Overview

overview

10

Static

static

3

2024-12-29...pt.exe

windows7-x64

10

2024-12-29...pt.exe

windows10-2004-x64

10

Resubmissions

10-01-2025 08:28

250110-kdbyds1ldn 10

29-12-2024 11:43

241229-nvrlys1jgl 10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-01-2025 08:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-29_1f9d9c8b17bc4e6ab42217e4ca879273_teslacrypt.exe

  • Size

    316KB

  • MD5

    1f9d9c8b17bc4e6ab42217e4ca879273

  • SHA1

    ebbaefabffef6eac50f8c52c84a51cb7442ecaea

  • SHA256

    c2f389b2ee29d7b7d23ba7f1d248b0e9fc9d8c8a60e77cd75b6bd8dd2b38db00

  • SHA512

    9ff77d473a0cbaee33d576aea49cfde04946353c2334d18587ee732c90eb656eef35485996934385b32f94729999c6f2bf83ae572541f4adb56f4659cc9c848e

  • SSDEEP

    3072:sP36v0ABWbDFp7yz5dwjtYjt+XOCGNjYQMhLwZil6hdZrz5ZbJnCgo5QTRpALo3:IhKjjtxVYQuwFhdZrz5ZC5aXALo

Score
10/10
teslacryptdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\_RECOVERY_+atien.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/4F6C52CA66FCD218 2. http://tes543berda73i48fsdfsd.keratadze.at/4F6C52CA66FCD218 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/4F6C52CA66FCD218 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/4F6C52CA66FCD218 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/4F6C52CA66FCD218 http://tes543berda73i48fsdfsd.keratadze.at/4F6C52CA66FCD218 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/4F6C52CA66FCD218 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/4F6C52CA66FCD218
URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/4F6C52CA66FCD218

http://tes543berda73i48fsdfsd.keratadze.at/4F6C52CA66FCD218

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/4F6C52CA66FCD218

http://xlowfznrg4wf7dli.ONION/4F6C52CA66FCD218

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Teslacrypt family
    teslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (872) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 11 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-29_1f9d9c8b17bc4e6ab42217e4ca879273_teslacrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-29_1f9d9c8b17bc4e6ab42217e4ca879273_teslacrypt.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Windows\ladbjordwuln.exe
      C:\Windows\ladbjordwuln.exe
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1816
      • C:\Windows\System32\wbem\WMIC.exe
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4824
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        3⤵
        • System Location Discovery: System Language Discovery
        • Opens file in notepad (likely ransom note)
        PID:4756
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4400
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91c9746f8,0x7ff91c974708,0x7ff91c974718
          4⤵
            PID:2232
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7063523961284189144,13942543257612306673,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
            4⤵
              PID:4676
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,7063523961284189144,13942543257612306673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
              4⤵
                PID:4228
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,7063523961284189144,13942543257612306673,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
                4⤵
                  PID:264
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7063523961284189144,13942543257612306673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
                  4⤵
                    PID:3960
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7063523961284189144,13942543257612306673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
                    4⤵
                      PID:3384
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7063523961284189144,13942543257612306673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
                      4⤵
                        PID:1720
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7063523961284189144,13942543257612306673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
                        4⤵
                          PID:5200
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7063523961284189144,13942543257612306673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
                          4⤵
                            PID:5468
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7063523961284189144,13942543257612306673,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
                            4⤵
                              PID:5476
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7063523961284189144,13942543257612306673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
                              4⤵
                                PID:5660
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7063523961284189144,13942543257612306673,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
                                4⤵
                                  PID:5668
                              • C:\Windows\System32\wbem\WMIC.exe
                                "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4672
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\LADBJO~1.EXE
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:5144
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2952
                          • C:\Windows\system32\vssvc.exe
                            C:\Windows\system32\vssvc.exe
                            1⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1464
                          • C:\Program Files\VideoLAN\VLC\vlc.exe
                            "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\DisableInvoke.wma"
                            1⤵
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            PID:1260
                          • C:\Windows\System32\rundll32.exe
                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                            1⤵
                              PID:4504
                            • C:\Windows\system32\mspaint.exe
                              "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Pictures\My Wallpaper.jpg" /ForceBootstrapPaint3D
                              1⤵
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              PID:2724
                            • C:\Windows\System32\svchost.exe
                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
                              1⤵
                              • Drops file in System32 directory
                              PID:2260
                            • C:\Windows\system32\OpenWith.exe
                              C:\Windows\system32\OpenWith.exe -Embedding
                              1⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:4240
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:4696
                              • C:\Windows\system32\dashost.exe
                                dashost.exe {06c08f7b-8316-4ef0-86a6552a7ac0cac8}
                                2⤵
                                  PID:3836
                              • C:\Program Files\VideoLAN\VLC\vlc.exe
                                "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Pictures\InvokeFormat.svg.mp3"
                                1⤵
                                • Suspicious behavior: AddClipboardFormatListener
                                • Suspicious behavior: GetForegroundWindowSpam
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of SetWindowsHookEx
                                PID:288
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:3760
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:1732
                                  • C:\Program Files\VideoLAN\VLC\vlc.exe
                                    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Pictures\FindAssert.jpg.mp3"
                                    1⤵
                                    • Suspicious behavior: AddClipboardFormatListener
                                    • Suspicious behavior: GetForegroundWindowSpam
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5332

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Windows Management Instrumentation

                                  1
                                  T1047

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Defense Evasion

                                  Indicator Removal

                                  2
                                  T1070

                                  File Deletion

                                  2
                                  T1070.004

                                  Modify Registry

                                  2
                                  T1112

                                  Credential Access

                                  Credentials from Password Stores

                                  1
                                  T1555

                                  Credentials from Web Browsers

                                  1
                                  T1555.003

                                  Unsecured Credentials

                                  1
                                  T1552

                                  Credentials In Files

                                  1
                                  T1552.001

                                  Discovery

                                  Browser Information Discovery

                                  1
                                  T1217

                                  Query Registry

                                  2
                                  T1012

                                  System Information Discovery

                                  3
                                  T1082

                                  System Location Discovery

                                  1
                                  T1614

                                  System Language Discovery

                                  1
                                  T1614.001

                                  Lateral Movement

                                  Collection

                                  Data from Local System

                                  1
                                  T1005

                                  Command and Control

                                  Exfiltration

                                  Impact

                                  Inhibit System Recovery

                                  1
                                  T1490

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Program Files\7-Zip\Lang\_RECOVERY_+atien.html
                                    Filesize

                                    11KB

                                    MD5

                                    9167ba3856ab125ee5c716fdfbd0225b

                                    SHA1

                                    6835d0b846fcd4249fad9723b18069306204bf17

                                    SHA256

                                    1e37ee619102315cd6a04144e4f564f623c7069850b3be05efc01cf9dbf20f7f

                                    SHA512

                                    3d80525e6598394ef7ba9a667c5f4c426118f6cf45b63c351cbaa60547a4df8ef607329f7f79be014f59b708f90e5cd5202dd3b21fe35399dc895910617ca99b

                                    Download Submit

                                  • C:\Program Files\7-Zip\Lang\_RECOVERY_+atien.png
                                    Filesize

                                    62KB

                                    MD5

                                    b12aa83d285ca7a3c8644a5a09f80810

                                    SHA1

                                    9242470e89dd1288f5f33d13cc2d0abbfd4104bf

                                    SHA256

                                    3c8c500b0688d4372bb3624f3e2b64921ec2639f03b6c8faa2e19b72ad554100

                                    SHA512

                                    647fc66f7f9a588963e42936613124cd87078ec841787ac3df6ecd74055b4ee3cdab8c0f8fe0abec79d9d31e56b5a685591b3e7e047d74039848288aaaa173a2

                                    Download Submit

                                  • C:\Program Files\7-Zip\Lang\_RECOVERY_+atien.txt
                                    Filesize

                                    1KB

                                    MD5

                                    8290eda1ffb74a2a7876cecb7bff565f

                                    SHA1

                                    9155684ccb28547b1e7e5af7906d3752e4827bd5

                                    SHA256

                                    d44d6606037296d408801b659259d363eea1c498c8c93589fedf2f223429ab2b

                                    SHA512

                                    ee2c8f12a58bc4794b6dc37236a1d9454275a9474753b7464ff715dcfbf7da9ae0ec334409ce5273ab8fbdc2bb157bd9475b6d90738ac6b01e81c8312f93a11f

                                    Download Submit

                                  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
                                    Filesize

                                    560B

                                    MD5

                                    753f4ed2e2965e0a1707b47e1a54471e

                                    SHA1

                                    d0202e5948feae327084400978666ce951295834

                                    SHA256

                                    64fdb208e122f266d62a000dcd96e2b44a6cad255492e5c212ffe27fa682132b

                                    SHA512

                                    dd4f1d449c418b9112915116ab5e1725988ae9687011d8c79b3140de278559aa89169ebe29da13c1796be7992ffc56f4ea4aa9c4ce5b63dd9fd1e2b1ab082d52

                                    Download Submit

                                  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
                                    Filesize

                                    560B

                                    MD5

                                    56bdce16a4fa4ac6b578581365d0a906

                                    SHA1

                                    778c3dde0a717f3a801ca377484647a1b942f5f9

                                    SHA256

                                    7e0ff2720c4a9bc60d851da02aef3437b7e640380d5ba12332799e399255c9aa

                                    SHA512

                                    e86c74612a23008f83135d7a8ed8b42d01d70bd1b6017b77959179a69f537837c046758b41d47cb74ab31deca259bd1fd956295fd160d8f1ccadf378b0adc12c

                                    Download Submit

                                  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
                                    Filesize

                                    416B

                                    MD5

                                    1c29e37814a391b13b6437c74e1dc323

                                    SHA1

                                    7ae308f36cbb93616d47921fd60cc40a333da993

                                    SHA256

                                    565a0aed8841915039bce9adf8ff86c0ada87420d4015d289d4f9b6893c4e123

                                    SHA512

                                    79f43721c494fbb57a45af2632ec2e369506710840c2befbc5551dad9ab9ffeb9166c74db3d9e9f06084736d90c60c1a1ec4dcc5364afad0529d312ec84da3b2

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                    Filesize

                                    152B

                                    MD5

                                    d22073dea53e79d9b824f27ac5e9813e

                                    SHA1

                                    6d8a7281241248431a1571e6ddc55798b01fa961

                                    SHA256

                                    86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

                                    SHA512

                                    97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                    Filesize

                                    152B

                                    MD5

                                    bffcefacce25cd03f3d5c9446ddb903d

                                    SHA1

                                    8923f84aa86db316d2f5c122fe3874bbe26f3bab

                                    SHA256

                                    23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

                                    SHA512

                                    761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                    Filesize

                                    6KB

                                    MD5

                                    5345ef47c63421c1e85ae264ebd35f85

                                    SHA1

                                    39a8ec04f35dfd3a8aed3a933f9b7a3fca35afc2

                                    SHA256

                                    027515aa74f50157aea5fd6375a00917606c5ac3a41fcd5e91f59ad3811061aa

                                    SHA512

                                    e898895aaad4fdb619560f49891f6625308db117240fdead707e92f80d79db40af7fd0d3748ac332510b58a1f8ea2589db248461bd18faed4f8fcfb1f60e8345

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                    Filesize

                                    5KB

                                    MD5

                                    abec01de191c554f5d1dd83082498bd5

                                    SHA1

                                    0e899e1a45bf8f68aa64bdb08ec52624e9616e20

                                    SHA256

                                    a1beae248982d5c8a34cb24af9e9040d9a328864fd2a060506e0f5e4c88509af

                                    SHA512

                                    8c8d03fb512bd4d98dc20ec6689dc183041bc18e1adbee5ff03e986eba9af9a1e07c59df1a9dd9f6dbdcc1df600277f37a8c4b5df304e20460b99f9fd4345e3d

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                    Filesize

                                    16B

                                    MD5

                                    6752a1d65b201c13b62ea44016eb221f

                                    SHA1

                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                    SHA256

                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                    SHA512

                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                    Filesize

                                    10KB

                                    MD5

                                    4806e2bcb5810416b79c4485d5d3e68b

                                    SHA1

                                    0f27cc120f61f60251df41198566f3f3ade78145

                                    SHA256

                                    44a9312fc3eaa00b66a6e74acb75395e5b061dd4363a0969578977df23f41e79

                                    SHA512

                                    82ad6b93821cf153cbe6d6925bde1b4e21687662d1d576698e11a0c1c7decad088f4070d976edb92f4306844fa79ed012fb5d96539cf7fefa94e084efcb04392

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662192103813.txt
                                    Filesize

                                    77KB

                                    MD5

                                    836646a36abccf65cda2f54f4134d99f

                                    SHA1

                                    2043ee8ec6843a8ad21248f034e68500c7a25123

                                    SHA256

                                    bc491daf38d2b8650816e3af71247bd6d58036e948136b6eb63c6a2c4b274f95

                                    SHA512

                                    abb44d4df332101457dffb822a22025ce0a63c1479937fea02a65b9435c1d95231ac7bbd28c9f066a3ca2c4cbe4f06eb3943bddf164d8792910fce5a6a6622fe

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663401899668.txt
                                    Filesize

                                    47KB

                                    MD5

                                    21272a5d7d77570d4d7f41850541ab52

                                    SHA1

                                    d21e11f40f475eca5f14e9d26692f2ee01efd7ac

                                    SHA256

                                    b4c4d2f4ff4c947350992301ad20b6b4915cc97dd82ed7147ce26c7d1c03ec3c

                                    SHA512

                                    75e89d0fe594272a83c916d432499f5871aa8492f442e0883f3201fd23bf84d2deffecc060e7167e43b654feaa015ff8b93750fb3e28d0f301fd2d691e4815d5

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727670771168387.txt
                                    Filesize

                                    74KB

                                    MD5

                                    93b6d4728b5440d3718989616c101b32

                                    SHA1

                                    6aea2ff6132391dedcffeb09b32bd417f3518d76

                                    SHA256

                                    21d8238e1efddcd76d3183f1c9c106d9117b924d708a9c3818c59818f14ce3eb

                                    SHA512

                                    4b0f9866e4cd77ebbd9c514d066a1770a4a51d5dca4f08c8d0435c483070d9c91e9504a5ad2867ddb0802321d636b4d7374f948d9435f35b67af4898038e5c01

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\vlc\ml.xspf
                                    Filesize

                                    304B

                                    MD5

                                    781602441469750c3219c8c38b515ed4

                                    SHA1

                                    e885acd1cbd0b897ebcedbb145bef1c330f80595

                                    SHA256

                                    81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d

                                    SHA512

                                    2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
                                    Filesize

                                    504B

                                    MD5

                                    6a320314e722ced036114daf8e077201

                                    SHA1

                                    3d3a6a37f3c6836c65aa93ab2e1abcfcf4405ef6

                                    SHA256

                                    a155fd48274646664f573990392b666dd4dbb3ae89f9208e10ca5a0bfdf542fa

                                    SHA512

                                    97220c3b7fb21385f6f852e7950e103f4706f6d0d67ed08622edd83f14eeee8b6e7145650036545618fba4ea0be9cca723963dff3a39cb9f36c115d4808d8ec1

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
                                    Filesize

                                    537B

                                    MD5

                                    0531b6637fe0d049fb80c625b3f8ea62

                                    SHA1

                                    b1a740aef7368a93809526f90b93e292890548f0

                                    SHA256

                                    04c665d820a862692cf242f280781bacffc50b337470fbc820bc7380a6279d9b

                                    SHA512

                                    d8add6bb3c51c631542490f90fa337fb40e6c47ca550eb4a04438cc7d080dab1c2e058f86af709dbe3c4759bc6f45a099ca797e44dd949b53d814afe5c764c51

                                    Download Submit

                                  • C:\Users\Admin\Pictures\FindAssert.jpg.mp3
                                    Filesize

                                    236KB

                                    MD5

                                    4bf1c0c1fe88425b6fc9826fb0d2ae79

                                    SHA1

                                    999ab5f7573b95e9e7b1c61d50f2f35c184ffc8a

                                    SHA256

                                    5875278b8898df9f7f0537834ff0128e11e00bc1456e3dfd3b94006ed4109696

                                    SHA512

                                    3cd856750f5d08759887194599bdbbd0717a3013204d37cf76e1e5d0bce669d936ad1de096008d177bfdaed5278325e381403bfbcb56071c10b4d7a05de4fdb9

                                    Download Submit

                                  • C:\Users\Admin\Pictures\InvokeFormat.svg.mp3
                                    Filesize

                                    273KB

                                    MD5

                                    6b3737109bbb8f0bb5002a8f4e863247

                                    SHA1

                                    2752236d6d00f9c884e4456c04e782cdfbb39a2a

                                    SHA256

                                    79debe1c35699517180109f2e671bd5dc54bf1559f0db81321977fbbc52699c4

                                    SHA512

                                    b1482297305f04c4993c5a668c8291c1a5c281238d7687487063248f2cd0a35713bd4efd84bb1ee4d3695bc33f0c65ede3016a557d6cd3f8e786c054840c68ed

                                    Download Submit

                                  • C:\Windows\ladbjordwuln.exe
                                    Filesize

                                    316KB

                                    MD5

                                    1f9d9c8b17bc4e6ab42217e4ca879273

                                    SHA1

                                    ebbaefabffef6eac50f8c52c84a51cb7442ecaea

                                    SHA256

                                    c2f389b2ee29d7b7d23ba7f1d248b0e9fc9d8c8a60e77cd75b6bd8dd2b38db00

                                    SHA512

                                    9ff77d473a0cbaee33d576aea49cfde04946353c2334d18587ee732c90eb656eef35485996934385b32f94729999c6f2bf83ae572541f4adb56f4659cc9c848e

                                    Download Submit

                                  • memory/288-10590-0x00007FF91C6D0000-0x00007FF91C986000-memory.dmp

                                    Filesize

                                    2.7MB

                                    Download

                                  • memory/288-10591-0x00007FF91C0D0000-0x00007FF91C1DE000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/288-10588-0x00007FF6EEB00000-0x00007FF6EEBF8000-memory.dmp

                                    Filesize

                                    992KB

                                    Download

                                  • memory/288-10589-0x00007FF91D410000-0x00007FF91D444000-memory.dmp

                                    Filesize

                                    208KB

                                    Download

                                  • memory/808-0-0x0000000000400000-0x000000000049F000-memory.dmp

                                    Filesize

                                    636KB

                                    Download

                                  • memory/808-6-0x0000000000400000-0x000000000049F000-memory.dmp

                                    Filesize

                                    636KB

                                    Download

                                  • memory/1260-2723-0x00007FF92C750000-0x00007FF92C784000-memory.dmp

                                    Filesize

                                    208KB

                                    Download

                                  • memory/1260-2722-0x00007FF6EEB00000-0x00007FF6EEBF8000-memory.dmp

                                    Filesize

                                    992KB

                                    Download

                                  • memory/1260-2724-0x00007FF91EF60000-0x00007FF91F216000-memory.dmp

                                    Filesize

                                    2.7MB

                                    Download

                                  • memory/1260-2732-0x00007FF91D350000-0x00007FF91E400000-memory.dmp

                                    Filesize

                                    16.7MB

                                    Download

                                  • memory/1816-10651-0x0000000000400000-0x000000000049F000-memory.dmp

                                    Filesize

                                    636KB

                                    Download

                                  • memory/1816-2110-0x0000000000400000-0x000000000049F000-memory.dmp

                                    Filesize

                                    636KB

                                    Download

                                  • memory/2260-3833-0x000001C5F9D70000-0x000001C5F9D80000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/2260-3840-0x000001C5FE9C0000-0x000001C5FE9C1000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2260-3830-0x000001C5F9D40000-0x000001C5F9D50000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/2260-3848-0x000001C5FEAE0000-0x000001C5FEAE1000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2260-3842-0x000001C5FEA40000-0x000001C5FEA41000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2260-3844-0x000001C5FEA40000-0x000001C5FEA41000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2260-3845-0x000001C5FEAD0000-0x000001C5FEAD1000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2260-3846-0x000001C5FEAD0000-0x000001C5FEAD1000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2260-3847-0x000001C5FEAE0000-0x000001C5FEAE1000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/5332-10671-0x00007FF9194E0000-0x00007FF919514000-memory.dmp

                                    Filesize

                                    208KB

                                    Download

                                  • memory/5332-10672-0x00007FF919220000-0x00007FF9194D6000-memory.dmp

                                    Filesize

                                    2.7MB

                                    Download

                                  • memory/5332-10673-0x00007FF918870000-0x00007FF91897E000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/5332-10670-0x00007FF6EEB00000-0x00007FF6EEBF8000-memory.dmp

                                    Filesize

                                    992KB

                                    Download