x0000000000400000-0x00000000004A2000-memory.dmp

                      Filesize

                      648KB

                      Download

                    • memory/1976-8505-0x0000000000400000-0x00000000004A2000-memory.dmp

                      Filesize

                      648KB

                      Download

                    • memory/2160-8497-0x00000000030C0000-0x00000000030D4000-memory.dmp

                      Filesize

                      80KB

                      Download

                    • memory/2160-8496-0x0000000000D40000-0x0000000000D92000-memory.dmp

                      Filesize

                      328KB

                      Download

                    • memory/2160-8498-0x0000000005E10000-0x00000000063B6000-memory.dmp

                      Filesize

                      5.6MB

                      Download

                    • memory/2160-8499-0x0000000005920000-0x0000000005928000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/2160-8503-0x00000000066F0000-0x0000000006712000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/2160-8502-0x0000000006720000-0x0000000006764000-memory.dmp

                      Filesize

                      272KB

                      Download

                    • memory/2160-8501-0x00000000065D0000-0x00000000065D8000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/2160-8500-0x00000000065E0000-0x0000000006672000-memory.dmp

                      Filesize

                      584KB

                      Download

                    • memory/2848-482-0x00007FFB886C5000-0x00007FFB886C6000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/2848-492-0x00007FFB88410000-0x00007FFB88DB1000-memory.dmp

                      Filesize

                      9.6MB

                      Download

                    • memory/2848-489-0x000000001CDB0000-0x000000001CDFC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/2848-483-0x000000001BF80000-0x000000001C026000-memory.dmp

                      Filesize

                      664KB

                      Download

                    • memory/2848-9062-0x00007FFB88410000-0x00007FFB88DB1000-memory.dmp

                      Filesize

                      9.6MB

                      Download

                    • memory/2848-486-0x000000001CB50000-0x000000001CBEC000-memory.dmp

                      Filesize

                      624KB

                      Download

                    • memory/2848-490-0x00007FFB88410000-0x00007FFB88DB1000-memory.dmp

                      Filesize

                      9.6MB

                      Download

                    • memory/2848-494-0x00007FFB88410000-0x00007FFB88DB1000-memory.dmp

                      Filesize

                      9.6MB

                      Download

                    • memory/2848-493-0x00007FFB88410000-0x00007FFB88DB1000-memory.dmp

                      Filesize

                      9.6MB

                      Download

                    • memory/2848-484-0x00007FFB88410000-0x00007FFB88DB1000-memory.dmp

                      Filesize

                      9.6MB

                      Download

                    • memory/2848-491-0x00007FFB886C5000-0x00007FFB886C6000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/2848-487-0x00007FFB88410000-0x00007FFB88DB1000-memory.dmp

                      Filesize

                      9.6MB

                      Download

                    • memory/2848-488-0x000000001C9F0000-0x000000001C9F8000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/2848-485-0x000000001C520000-0x000000001C9EE000-memory.dmp

                      Filesize

                      4.8MB

                      Download

                    • memory/3016-500-0x00000000051A0000-0x00000000051BA000-memory.dmp

                      Filesize

                      104KB

                      Download

                    • memory/3016-495-0x0000000010000000-0x0000000010010000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/3468-8549-0x000001ECDDDE0000-0x000001ECDEDD4000-memory.dmp

                      Filesize

                      16.0MB

                      Download

                    • memory/3468-8550-0x000001ECF9300000-0x000001ECFA88E000-memory.dmp

                      Filesize

                      21.6MB

                      Download