gandcrab | hxxps://github[.]com/topics/malware-samples

Analysis

max time kernel
541s
max time network
542s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2025, 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/topics/malware-samples

Score

10^/10

gandcrab xmrig backdoor credential_access defense_evasion discovery execution impact miner ransomware spyware stealer vmprotect

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-83325578-304917428-1200496059-1000\VANILKQEUN-DECRYPT.txt

Ransom Note

---= GANDCRAB V5.0.3 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .VANILKQEUN The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/6b4406c7f179761c | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAE6QuJE/W1ndaexfTvNYRwjHLh4fOyA/CTDsanQDbglf+RrhcOzHkBbuNM+ePL/88+ovQW9YWN2jCkpcXP83iabqsz5W6ksAarvfp77dIHOGsApyQ71NyW+J3KYMYfcOwsO7j+JMS3V6RwWjGZwTqNzATYDBNKXN9injG5H9NMNn4hUciPMp1RDyRJh8sDpxmjEn7CiMLPDbxqCMmpI+yREWMdHFxupP1b0huReEZEIqjunZiPhgn8Ook6rwm1QTkcrLR59BnaZQsVgdZSocaMY1WbXhhR2IMOmkj9SJ4MvRz2eD6YHBCXox+uIsBHbSjNhEj5b+BmnWI978GUBOP0MgjY8AT7vJydqena9aX7dxDmxLCpCmHd8ZCHxf/YISgRjWpE+ood1rC46yHTWSOwk12bf8GTO5LHINTnSsDez79JotJX/bo+ttKIbHigpxUBKW8DBTsf+D5ZROijrVHcluEDomMqtKKV4rW6KTsNwjihxUXJEgGj1u1xUd0H0nXrS2FQqH6NaesXd3byTsKzcxCAKw1PMLJc8/Kyvm1DVG5dNVIvglf+yBGx3aEQELVPSCs8Pt/0Fdk65u5O08nFXokA+YFj7myIxloumkbfoujeBGf3j78hBZwKBEspb3IfDTt+DTzqD7DxyeZkP9a8M52JdxY35y2oHuhHzavIGxECN8/pTKP9MrgOJ4kowE3n9yBHoEe2HxP8WpVFUSi5txgdNXuVe05MuWJqzxIq8NVfdGY1pnJ8oCv3R3YYoslNNj2tcSNUHt2j2bAQLrdfUvhUaYF31XhTSclEla/l+JHbZx+GFNMc0BPlwyPQAwDlS1nkwZwjD1nMjkWHvpcRlctUT6m7dez3DIDeHb54QwgZnVUtYBtqdXieGsVMq8PZdphDfYq6IkQFvXbFwkHmsXE5EJFFtwGe6Vn2l3/codz9/nr9rGMZQ7BUlvgnnM+hMAoNRSMHQOtatj0VVQTPOaqM0QjF7kQznP2HJAYRMxIF0eYrUVytBWT7Duu4bfJywTkJaRY0bixRo32NYUh2iiGpgLq5HlDGUyYUIMhkwEcmRbwizhM56BNLEC1tpdfVhVEPA8OZwt9UirwGlNwwDlcyNKN6OuiWhdAGfLXMky4kOQ99tM0EZidTS85fbS2eCruy5OCBwy6TleRMTJwXpTpgYSiOSwBGwf5NapR63o5MDgxUNUw3IUtRn+FpwKGt0dSvDmNavSiHc6YsLnZAeUveSRKWPp8kozESw0otAWQ8oAYqwz6z1JbB1rYPa6/Lj74iFk5Z+pZjowkCS9Eh8jlLBbxD7tvN3rNKkqq/x/Qy8t4WoA2qjW94AuI1QC8YOriD+46GJTUDXs1XtAzPY5Oj+GmL/I+NtnrMkJXVRanpyPJ4foz7ymdtQf7ITMWq2mfyPt371to843rLBWkJ33Ecm5QYFvWeegZOzHvlzBbhlrqoAGzX1jlyXU05+a4PoJna73mPSw0RmEYfjvuSTB9R8Atgh8TQuJdQmXU7zKAwrndd9bHatviSLlQXaSUpVtiKSE3wjpaHhSrxjP4QBe4ilWgA5Rhe8pJVtnIhuhl4ZF9DdXNm62Wrj08n2p+07QDyRSLPwCWTGJNhQe/buHIVoGdO+KnH0MZuyI5lsC2qVXCE4gUJ+VkKApV2URvnGL473uekS6ajSZdiPkrS/xpv/SdbWqiDUIk/5ymBT9HelFU4frsE8eIxC8Ho+tWAuT9lKN+3gjEcSnVszshzGTtLh3XR3t46P7LPKPWUbKurIcupRaVY81F1EFz/ymO+Usrn2vdjVPlxbvvCw8vsHRkKcsNq97l4au38KNzPowqRLYulkyYFuGsY003HGXK2yFgZek4q5Boj52Pyn14UeWFGSjikpKA2BXMjk6sXkgoYaPmhWxWXoPaRbTRRte9wtDSc25+kHmwqEA91vEUI5TbGFQ8QclXJ1O5HJPHcbfeTbZhDvgaf12TUfkAQwz5hX/CtbNfJbznr55iNQPz5stFD3gxGHxUz+fawKfwS5b2DLamlbWjQrJ/JoHFBBrrO9Tq3oczgJHnDfI/QZPgVqx53H5WrInwDbBRA5nsZtkzi2vg+pyjSuqBW5pr7LU+qcUNHkxh2cYrIWMg/uIrZk0YSYmuA678a5TtmzQD9HyrsTekJ9lgCq54NiImwGGnzmEl8PjXhfvXDfZ6k/dJq+bAm58hSuSPoUq62G2t3AkYPr08c/nVH+6v/rcfuSUr+Hw5dc= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZeToRRtXYM7m5WvLfYTHmHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB5uL2/2I2FesmGt1YP1qEBnHtrBHREdAbpicU4ti4aKb3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pDxFO3v3LMeau1wUZMnQSRlGKYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9XQ3DC2qZAEuDtLkioBZ9MNJGhHpcOfb/LRc8P54k7V/HuibORzJL9NXYEh8sz/ewORahtHP+ZbmbW4eJPXp1eNtQ19EJhJFLe2qhgw2mJLRMzwAtbfjn5E2ENiW4EkrJfTw== ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/6b4406c7f179761c

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-83325578-304917428-1200496059-1000\KRAB-DECRYPT.txt

Ransom Note

---= GANDCRAB V4 =--- Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .KRAB The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/6b4406c7f179761c | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAA7ATHEe0KBTLztWhXoyGj4IBT2o/fe4PvUbpSlWWerMXRZ37nlms/rjgvHXQlc/4V2Z9TZPtDTSzYjW1rlwK6AmTI+no4Me8OG56iHKsfaB8FkyLbs53b4JIFXDgsNErTRT00k60NVJ+13sgsM8BQ45UJ2UDyx+X1jaQbP6YpRc6txuCVdMbx54Qq6YF+zHiyb0/UDPpZkC73wOg9hl7yOb2aDL6J6aqs/NfDnZuLw+qmBqxMAvgoTSNrHSLyl3xriuVajwS8EPAw94aSxZGR1iSsVcWKFW32fQ+0ALAxsznScQQUAnw7N4DjcV8TGT24yyL0tutsAtunN3PpLUgDMimcr0HyOU6BvJqhCEAschAZ2m7XmRitjcse4mRHfBan/rf2eBtGc6zADo85EnLdYmdTI75eEnvxBuWVeNiMKlyr9Kc19883rZxgm/EBClvd4qZGyvsOgE4uTkGW0DYXusC8PT6wmoAshX6kfjGrbB3QdZ5MUxrpQeqzlIrLYRlptSjVwlsjlUQRYbMbRWk0uCxebeQtslB2d8lAMrU0zjgX20ZY94C4eXoQ3sWTlfnxLFXz7togTppimjBm4/vT6UgEbXk13mHw3qLftplUBQ6kgqOo3Dc7nR+Q4l+z9o2aiORG0xwcLX1uccKkTHRBZyS0bOYy7T6pIMDAzF0Yaq0owBd33/99sRhIRULeyFV7bmAPwMVOy1BWZkSF/f74W0MCF3GrgvCkOCLh/OrorANwCMVMH5YSusO6UDDssl/3VBT9H3nzIOBNB89g2mi/HPHjVSmwMHK1t76v0T2+h/Tok0pENtLeeyO0Re6nll4XVosN6vHkPzkoX73Hl46Nu04xXD1Sqv9PdW6V0mU6CUep8z30lGWlNkdTkmMzAEhW++2CBobimvn0SNSt4OMTGFm4xUbyqsQ0JtDfVI1+pESNAqYKvj6Hm3LKTN5AgsO/9lsvAuDSXEKDYwXlDjnopcEVuHCP59CWYnUHngFw0+/nYBIq+6ySm6YbfoDs4UTKkmqzL024qjKbrpdoV5+Cs6nkuv8+8VrPJ9nGCLwl30GdNYYV6+5gTF46SqrRfp9QTTTEgj81rOU8T39p8Hul3sk7ZqiplLmpYwwW2vLj/TJnjIDF+oVx7ol0zckldM/vkfrdX0iaf67IBwGnGqwXhF1WJeSB1tBZ+cxU7RzczAVPX0xKu8NiW60queSYnbuaYC9t1CJFyLzF756SbYTSR6IA1ss9e8lO3/Mz1jCWo0WJmUkWZjVwTB075GiOsSd/1kFJIoJ2VwgSucukRp0I3qqTQnqbPnkGqxNbisbe/buRY1a4/ccubypQopIzIRGV9NsvH6F/w55Z5UspMe4rfOrx5N5thKnqV7f3A4gURS7szhlXnyzGMuXe5OGlv9nUOrecU9iE8Mea1nkQo28RiQP+Fd0ajH6pPxWBGDYBI3RpQR1+BoRIwCFBuj30Osn19Wa8QZlbP4aCIcA8y9lBRr1wzZtFNrcq4LVgcxPfAWqhw65pXvtHweZm0KBh/sbSVyRshypezpESL2aedRuCyOZAWAMYiOdRs61af26IzTT8mCSyQBU8kfDDJSRk9dyW7K8WT2muwtLm+Cc6gja/Cmvw7cyU2baA8MH7IJm9a66018uQ6X6Sbmnw3uXFblRaasAHfiRW3kOeSjUB59u/3WY4So7S0sb1+rh0P8p7hRoFaTq/xaePNP40Hwb667HBgCL1a4scd9rRVpYo0MxWoQsLdhfkdRLAguXIIxemR2btNoPjbCWv1BCSNSV9p4xOnIIsO9OMCTDJGRyVwoeqwNFlr4LyliRATpSCj38f80ZuW0eg8FvBzuxN6hfdQBbaU8FDIFr63XmhqGKj0Ue4d2N8QCTeu5YXAQ417OOEkDfJNxbCsa8b6YlpAKlYRjp3j8nWzUb24FujwL+AfEJxR7vGElN/n8mWaS0uuzVdqW096/mq6IVa7zmBYxH7YiRY4Ge6sVwgt7syhJd3sh6Yf+G+ngQdwf3eoPIL23VXAW+b/T1SZp3RiXHO5A93+8WxeFfXmnaoVPl/8emDc+akKDdm0lwnuQ9i1rOyvpvBh7IfYja9astkHAYjJrWTxsgWdIAIVpB7ahiqZP4HKignoQv1jpAjcpjlCmO953i1K6Gkse2Vyjz+Xj0qkMj/buTxhF3etV0BsTVckCM4fvv8OawNO5A4ifZBMApQB0Dv/iai04nqmtkPGnFk3XX8Fe/oagSxQ= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZeToRRtXYM7m5WvLfYTHmHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB5uL2/2I2FesmGt1YP1qEBnHtrBHREdAbpicU4ti4aKb3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pDxFJ3vTLMuao1wUZM3QeRlWKYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9XQ3DC36ZLEuLtJEisBZ9MNJGhHpcOeb/JRc8P54k7V/HuibORzJL9NXYEh80z6OxeRbttC/+YbnzW5+JOXs5ePtQv9FxhO1LD2rxghGmLLQQz3Qtdfjj5QGFTiWwEn7JfT+zb ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/6b4406c7f179761c

Signatures

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Gandcrab family
gandcrab
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (321) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Renames multiple (503) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral1/files/0x001200000001e68b-771.dat	xmrig

Downloads MZ/PE file 8 IoCs

flow	pid	Process
119	4936	chrome.exe
119	4936	chrome.exe
119	4936	chrome.exe
119	4936	chrome.exe
119	4936	chrome.exe
119	4936	chrome.exe
119	4936	chrome.exe
119	4936	chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation	GandCrabv4.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\f17971f0f179761e50.lock	wermgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\KRAB-DECRYPT.txt	GandCrabv4.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\f17971f0f179761e50.lock	GandCrabv4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\VANILKQEUN-DECRYPT.txt	GandCrabv4.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\VANILKQEUN-DECRYPT.txt	wermgr.exe

Executes dropped EXE 5 IoCs

pid	Process
5700	Gandcrab5.0.3.exe
1220	GandCrabv4.exe
4384	OctopusDelphi.exe
4088	OctopusDelphi.exe
1432	OctopusDelphi.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x001200000001e68b-771.dat	vmprotect

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	wermgr.exe
File opened (read-only)	\??\P:	GandCrabv4.exe
File opened (read-only)	\??\I:	wermgr.exe
File opened (read-only)	\??\N:	wermgr.exe
File opened (read-only)	\??\U:	wermgr.exe
File opened (read-only)	\??\A:	GandCrabv4.exe
File opened (read-only)	\??\J:	GandCrabv4.exe
File opened (read-only)	\??\M:	GandCrabv4.exe
File opened (read-only)	\??\T:	GandCrabv4.exe
File opened (read-only)	\??\Y:	GandCrabv4.exe
File opened (read-only)	\??\L:	wermgr.exe
File opened (read-only)	\??\R:	wermgr.exe
File opened (read-only)	\??\Y:	wermgr.exe
File opened (read-only)	\??\Q:	GandCrabv4.exe
File opened (read-only)	\??\S:	GandCrabv4.exe
File opened (read-only)	\??\V:	GandCrabv4.exe
File opened (read-only)	\??\Z:	GandCrabv4.exe
File opened (read-only)	\??\E:	wermgr.exe
File opened (read-only)	\??\J:	wermgr.exe
File opened (read-only)	\??\O:	wermgr.exe
File opened (read-only)	\??\Q:	wermgr.exe
File opened (read-only)	\??\W:	wermgr.exe
File opened (read-only)	\??\K:	GandCrabv4.exe
File opened (read-only)	\??\N:	GandCrabv4.exe
File opened (read-only)	\??\U:	GandCrabv4.exe
File opened (read-only)	\??\A:	wermgr.exe
File opened (read-only)	\??\K:	wermgr.exe
File opened (read-only)	\??\L:	GandCrabv4.exe
File opened (read-only)	\??\O:	GandCrabv4.exe
File opened (read-only)	\??\G:	wermgr.exe
File opened (read-only)	\??\T:	wermgr.exe
File opened (read-only)	\??\X:	wermgr.exe
File opened (read-only)	\??\B:	GandCrabv4.exe
File opened (read-only)	\??\E:	GandCrabv4.exe
File opened (read-only)	\??\G:	GandCrabv4.exe
File opened (read-only)	\??\W:	GandCrabv4.exe
File opened (read-only)	\??\X:	GandCrabv4.exe
File opened (read-only)	\??\H:	wermgr.exe
File opened (read-only)	\??\Z:	wermgr.exe
File opened (read-only)	\??\M:	wermgr.exe
File opened (read-only)	\??\P:	wermgr.exe
File opened (read-only)	\??\S:	wermgr.exe
File opened (read-only)	\??\V:	wermgr.exe
File opened (read-only)	\??\H:	GandCrabv4.exe
File opened (read-only)	\??\I:	GandCrabv4.exe
File opened (read-only)	\??\R:	GandCrabv4.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
106	camo.githubusercontent.com
117	raw.githubusercontent.com
118	raw.githubusercontent.com
119	raw.githubusercontent.com
142	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\pidor.bmp"	wermgr.exe

Drops file in Program Files directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VANILKQEUN-DECRYPT.txt	GandCrabv4.exe
File opened for modification	C:\Program Files\JoinSave.7z	wermgr.exe
File opened for modification	C:\Program Files\OutLock.ppt	wermgr.exe
File opened for modification	C:\Program Files\UsePing.3gp	wermgr.exe
File opened for modification	C:\Program Files\msedge_installer.log.vanilkqeun	GandCrabv4.exe
File created	C:\Program Files (x86)\f17971f0f179761e50.lock	GandCrabv4.exe
File opened for modification	C:\Program Files\DismountConvertTo.potx	wermgr.exe
File opened for modification	C:\Program Files\DismountRename.vssm	wermgr.exe
File opened for modification	C:\Program Files\InvokeSuspend.tif	wermgr.exe
File opened for modification	C:\Program Files\OpenAdd.mht	wermgr.exe
File opened for modification	C:\Program Files\SetSave.shtml	wermgr.exe
File opened for modification	C:\Program Files\ConvertFromFormat.ram.vanilkqeun	GandCrabv4.exe
File opened for modification	C:\Program Files\InvokeSuspend.tif.vanilkqeun	GandCrabv4.exe
File opened for modification	C:\Program Files\NewPublish.easmx.vanilkqeun	GandCrabv4.exe
File created	C:\Program Files\f17971f0f179761e50.lock	wermgr.exe
File opened for modification	C:\Program Files\chrome_installer.log	wermgr.exe
File opened for modification	C:\Program Files\NewPublish.easmx	wermgr.exe
File created	C:\Program Files\f17971f0f179761e50.lock	GandCrabv4.exe
File opened for modification	C:\Program Files\ExitDebug.reg.vanilkqeun	GandCrabv4.exe
File opened for modification	C:\Program Files\SuspendUnregister.easmx.vanilkqeun	GandCrabv4.exe
File opened for modification	C:\Program Files\MoveSkip.3g2	wermgr.exe
File opened for modification	C:\Program Files\msedge_installer.log	wermgr.exe
File created	C:\Program Files (x86)\VANILKQEUN-DECRYPT.txt	wermgr.exe
File opened for modification	C:\Program Files\UninstallUnregister.wmf.vanilkqeun	GandCrabv4.exe
File opened for modification	C:\Program Files\UsePing.3gp.vanilkqeun	GandCrabv4.exe
File opened for modification	C:\Program Files (x86)\VANILKQEUN-DECRYPT.txt	GandCrabv4.exe
File created	C:\Program Files\KRAB-DECRYPT.txt	GandCrabv4.exe
File opened for modification	C:\Program Files\JoinSave.7z.vanilkqeun	GandCrabv4.exe
File opened for modification	C:\Program Files\ExitDebug.reg	wermgr.exe
File opened for modification	C:\Program Files\OutLock.ppt.vanilkqeun	GandCrabv4.exe
File created	C:\Program Files (x86)\KRAB-DECRYPT.txt	GandCrabv4.exe
File created	C:\Program Files\VANILKQEUN-DECRYPT.txt	wermgr.exe
File opened for modification	C:\Program Files\ConvertFromFormat.ram	wermgr.exe
File opened for modification	C:\Program Files\chrome_installer.log.vanilkqeun	GandCrabv4.exe
File opened for modification	C:\Program Files\MoveSkip.3g2.vanilkqeun	GandCrabv4.exe
File opened for modification	C:\Program Files\SuspendUnregister.easmx	wermgr.exe
File opened for modification	C:\Program Files\UninstallUnregister.wmf	wermgr.exe
File created	C:\Program Files (x86)\f17971f0f179761e50.lock	wermgr.exe
File opened for modification	C:\Program Files\DismountConvertTo.potx.vanilkqeun	GandCrabv4.exe
File opened for modification	C:\Program Files\DismountRename.vssm.vanilkqeun	GandCrabv4.exe
File opened for modification	C:\Program Files\OpenAdd.mht.vanilkqeun	GandCrabv4.exe
File opened for modification	C:\Program Files\SetSave.shtml.vanilkqeun	GandCrabv4.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GandCrabv4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OctopusDelphi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OctopusDelphi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gandcrab5.0.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OctopusDelphi.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GandCrabv4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GandCrabv4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	GandCrabv4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wermgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133886097253424897"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5580	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
5876	chrome.exe
5876	chrome.exe
2684	wermgr.exe
2684	wermgr.exe
2684	wermgr.exe
2684	wermgr.exe
1220	GandCrabv4.exe
1220	GandCrabv4.exe
1220	GandCrabv4.exe
1220	GandCrabv4.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
6120	7zFM.exe
1796	OpenWith.exe
404	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
404	chrome.exe
404	chrome.exe
404	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeTcbPrivilege	5736	svchost.exe
Token: SeRestorePrivilege	5736	svchost.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
6120	7zFM.exe
6120	7zFM.exe
6120	7zFM.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe
4700	taskmgr.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
404	chrome.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe
1796	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 4732	404	chrome.exe	86
PID 404 wrote to memory of 4732	404	chrome.exe	86
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 2112	404	chrome.exe	87
PID 404 wrote to memory of 4936	404	chrome.exe	88
PID 404 wrote to memory of 4936	404	chrome.exe	88
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89
PID 404 wrote to memory of 5600	404	chrome.exe	89

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/topics/malware-samples
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff82ac8dcf8,0x7ff82ac8dd04,0x7ff82ac8dd10
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2064,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1540,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2264,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:5600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4372,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5016,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5060,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:5472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5088,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5448,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4804,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5556,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1500 /prefetch:8
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=4852,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5760,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5836,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5820,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5732,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5904,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5972,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5940,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6260,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6232,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:2484
- C:\Users\Admin\Downloads\Gandcrab5.0.3.exe
  "C:\Users\Admin\Downloads\Gandcrab5.0.3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5700
- - C:\Windows\SysWOW64\wermgr.exe
    "C:\Windows\System32\wermgr.exe"
    3⤵
    - Drops startup file
    - Enumerates connected drives
    - Sets desktop wallpaper using registry
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2684
  - - C:\Windows\SysWOW64\wbem\wmic.exe
      "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
      4⤵
      System Location Discovery: System Language Discovery
      PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6236,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:2420
- C:\Users\Admin\Downloads\GandCrabv4.exe
  "C:\Users\Admin\Downloads\GandCrabv4.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1220
- - C:\Windows\SysWOW64\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6272,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5924,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5480,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6028,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6152,i,5868567290193473912,18323128313378449540,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1500 /prefetch:8
  2⤵
  PID:4608
- C:\Users\Admin\Downloads\OctopusDelphi.exe
  "C:\Users\Admin\Downloads\OctopusDelphi.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4384
- C:\Users\Admin\Downloads\OctopusDelphi.exe
  "C:\Users\Admin\Downloads\OctopusDelphi.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4088

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5736
- C:\Windows\system32\dashost.exe
  dashost.exe {7581b3d0-7c33-4246-bb6cbc8ae59bb386}
  2⤵
  PID:1952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1436

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:220

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\AcidBattery1.0.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:6120

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1428

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\KRAB-DECRYPT.txt
1⤵
PID:4356

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\KRAB-DECRYPT.txt
1⤵
PID:5160

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:4700

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1796
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\DoubleFantasyEquation.bin
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5580

C:\Users\Admin\Downloads\OctopusDelphi.exe
"C:\Users\Admin\Downloads\OctopusDelphi.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-83325578-304917428-1200496059-1000\$I03U2KP.mp2

Filesize
648B

MD5
3a265c408740636a3c879fa0af9af71f

SHA1
b46fc16ea660d0370841b5640f31c5a4dc39aa96

SHA256
69e8123334120be1377b395a12f6ffff019c15f361ef7723f34f36682e32fb1d

SHA512
63220735cae0ead2bd3e4624da4f9e110d646c97990b5984ecb84c79929b05f1b82623d51b5d7f9bca8bbbd7289e9a9fb589aa66ab19a3f02d8979c97e9bf16e

Download Submit
C:\$Recycle.Bin\S-1-5-21-83325578-304917428-1200496059-1000\$I0BLLC5.vbe

Filesize
646B

MD5
cc93fdbd8c02d209f173f8711c70e196

SHA1
d9115e82dce7f6463d06ada76eff02c62e2fd153

SHA256
09a56f75b47b017253c85f5abc58028e35edd72487e1d9aceb632ef16bb13975

SHA512
55d7be47786434dd6712502561f800356f86b7c554f01d063bc30d463bdf14a125480a26dc9f23d83a248205e1ddccda44fab2c8d695563eda9748c5816a24cc

Download Submit
C:\$Recycle.Bin\S-1-5-21-83325578-304917428-1200496059-1000\$I2MYXCP.html

Filesize
648B

MD5
f9d26e7a4a83495d5f12d6dbe06a9160

SHA1
7733bdd612bacb27951aee9e8f2d3af5967e5e71

SHA256
d2b7d210606a440af3d5f0e099440fedde8c260cee22a676853269d292d892e4

SHA512
88e3a9494a2fb91cfd2de1a60a0d42a1192efca8269fe5aa2bd0ee77620cdf22715999648b60fbcd1b164a6fd3b92ff2a3f66da6c9d78145c800110ef5e031a2

Download Submit
C:\$Recycle.Bin\S-1-5-21-83325578-304917428-1200496059-1000\$I314NGS.vsx

Filesize
654B

MD5
1607c1860717849f4eee89d0d9498eb5

SHA1
97be46cc9f836fb70dad4d52f8600af851585413

SHA256
39f6dd8883b5ff4fb15819673004e5b2a2028894300dcc99fb327c390a18bc37

SHA512
75ac26b047a02d42c4c472f6fc108476b87e9481235b3bb2a1b3168ffe84e3ef264b499c24e3328d6237c96b7030179c136280aed8371ea2c9875e3cdd946aa5

Download Submit
C:\$Recycle.Bin\S-1-5-21-83325578-304917428-1200496059-1000\$I5YQ5GP.vssm

Filesize
656B

MD5
a0ecf6cdec63a6c89704a987d2a7eb33

SHA1
18b529e4f486acc4a8d4cae44784fbd4f18f0b7e

SHA256
f31992220ab11f7c2028126d311b3837d14523c8baeb87eed9b7b9d6becb7781

SHA512
7067b802d1f3418fe9bef0fffafad8aab847d750c56ae43482484980b0ab5c33a954d9c3332d6cc22c7dc26ea5a64ac00a9b0cb296961eeb55bcfdbf2cc3783b

Download Submit
C:\$Recycle.Bin\S-1-5-21-83325578-304917428-1200496059-1000\$I6G8UBZ.i64

Filesize
654B

MD5
bbda4497853ea2fab4f4040afbaddd7b

SHA1
26c37141f42868dc99d6fc82e0f5bb9712af1dc8

SHA256
4311523fbc2f13eaa73e6fa7a0afbfc0c0e1630b2187e82091471be1647a862a

SHA512
891d64e252f77adf71dbea3d8a885d564a9f0dc89d080452b5559795e38dc5af86bae3ef46660321d07fe630e9fd63bf5c5162323690b6de2be91bb026e43bac

Download Submit
C:\$Recycle.Bin\S-1-5-21-83325578-304917428-1200496059-1000\$IAU79OK.odt

Filesize
656B

MD5
409681bd0e3bddde64bca61d735364c9

SHA1
84ab5a39607685afd4b7cb084223902ed5ba6b48

SHA256
e08d1b58b35027f292703bfec392a32c3ee6fd406b0245707cd0329ce819c70d

SHA512
020f331ef4be838b9dd915a46f81fa502ac2fa129540770bb2533f52a701533d67afdbe78abe04e4501f239838d8ca37c6eacc66f136b437aaed2e04cdace7cc

Download Submit
C:\$Recycle.Bin\S-1-5-21-83325578-304917428-1200496059-1000\$IAZ9YIK.M2T

Filesize
638B

MD5
c395900214857f46ec2512a14ab64066

SHA1
03866532766364e20a60da96620a9757a994a1d8

SHA256
fc7918c53f48f9589fbf62fdf5dbb6b11b508cabddbc7e62458c2b11868b6fae

SHA512
957572eb31452d1d07e439c4bd48f9f17cefcbd58d2465221dbda764da37c71c17b33aa182cdd1e90b18f82acf18212bc220b924510ee2320d278f4dca531714

Download Submit
C:\$Recycle.Bin\S-1-5-21-83325578-304917428-1200496059-1000\$IE9J1EV.clr

Filesize
644B

MD5
bebe0580ec9d3f95597f326375b3deca

SHA1
7f3906892a4804789fe06fe12c4e5b1c658458c4

SHA256
110e2ea36f32a70128052de851215b1aaeb7549c2e14e430fc4ef94da7f732ac

SHA512
f8a2e4c0a8006b9c8cb551aa95113f137cf4606e213b2a85ab0ad68fd05c0ffcb9850f350aee8e21040b1eeeecd00bad3429ad16b056a09f2e40f622f1207290

Download Submit
C:\$Recycle.Bin\S-1-5-21-83325578-304917428-1200496059-1000\$IFWQUIU.M2V

Filesize
642B

MD5
39664aab9d0a03ad77caabb7085a0453

SHA1
9be325fdd08c3785c97f46910c5b0a05c01e7e97

SHA256
0c0d5566f70190b305a7446184b02b89f320248401f764dcb71d2d3d81d30fd2

SHA512
99b4534a831dfdb4e45795a5f934825568beb79cd718beda83929f50e3e9f85cadb33a5edb0868231aa275d5cd0efdf2e58fe82c51586a1de3ada759b3679372

Download Submit
C:\$Recycle.Bin\S-1-5-21-83325578-304917428-1200496059-1000\$IJ26W9D.aif

Filesize
658B

MD5
194ca2d23201036001da4a13b0a390c3

SHA1
cf0129fec8e61a4166b0e9389d1da7a99dc35027

SHA256
03168e0a5ad8d08efefc7ac59481ccaa5bdc5b33bf83b3eb81a4bf690d535b7e

SHA512
d76508b2717caaef343b2b4763754fbf6d1dfc7c700696b936a3e3d06c76feb9a9b7ad7894d85152d41dda7f15d36519024c6db3f09865600b9bc9b4e925e4c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3F45CFC395459D7C5D5E6E2DBAC3A186

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3F45CFC395459D7C5D5E6E2DBAC3A186

Filesize
414B

MD5
f693a73fa2df84402ed2d9b732aca4e6

SHA1
0883702b4b15addec5aea4e8e6b8d94ee767492d

SHA256
04ade73ac4041c846849d69859bfae3c58eb85bb01e697d8e7188541fe6cbb74

SHA512
b81bdb3e15b92bd4aebcafb865216ef715582dc01b7fd02aa45d16279019ad96771995dc01b02b53f45d0a8cf628409b842d3c5a6d1c8af8ab6ee49c5d5173a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\383f2515-a6a3-483c-943b-e34572c1de9f.tmp

Filesize
11KB

MD5
19ff8ee52dd56f266a53fe116c34b610

SHA1
2d1dd5ef4f42d20d48c3abda20603ec50230526a

SHA256
d8ff78d3a32448a847e066e70a87a7cb00acda94ab542204c28777f4ea1fc887

SHA512
86acdbc7369c4537ff856e8541a5f3d3c4239682e299716c700e2ea9978a4bc8fe13090f99b793a81c48f1ca0052fad81377c96f28f509567e9e68c919365739

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\805f4e38-12b1-4f95-8368-b27648223c92.tmp

Filesize
11KB

MD5
20d418eff449a7e9b3710add0600cc62

SHA1
5ed56a8bec8ed549fbd58c1d12cbe9476f5046ef

SHA256
45ab4283297d79d63f39b3b3cab0cd5dfb285a14d433a43305affd9eaebd2a0f

SHA512
d1c6d6726eac7bdc418bb5318d42bd88c68b925a9cbf767a1e3a2cee3a5d133f40c80b917ef4d599de9ac3ac1aad4cf32c07996ed817ab73c1c6523f3744facc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
2a0123215ceb7affa807a2c0e8509a56

SHA1
d57471e6f883d1b93d73576baa9f28eb294b3bd9

SHA256
7802482114e7c49fbf03ba7009d7ca6d93d359237d2153ee6c3eef1f592681ad

SHA512
f6d5e703755a40194e813be14ae9639d50b1184331ae5c022918e0346235cd55009a4dc9382e04f40f4063b5a1c9905c64474062131173912d824852859c7b0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
58KB

MD5
07479cde8b9a8281882017bd0c2183eb

SHA1
984e8d0070d036796dfcdc0fed224bf95e46276f

SHA256
a474136b1d2aadb10a9c4bb7d5481e376d33195f43182cbb861def3bc6617d46

SHA512
3ae52aa700e2b8e5be6a8a25ed7486d37b99cda0e610dc475ac8a9dc060afee8a9f645598bafe4b4b520dde6bfba23485bc264d01110f86605c28306b89969cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
23KB

MD5
687d5ee4793de5b13bc7b8bdbd7652a3

SHA1
0ae7bf43ea433c214a387d2c5a87082c5b504e8d

SHA256
c02a6078fe322344c31146e51e3444bdbb2d3e2e2964e6e1e0b11f9f3253c427

SHA512
d998096ab278845599534915c9ea976df6b5308b51b805ce1a4d2c0d239a01c8f98e3df4eccabd83f8f32eeb4cfd33412b0d8dd89c4bb8226aeabc536af8f958

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

Filesize
158KB

MD5
a85f2754a98d47b084bda4d5b80d16cf

SHA1
785ba374d35ee68c12f7da524b2e21bf86d2a272

SHA256
f17170f603b0e07b71d279b17cee15212fcd7678b120cacc70e0ccee83ae4eca

SHA512
862705a71875d10fcdca8d59b69664bbe7a3d681b1bab1801c260fcaa222d45113d99ee39f08f095ac55d47031c9410f25667df27fcdbceef67b308cb1405a88

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020

Filesize
68KB

MD5
77436cd4d57837e30e272ea3de21472c

SHA1
f4db498e526946efdc3b49a28710d4fba0edc06f

SHA256
356e90662ed6550e2964419a6e1399457928f28a7124fc210b744a3aea73c85c

SHA512
2ddf77ffed4faba2aaec7370959874f528657d566e88c583fe875dde25a9da7d62b10ccd4f5496ae1f470f3e1dc0ba5295f3bb5d56c6e7eaaac51690aca7a788

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
86ac7807defc448c5d588ff5a9fb47f8

SHA1
bc7ac6f1bf74109a5f432531742fcdb71ffec84a

SHA256
481723f4f46071f4dd8222224fae4d944b10f02068e09006b2302ab0074763ad

SHA512
ad0cd5614d35e30143303813b0cf4990be47a4d103ddfedf7186ee8f0c4358361af30cfbf9982ef32a6e7bfb4726179b836cfe1041b92a8f76dae3332ef91679

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d8481cbd2e7f17b1943790fd57a865b5

SHA1
95c3d7b223bd9f38640fe2c4547375bb5b1e5ae3

SHA256
21422d6158d88b1812700384449f6e9b81b619d13733731aa3c48557c176a133

SHA512
35d7824c2abf9766552d8fc8648a61371c6dd28a8518f0a0cf1a078cc8cdbea4f2a030f29c6703549e22871159e7484902042ff2a03516275ad4c049d5a177e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b43a3ffd1118aee968f9a49d3ed566a1

SHA1
7454e872234050c04cbc9ef78f4608a166b35cd0

SHA256
8a413467470c24da30226ab7a00c0d79af0deea5860e9aaf0b9bc683653f52dc

SHA512
c78db931e02af9a5c3b93434cf2ce0fd4785ce5463cd7e2df14d232c4ce86dc4d4494fc1d8b687a328e9130d663230f788182488de85c8893756ebad11cc0e5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
0cf7875ff25d639f729d44d223a2e6aa

SHA1
508be23e9b6ced9c53804789a50ac64dce273f83

SHA256
0d9d10ef99a1b1857bc1bd445920fa9e8b878262d84cf86327135da6aa2208c1

SHA512
188e35494048f34825fed67dfba7e147def3b8d2e72f4300640170d6e975a223443d1b92a9d9f3c40bab423de48bfc03b9a9863c0ed6169a656fb5298f4c5737

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
fafb2929a14723e2abff856cdc4f48f8

SHA1
1acc46aebab45a12e76487001414d139d51c953e

SHA256
49e4ea397ad73c4614e4f7dbfff09e4bbec487d89870bed25bb8a52226e7dc7d

SHA512
a7d352dce3810a0fd767bb69c16bdd0838d806f330c676abf55f2405f7f6b1d7d3b9c283cb2a05a88f0261109479aff922b75da51e4e105c5e002c5a752a1921

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
fd1f4ccdb90871603e4c9a8d2f7d0e5d

SHA1
b06b3fff05d3d27f1bd0c85eaaf4bdad7d98a486

SHA256
c5fd03abaf07c43f88ff2f2b2a6cf477a2045b4b1c4bc43750c9ff70bb5027da

SHA512
4665c5d667d55d3714fa7c52cc7f9d92442b35507beecb5b402195338b8bc81850e21e30b492bc8b90f4a7a27862cdb13e1228a0f7fccd32ecd6f4d1a666c331

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
9fc86737c45a7a52b2a2da082c1ee8fb

SHA1
a3fdfba544ac870dccced0e1072fea4345bb0541

SHA256
9ebaf60e1e4fddadfb48746d04b78e03226ce0b2535ca8416c427ca46bfc4c18

SHA512
00beaf14b4a216026fe424396e52e481081521e0c2d9ed36209c6b2c983a16eb8b9623d5cdc407d0ea1d4fcd6541dc44f3e4bdd6b8dbb6075a73ead733510148

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
cd052cc56a359038d69c1d0bc7b48c76

SHA1
596853e44426733572778de4254dc3a1d10efb4a

SHA256
272f233dc62be8f2b5d25c7e28a19e84e9fa4c8d0b9c6b178361594cf0ebd7ab

SHA512
672dd8a523604be1d19357fa22b8c8a84740af51fd53c11996814452799fb5fcdb82aff0e77ed85ac8c71edd6931a8285904179c32fb9ac50666faac8bf80234

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4791337c89f1d29eaa5cf8eb40c78fd8

SHA1
84d0527c1f227c84d77956d50e3d8fc6e0d29124

SHA256
030575e82342b64f687e8ac20d102d925d4b6e713409738eb747cb019db6c22c

SHA512
897d31782014988d2e49f638d80c8407b66964b84c437c08ccf4f3601b8e9ae1ceb59be0859935376c32b73da3f15636099b91c03b80b5eb4d67c91b4f18cd28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
92ab3c8c194f4e702a87a2128c4f0181

SHA1
175b9ce39ab81fc0be02f970dda142a5abebc319

SHA256
773d47d140152ebb42e9adba7cf61c0fd0942637b3cee33edb9f3cc2e7930534

SHA512
9e491f867dbd7120d09d364484c95f6ff56632c18b6e6f4244b0bb3b90701263fa2a349c0d1789b5fe9025fb7f01dc1969bf39c44b5cf8537659cff834a22074

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
31769f359a90f21a1957a9a376a13686

SHA1
135d2ee7a4109a898e49afc8957e3542f50809b1

SHA256
00d67781d79287400c6ec18e01cb901e032dadb4bd09b1080cbd485ff058f28b

SHA512
08c6c356e0fdec9f24ad91b9fa3f556aa7184e3d988ca68940cb9712fa39aaa54bbfd564a979c6af53d3f12749c4b0a61304e59f9a57c3e3b3ea7ce71ec59bfa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
b059fd376bb568336a6c35fde2469a56

SHA1
805a5c94cb2c62df047da75fde38ea20e94f0b5e

SHA256
ae0d120d8108a5c10ae4581dbbc18b196a3b5aebbd7e9a6835d7f438104fe2e7

SHA512
cba2fc067a92e7619ef33c0c013ee8067fbecf5d04f81079f6169eac3a91afcf6df246dcc72e95ecc3cfc0cec0744b569c2314ea6d2f852ab5e248223ba4be90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
a23ad4002a174c45e7eb05052089308f

SHA1
d6b8f512f10ff2fcc8dad00b125fd6190341c05b

SHA256
0d8c7defe27b00b3bf145a6769851e2b8d6df030c3ddcca6fc236f32e5fa305c

SHA512
1396f2bffb654ff68fb3fc066a90194520aa678f4c11ded106618b3983fe4d5fa23084db2fab48330305744666d523a47a716b5f55bf5a3f4704e7f759aa5275

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
fe322e13528bea37e5788453ae5c520b

SHA1
fd15d22c31d8307ad26c5911cce28e616d726fa2

SHA256
bb7038c24c5ed3ba7a2e9844ed38a2257ca719f202855c5d0d37d8e8ed85eb9e

SHA512
05ff650b7f52af6133c1e8043f0d156a8d332737c110403a88af48911114157cd592e689248d8af9a125ecde0650d92f8a0bd26c1deb661a7103cb84e23697ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
d591a2e1438e9aa504df8dcfd150c174

SHA1
aeb6b2e73e7cf7e468e7dbec2a13360da4e0e3c7

SHA256
049dbb9182b0ddc977af9374769e99f4e3639764c2de8c2fb9ff55a36dfebd75

SHA512
0511b1fcae46d8597af48020257515c352428ea263ec900e637e28c5519fcb0f781e769d4cea7af7fb875439eaceddc2fb0d0ef304dd67f7b6363ac2bb18437b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4a9cb4b59f1dd6383e9025fd914f4a0e

SHA1
a1eab4d08c518d62142197f759500b57b501d6df

SHA256
ff0d2acf5b188cb13c03752be2e5cf9188bf8cf86fcfe4269d7aa0f03752285c

SHA512
165510d4987467335b5ae3cd71fa2d2844e8c94b08398041a9ae219a4922d6eb265993e420731cdc6294bc2a91bf8a7ee8dbbe2a31ba806f87cc989b61fd30a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
0d6a464d6fd7f7eaf0de6dde019996ba

SHA1
1886c25048759f9a48c950a3b11cd388f62e7fd9

SHA256
1ad7160b81272d93cb820529c3c30490c9efd854febff58f4091abd12576822a

SHA512
c69607cb13853d345f4ad05df891a6c465db32ad6dec8ebba0ed856bcf258c89b725fc1a820a7cb48af4106944b856a1d37185dfa590f6cdf41a71c690cdbba6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4695a301daa67dbd7476dd462abc6f41

SHA1
46b832a9744c347c66f97b7efa58c418fd55ba2a

SHA256
47e33110d7ae98ba5d9afe487a75124d8a0bac92bd3d62de1015da160c7c7dbc

SHA512
8425158e7d25eb9fffe4273b173b40faa2c9177f61a54a43b7e5e4c32ab82b567964e0296e95080a398d758bbe05219eacc383dbbade46c893e035e5c6fd7f24

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
7c89fef0ab03cc3e578a9211f6840795

SHA1
d8d12d69f5dba924561712ef922d4ea52277c0ce

SHA256
d5218e81a14ff73f63f0501af51a3a52e721948495e36a0722da76b5d7511b97

SHA512
ea4bb7b59aaaeaa626b8f010a518fa9e9e50c3bb61a14d4314471c0e7b5528ed80177934cabf71c9cd74947f829841d26699fd8da5de2df2e5ebec830fcf3c77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
7135375693fa57ac358b3baba886e1d1

SHA1
0dacc9a5e4a13b6f4f43f0333375dae3ad8491dd

SHA256
0817c00ac38ee0f3fc32f869fd4817274247a9ec1b312d9dd55b0f2b10faf4e4

SHA512
1bc16b26d0b6cb89196f0183253a95f615b9201005520e0082a17ae2cdb05825712461f3a3717e936bffdbd2390a68c5e955c04a93334eed5b67dd6845bbba2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
302cb40adbc835dca738fc7aa3702e77

SHA1
95d920ec751c52a35ed059eae1f8e0b5ba9c8265

SHA256
5314a3d3ea0d12066c7df54a9bfef6925552130bd6da8134dcc0623d8e299187

SHA512
b873f9d9b9782a1d35fd390365d1ce4b4d53f98bdc05004668fde7aae93cfdd9a8198cd94ab9573bbc6f4a6dcf4ed8ceca7d3cb750d83ec9c3d0eb53a59c5cf2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
5377f52d77a66357f68b96538bd3483f

SHA1
63fc28d182db03a21c3e32fedc26effcd2be035a

SHA256
545d16e54317e2a56965362e4302b6d794a64bfb85fdbea1335a8766434c4645

SHA512
d1da5534dfb998f7677bfd60766721e09facffd4e0f5f0d1e01b28026497ec8a88a3c44ce9261f7914ae3ae758a2561db3235bceb0e5d620dedb139117d42cb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
cb70538fafac9a67decd888502f9ec2c

SHA1
8f5e0992cd6e669ddbf78bd85757cdc4eb4176d0

SHA256
9929faaa53a352cda3cb856ccb596b66babe173871a11befe36f61546741b91a

SHA512
45e0686bfb503615d9834a0663a8bcf26957e4defdcf7322b43f249c7e335b0f7cbbb87f332cbf06e6dc45fecb271f81b6f351626684f2f9368f0415fd7166a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
f3dd05392643bd61de483ba0d5a4a806

SHA1
743f49c54204fe972f837baae575b3911ab1cfe3

SHA256
a822be94a44e329a7de57e1ddf269750624d95a95ad21316f497ff545e0f3b0f

SHA512
d2bd66df62c0fb02f14503b29a941c7c7864dc3955d91ee50077106e09d13a1422f13e6aef6a29bfe17c8f35bb0f6936ab9444b1074f5e49dfd5f3b1c595205a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
cbff4d75a8b34945fc00b0f9a1ad2964

SHA1
ccc15ac215aad1b231c4095b041e930b350d808d

SHA256
a9f4c8ca87b029cb645afe7171f20bc903ced42c2efd1555a375b8f2f69c345d

SHA512
3ed003321b5fd65e5a6c1909cc7e588a359345206a4b0e6e2d6509b34d046945d5eff2b21867dfcc3b1febd9685d753351b8ceefc2508d13d7d26c6ed0f79145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
c0f738fac7f7f4abd16f730c578332f5

SHA1
9246cfaea53d76cdec1ae191ebff9bef4c6d3812

SHA256
0eebff33d23429faeb502b782cee9443f9273e010ce2a2765bec12a057487337

SHA512
c3030c7c9ac047334ec379aacbe2fe70db0db625ef6b0026317ef819434c28005b5261c0f1e1a84d8e2754a69e84f052f8dd727a4c2d57b5fe3fabd18c63d913

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
b482eb22678bc35d925ea44bfdeed029

SHA1
b0c335cc4ea7f738603e1755ab846e5c41d0b956

SHA256
f206c1cb9ac7a9c92388b7ae5b5602ef21157c2a39ba8e4f1a4e17292c74ad0c

SHA512
5b5a3a460b913bb963de1c2788b5fb3a048f0a71623c678869ccedf269a7a89564a94f4048beccaeb513c574bee0457f14eb86a3779e5839c54d6ee9d07d18b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57bb61.TMP

Filesize
48B

MD5
104060933e314481447785a6b808889d

SHA1
5d36d5bd3dc57bb9dcf30c7e5c2db77327c0eda2

SHA256
fe0c000bae8558b0d4ed8e66d890eb6dd97fd677c2f62ff1b727468863799151

SHA512
d6044c28a1e6ff2cb5fca428c90e4ea723a8c74ab4ba0554fbcff9481911968e3619f47f55308d58373dee511822f6b0d23613b988af7a52b95cddb86a5d546a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
4ad4460942852c5af4ae720b9a22091d

SHA1
b9671db2c437e6ac0c5a95564c99c78f964c1f45

SHA256
c66bb6be32312498fc9aa1e15e896f0b6eeb24516a11261a33e4d688638d1b76

SHA512
f84cbc1b351efac9d018cc18ed40518e54b786923830b0ab82809a76d5e04c5ae3592b0d231f63408b426e8b3567a20b6ff10bbde23087eb3c2348541c252175

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
0b52644a106b79639f484a9eb2be1acb

SHA1
292a4fdb3a787f7174df70f4d9d3a79211a36579

SHA256
38ea6364c7e19234fb01d2f46d34db6011d98e38264709cf278d0efa3844c9a0

SHA512
32a5fc3ef77ec41c73d3c87ac58bad9ea38160ee7a93d83fea0d7cc6ca74ec7846adbde37ab2e7774571945794dc8e361ba17a74cba4c4cebda9c892c760d776

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
c147755c833bc0eceb60a587a9dc50c2

SHA1
47917008fc47292699ea6e88a1982e4ff265332d

SHA256
3c05532db51b8b9211ff40ebffe8f79c542ad4e58428ab4be83d87e7cf13a280

SHA512
5f5132e10ab2606363e82231505e46cd239ce9d2d003f72f6bfd4d6d70a8952849e521c6d0a6d9270997f884a66bbc24a10145b1c938ce17b02ef993bd0b36ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
3362d415a3e85c9bff9af93f9ada6019

SHA1
ee853e0a350dd91d73e80ad7eacc776de24ae19d

SHA256
72f8c59aed8b0ee6e04d83a499fdcf28237d54fd5f4452b0a466bc16c606f59d

SHA512
acf8513a4d49b6a939611f662b4bf107ac3af2219f78c4ea6870123c400c2c96f5b12963c3ba9a454e27f3739cfa2e82e3b70150da2c6cfdfdb1d85c00003b25

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\VANILKQEUN-DECRYPT.txt.KRAB

Filesize
9KB

MD5
841cf4e353d866f50141026a55e7e05c

SHA1
ac205ec88af35ade10ed2be1a909b2aea32a1684

SHA256
01a1a12e1b318342af383cdbc6d54b875c6acfd923b7f377c32915c34a23d8be

SHA512
558fa8324fdae4a61731badaf462f4056bcf3d4253d268728beefbf9a8189ca146893460f9ff47e761b4639af8a02cb82038b89c41f3c09937ca03707fd5fae8

Download Submit
C:\Users\Admin\Desktop\AddSelect.mid

Filesize
1.0MB

MD5
32adbd82f2bdb60418a56b01d03e1f15

SHA1
fdb82882af5a7c3355ac3148969d1832c8ba76a7

SHA256
56a3841c1ca24d99780f8b95edc1f4e8fd795fd879246d21c09bd47cbf82caa0

SHA512
9e3a88b2e03dfa9dfdcc3a68e918f113fd8d98a231246de176a929293d7faf7dc6b7acd2cb08934b7c0a4139048d39539caa1e40ac362c7fad85c8bbb02cff99

Download Submit
C:\Users\Admin\Desktop\ClearShow.iso

Filesize
383KB

MD5
c63ea632b85b93fe4b5281e3230e5fc6

SHA1
5b8fcce8143651dbd623369733c81c9b7d1fe2d5

SHA256
d9d176d5925e400c53f5a363dfd4e6dd974ea4c8a8c02aad7b8a4e3f55c76603

SHA512
8e7c7a44cf63430fe0f9366c9403a36e3abe8b82cf284bd23cf69da79b4d341c5eafdd17a63258af8a10a9e02ccfe89897d87bbc759824386eaf54e5643f5c57

Download Submit
C:\Users\Admin\Desktop\CloseReset.tiff

Filesize
406KB

MD5
79e48ddae9098a998459b293ac4a99bf

SHA1
5c344bdd551cb768f4dc04e4f4475582ad8431cf

SHA256
a9362ca466afe8183a5e6b4696cbffc14dd9eb90b00f52ed01de4a927728ff93

SHA512
0a43398cd1e0be13aed5f7b859f3f43ec71960e7b4e96e8d16f8dcc84ba229aaf43491f6559fa87b2079915502d7b5e308650195fb6e6b91d2851ba882dc6868

Download Submit
C:\Users\Admin\Desktop\DenyLimit.001

Filesize
708KB

MD5
69e7640f89c249c65a260376ab10b329

SHA1
19aad5604485c279348cfbe56ccb4a6e94fd0916

SHA256
387c70e63e2df5d83989c5d0c1513c5a14977d74f5ecf52277f4644bf4cf2d07

SHA512
5eb3081957fc9b3fe0541e51157838f9f76d2ff39fd5d645393b6d896db030b8d7e0b50e96eef1c702da82a3091b9cf430fc39766607a28d2470c3995b318f1e

Download Submit
C:\Users\Admin\Desktop\DenyRepair.docx

Filesize
18KB

MD5
a73ecc3b264c467aa4793bbd1cb439fe

SHA1
2881c2b8a8568a677c203b84d319193ceb24726d

SHA256
2ade80395881479c81ec06892191fcf1efe6376b37896713452ac865a9902339

SHA512
3880ea06c3cf102ecf011b0d0781f8ef97f3201193d3f484986cd51db8b1e25a3b5fa50e5252cd28371c6f5c8f0e461d56d2ef5bb7c8ca4b770abe2c7da1002a

Download Submit
C:\Users\Admin\Desktop\GetJoin.M2T

Filesize
731KB

MD5
3b66070b8ea19d4ea46e54eb339d8f6e

SHA1
243abe8b531870c898a9e233301c561eed933dd3

SHA256
2f905c4f134659c689703a6fc15b856f0505f37f54c468b984fd0dc67fd2f9de

SHA512
1f92f943a2e6fa78493cfead94e50d6a2cde97e2c8693ccf0ad82ee76a449aba5250012fdf31332e494ec9e7b1153b0b780697b504279b945780a91de8a00f40

Download Submit
C:\Users\Admin\Desktop\InitializeMount.vssm

Filesize
615KB

MD5
a009fe40e4a1ef43368e971ee37a9b32

SHA1
1b5b6705029edc9b553983d36307adddb810c1ed

SHA256
6aa6746146f20cc2ce6fbf2bd21ccab7fbf2a9d95e5b1fcc36b3338a6e6fe6c5

SHA512
31486e363e214338efcd0a60f91136265c2bf7ede157791b26c3da6416401ce2e7f75e0772fa1a7eae4a620e97d450bf1d7485a7bed9d2b45dce705ff7eb9127

Download Submit
C:\Users\Admin\Desktop\LimitSuspend.mp2

Filesize
476KB

MD5
1d119e0e446a4fe46657a0aa22f2e0a5

SHA1
9e37e4ef8a3e2210af81148f03f554f4078a6a29

SHA256
3a0f979ff9b780a2d32f5c27e365de55c1940491987331d45cb2c56392fe42fa

SHA512
1f9ad965f239c6a16bd711afef1d2f4912c333a905bc7f69db03cbcd2a07f953878b40e50d5275ada7bb6c4f68d7f96ba759edc0e23aeae7b10a44fb079cf52f

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
1042481938e7f88586f49a54c254587c

SHA1
dcca557fb39ad03fdca3ca2a0ae1ccd1aadba88c

SHA256
b75ba0539dd9b29cdae75a252d4c282b53579695b9c11c6213f3d0d20fc982a1

SHA512
ff99a7cdbbdf0d737029914cdfd37f4655ae749e9b309435a14d8cc241cb0a1f4749e32e854c8b2a925921ce7b5c04a43b887525e411446091be1e2a85cfbe9c

Download Submit
C:\Users\Admin\Desktop\OpenConnect.html

Filesize
522KB

MD5
a29515c0eb9f280ed3f5e526c49de0b7

SHA1
6e9cb68e4441bfb10982967b41f436189f4af492

SHA256
8c0e2919e9ab8293c75ec0e099e410e826ec6f002b39cc8b4ff02f15376a2154

SHA512
38d1bfabbe1dc9713eee6b46ac60c92a9f134525dcbd22f50dea50f9a3806f0c6996c7de0217a107345be79f05bd0c79ba55a63742f24b7db4033370d8f980d3

Download Submit
C:\Users\Admin\Desktop\PublishInitialize.aif

Filesize
545KB

MD5
f76d75c32337b7e9cc366cfb1013830d

SHA1
e51aaa313623fd78c3e52adfb197f405f0a6a5eb

SHA256
666316509ed775095f0f960fe6e3ee11da569321a263138f5ffea3a8b997f758

SHA512
e0b5885a7005b9af526f7c70536a481fa61ed1ff66db7df44ddcfad2275596958926a0faef21b3794fa60f929374e50b3b658e9f26830555c8d419464bed8591

Download Submit
C:\Users\Admin\Desktop\ReadUnlock.asf

Filesize
592KB

MD5
cf374059897a7884ba0f04c9fd1df546

SHA1
c10e30b54ebb618f9cd7bf4392c83b01527b5690

SHA256
826be293ce32ecf3a42693e55cc0c7e324ca10dd4077d2873af381bae7caad94

SHA512
d7fb82e8ec900fcddedcb8941a4744987cd886b5cce7e168913dcebb8726d6573f3d95e7ed74c437a1d2c0331b140ad9f21f4e56a17c601edaea79494ab39410

Download Submit
C:\Users\Admin\Desktop\RedoEnter.M2V

Filesize
662KB

MD5
20a97ab9bb468fd21a20ca85d6324764

SHA1
f2ac763fe54858c1049ca294460c1be71f2cf1fa

SHA256
3d6f07041a208823c42d319750abd890d373d45ba93fa9dce70cf38c78584cf3

SHA512
136c6233133e66af8009b3b974114be1eaf4d8809be94b0e66ee7460397c65fe1dcf322394b448584ae2da69fbe780c2f48ef598da36fa9300bd1a56af4cb311

Download Submit
C:\Users\Admin\Desktop\RepairTest.clr

Filesize
313KB

MD5
bb468b78118c81ddb87e6a456e8f0fbc

SHA1
10c3102977167217828428c6f4bd4190b2049fc8

SHA256
2e174554c38384aa847ea57cb8298ae9b8cd1005c52cb9f29a2adc4014b9b3bb

SHA512
b56f22139198d98e504a70807da2e81856c1d60c61a4ff83785b1290ec1d9e6f37069a973ef8e0308303adf7970252a925bae480dee3395f1446bf1cec6e2af7

Download Submit
C:\Users\Admin\Desktop\RequestCompress.i64

Filesize
452KB

MD5
9864890d986b39b53a3afdde78d20386

SHA1
919ddd41f49964a87fb1989d0dafabf1db5daa18

SHA256
59a99adb633fc9614a87c82f1137b9aaad59699303eab6a1509cfa64bff4479d

SHA512
483338c7f3b41b62d7491c8c40554168ef10b16c421bdb08d54250979041da4267017fc7b3f5258800bebcfe588eddccf417697b6b5f102a0c186c1e6c73f358

Download Submit
C:\Users\Admin\Desktop\ResetDeny.ico

Filesize
569KB

MD5
067235a80b5310261e2a3cf7caf31940

SHA1
e0ebea39df70ec3c30b33fccf5637cdedc78d1cd

SHA256
9130a196e7dd85a46eebec39a88099ee4e7ad60c34c0b97fd2a050a384b807bf

SHA512
de448b73b574c6066a94dd5197cd0af18b1897b4bc4bd0445bd328a0095b566aed34248224d21f891f448e5159ec6d527f7047d92828f699de0ff6b44baa04b9

Download Submit
C:\Users\Admin\Desktop\RestartClose.mpeg3

Filesize
638KB

MD5
de4ac847c52fcbbad49010b4101f3e56

SHA1
3003c567d07cea46184a7f239d3850f843f3c11f

SHA256
d210fef21796c489993431f64bf1d97d4546574932597f8fec0aa3150056a6f6

SHA512
c32a99c7b5a742032738150f6540ac2126c2a8d20ddcda49e328ec13796177a05fb6991ddb0a48cfc7c17eb30d7699034b260fa2ef1d95a7e66310c13ee50068

Download Submit
C:\Users\Admin\Desktop\RestoreDismount.vsx

Filesize
499KB

MD5
534c8af00e5f1250369b80871b0cd8f7

SHA1
5a326037dd8761929081015fc387b3614f4ce59f

SHA256
34e1e2ab3c0f288bb21ef53054a2e5c1639c1c4c26cb5b38fd146de47f754074

SHA512
f2a63be3341af9075ebb96e0ce506eac9d8089e2cf75e6e598b34c95be5208d4aaceb0808599052dc0f10865ed7519cf489d315429d952d0bd42ee9b9f868246

Download Submit
C:\Users\Admin\Desktop\SearchDisable.mhtml

Filesize
267KB

MD5
78452609800f187f3270c245e2bf6a9f

SHA1
c3ee24dd058467bb0ce67a7322871401a89ee597

SHA256
5179183e3a2e7783e6c1a78517bd441833e7cdaaa7e1c2a149799ce58f7f90e6

SHA512
91e9fa0d0783a3ab2717461112597492abd40ed22af48475f509efe9ffb701a6c02bbcef64aa1168e7e372803e3f38cade8f7b6dbeccb98705121fe847bc05e6

Download Submit
C:\Users\Admin\Desktop\SuspendReceive.dll

Filesize
290KB

MD5
f55700689f50c7423abc753e5fb4b367

SHA1
a65689042682c1f2c7770ea401b98d87ef20d8f9

SHA256
19af9ef57ca2b0e0a428fd7d3a6494b8e3f4e556709987c4f414b2b40bc56f9d

SHA512
2747e52b993cc8ac931ca0fc373ef6c2cce6a9117845432808bd443748cb48bf4e93a65c35f57d721cfc7aa332d6f5e955945bda6ce90918dc5d34d190ff66ce

Download Submit
C:\Users\Admin\Desktop\TestResolve.vbe

Filesize
360KB

MD5
31c33f3af3f01427a8c02d56cb47b1bc

SHA1
3427c6e4677f8d4211c1cb089c51e011bb1ecc3c

SHA256
86df22ecff2c3fe9cec8673f640f8b945bf3e18563706297794ebb9faffa05f9

SHA512
7f984d18b3c7b8bffee6fb7bb519b0bfb49ca1bae1da9d2d57847a0c92a93f9d63ced15177d8255e04545cb9c32686fb9ae4824356a0aed18b051895a1489118

Download Submit
C:\Users\Admin\Desktop\TestUnpublish.tiff

Filesize
754KB

MD5
e9caa9ab02f00385c8f21c673baddfcd

SHA1
c11576942f001ae7b557db75595b1d4815aa8315

SHA256
dcdf515828c690d1fd93810fe5a48a926ae9540361a86517a8858891455385d9

SHA512
e51f382360352a1ebf8730e1b0faa398ccfe9615fa3de3e978953e8a075a6ee7201607a6780c4b33cf0ec57a0acc57b87d16f93e3486576f578ab8104c9fde0e

Download Submit
C:\Users\Admin\Desktop\TraceInvoke.doc

Filesize
685KB

MD5
303780e32d3c8376492391718c08eb8f

SHA1
e6605cfd356731db8080c484b1bf777687cd23f4

SHA256
e3df597d08a0736e337ec631621c3055faedb538b507f16ffb407bd748648607

SHA512
f5eab37690f73b82c69abaf0cf69824a6db89e8f497a3e6519a888dab86d2f512c1a80e3b1fda2161156db43e2d2bd3065de025ab67532a974581839b04d867a

Download Submit
C:\Users\Admin\Desktop\UnpublishInstall.odt

Filesize
429KB

MD5
a34be1c9de5b9623afed697be36009ee

SHA1
a6266acf210b7c2a7a16dbb3cc49449b21b9f74d

SHA256
f07cafa9787afba34b7d3a993a0bb2ee6ce267440bf290e27e1943705c73a0e9

SHA512
ad501549d29afe26cfab1c9a16ac41c3d7959ce713a8cf400bfb1a3e833ddc7d955d70205a85a6ee674808108406e05016d11ae3592d81f3a8165738e5f57ff0

Download Submit
C:\Users\Admin\Desktop\UnregisterCompress.xps

Filesize
336KB

MD5
90ef86a690cbba1da6aee2f4220af624

SHA1
d0e554d200d32f1a9f6bceb77acb786093991f8d

SHA256
4ab25906840ddf55a6889bf234df1d47f57126ff25438e28323cca54cdb282bf

SHA512
aaff297b2f985350fd71bd47f9ca49b2479325659b1eb35c9a542d232d2394661a2ba796bca589a7dd9f77579ae41b94c2a51c212d5365cad4e49bb770f021a4

Download Submit
C:\Users\Admin\Downloads\9fc5081ba3c1a4473ac1ffa3d653096afa16684a3e819ce6745bc22d38bb97f9.crdownload

Filesize
586KB

MD5
b835bf9188ed749da201403a51481399

SHA1
9775b4173c52da9b3618948881e197d03673e3c6

SHA256
9fc5081ba3c1a4473ac1ffa3d653096afa16684a3e819ce6745bc22d38bb97f9

SHA512
3fc72e7dee1bd19db0a20b11ee346479ef29ab3d36a79cc49092291f91e5c618754b3cc0d4bbebfce81faff3294f75fca67b69c430d73da7e14fbd80cdbd88d3

Download Submit
C:\Users\Admin\Downloads\AcidBattery1.0.7z.crdownload

Filesize
352KB

MD5
d77ce5cb20abcdd20c8e997f910c89ba

SHA1
da805c759f46118a410b53f1ffb8590507573e1c

SHA256
97ec8c13dc42c0c020acbc180a9ef3c1489cb1afd639a957cf0db5152adb47cc

SHA512
4758b2068e9b249f7c272a1c993d58889f2f23ac7631a643604656d574f6794da97d9e5e5f1457ed93f776ed29d1f052439a46cd4c52461fee89ded964b71a6e

Download Submit
C:\Users\Admin\Downloads\DoubleFantasyEquation.bin.crdownload

Filesize
216KB

MD5
2a12630ff976ba0994143ca93fecd17f

SHA1
d09b4b6d3244ac382049736ca98d7de0c6787fa2

SHA256
1e55abb94951cedc548fd8d67bd1b50476808f1d0ae72f9842181761ff92f83f

SHA512
52546e2e78e545c865a10fcbc684109dfad91a0f8a3003c5030ce42cc4873db5718fcdf01d2c250cd140e6e058333151ed42b46a2da2d6b0dad0c6a6d18e5663

Download Submit
C:\Users\Admin\Downloads\Gandcrab5.0.3.exe

Filesize
424KB

MD5
95557a29de4b70a25ce62a03472be684

SHA1
5baabf2869278e60d4c4f236b832bffddd6cf969

SHA256
49b769536224f160b6087dc866edf6445531c6136ab76b9d5079ce622b043200

SHA512
79b78cf77926e0d8b424ad9984f72d4461c7d9e7af58c4e2af32fa7c58cc445c534228b0709b87f5e35e1c8793b3d028dc60787151d852b8524023d08b57f103

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 331061.crdownload

Filesize
2.2MB

MD5
1610cddb80d1be5d711feb46610f8a77

SHA1
6b552879e3420c68d09d1df7bf18cf21039492c2

SHA256
3727dd9aad35776b4991eec1edb968844448bb9b104b1dbdc9bef7587dc948da

SHA512
9e1ffbdb4759de44981d61e37c1a92ffd64770a461f93b20c1c0cf6b76ecab7461bc70f310ab586f4e65a9c826d9f3ec4ba9b22385f507695e9a3a87ec7beb2d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 499980.crdownload

Filesize
121KB

MD5
0301296543c91492d49847ae636857a4

SHA1
147731983582c2196c304d1e6453cb2d26920756

SHA256
ce093ffa19f020a2b73719f653b5e0423df28ef1d59035d55e99154a85c5c668

SHA512
66a141b6e4df8fed9f6aaa4bdcda7d922542619de458ac5a43e904af3d5d77ef8dcc579b5fe8b7a70bb0520164d1e756adc2695360cf9c5b75e57959ac19df68

Download Submit
C:\Users\Admin\Downloads\VirusShare_15972bdf667c595e9cba11842a6d905e.zip.crdownload

Filesize
820KB

MD5
6be6fdb38287d3e28b29b612afd32fad

SHA1
d638efaa0c0df4827bc98ed098417cc83c50bde7

SHA256
47f39f223c627d8ff7d8c47af774500e4cc5d34ee2a9dfd5563b39ed5d434acc

SHA512
c3ee4c94db33d4ec22d37d3fdd5d43840eba4ec034c7fde46b08b188c93c120c9711a6fa04fea2a2d606db8fffeeeebecfb974e1d6e5ca4f6e6e0671e70ca77b

Download Submit
C:\Users\Admin\Downloads\VirusShare_e64d31ef596e86997ca0fffcfb3d1ce8.zip.crdownload

Filesize
418KB

MD5
27a51230a8989694ebcbb05f255a1c89

SHA1
c22d809f72ac50de2772fa79edbeb847c7c8dc93

SHA256
226f03af69f07fd8fd9a5a99b7098545c61da6fbe77cb8d7be64f9030ab08a8d

SHA512
a0a8d522e833291d8e17be71262fafd4d2ac02819119be3670b3f6e378d8fcccc18d5ddfbc67e7a7161238ff19e61e30b5cef41f134ce320d9f83a2a3b26cd39

Download Submit
C:\Users\Admin\Downloads\VirusShare_f15b86eaf846fc7e9a074caf0ee78b63.zip.crdownload

Filesize
180KB

MD5
c12374e2b8967a850dfef3fa80b4b7f3

SHA1
a8be21e39e80c4e88587e8cced7c92ec3529c7d9

SHA256
c17d4b304c9e66b3c609699e8634e4ebe26431eba205a14c5bed2b10218a6e90

SHA512
1b4d82ea058910a747d0992c9e1860ad1235b937bfece9d6883f9c3231bed1a755235f0ed128b9b8375254fd301875904a68a77a92395c9f8d2df7ec50a3132e

Download Submit
C:\Users\Admin\Downloads\ff5ce90c78eb4d6c2714bd659fb6fbbb9afc50d03a16d32015ff350d79f6fec4.crdownload

Filesize
115KB

MD5
04449f25e64ba893acdcba5f1694cd41

SHA1
2eb61bbe62a87385b843ef3aa9a8e3bf7bf092f3

SHA256
ff5ce90c78eb4d6c2714bd659fb6fbbb9afc50d03a16d32015ff350d79f6fec4

SHA512
69a94c64d7428df93bd673acf54ef141295aa0d89f969a4d5f86f6a27eaabb111440482a79995e873291662f7706a0475a8edf28fc28e86712ac139b1f9a5439

Download Submit
C:\Users\Admin\Downloads\msxml.exe

Filesize
366KB

MD5
1ef7d145bf7153292ea33fe7c900ece9

SHA1
8f0323e577d4df82c7faa4cd6ba7303b38b6a26e

SHA256
ece3cfdb75aaabc570bf38af6f4653f73101c1641ce78a4bb146e62d9ac0cd50

SHA512
640985ba6ff2488b77ab6eb25507b29e1f9f5b005a85afee7edbaaadfed6b990f9402019b13df08bd3845d90077f0d674cd1c48144d1ac3abcf63b4733d1432c

Download Submit
C:\Users\Admin\Downloads\sample.zip.crdownload

Filesize
98KB

MD5
6a5b8e91f0464d7e42e0632493448683

SHA1
e61b455712601eed24f0986980fb8270c3d48182

SHA256
2103a433eb868b11dd9706f0081258f704bb6ed8d6726292c7557db8a9db9d10

SHA512
fc81387cd2d94ae2947f3f36ab8c13407338171f83056ac3c821abfb853fe85c81fce8b09705e772efa7934bea542d25e2a931ac394ee170e7facb125b66e669

Download Submit
C:\Users\Admin\Downloads\video_resources.zip.crdownload

Filesize
44KB

MD5
84256341e82646ec64d0458b1665b082

SHA1
6b24beeb4faff418dae7252db771d57d35f6dae9

SHA256
946c05d1dd6f25bd818d08c252ad1c0ad0acc3624497d301f4bbf7819ae51212

SHA512
6d33f5d40cc87ac709f4064d5285fa3589111f2077c86e25881914dd590b66d6876eeff4fd9e25837db90f6a3778d7edd7fd254724c3c04c3254f33bbd70410a

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk

Filesize
2KB

MD5
91af61b044a1fbc426691afa65556d90

SHA1
a79df1843f34e7e82bdd9e74ed40ac8dcf36852c

SHA256
b858950359ecc1d7bb06fd03112a54fedc877803a09a1ad80abcaff4719288e1

SHA512
1a5d91bf1a0d584b365d1633d6309f1eae630abbf5b6f550ac2d7889058f125ea9e337b56b9f1238f69d9715f91230550a8262d4b417cb05bf4dfee32a39aa70

Download Submit
C:\Users\Public\Desktop\Firefox.lnk

Filesize
1KB

MD5
14d0fcd0bc61413fe3f17183eece20b2

SHA1
53deffadc7661f986123154b53e3275451dbf884

SHA256
673100cdc01dfcee3aa6adc2670806eba58fb89babf129f0d34a5beee5e90427

SHA512
69cf361144c9f8149c8a212387b9cc2d1e5123bbac28e72614f97c07cf85ab3bc1304460a2407655784e1289223d8b8039210f934cb12adfb502dc27476fd9dd

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
4dfe81e1c2c42f06725f3e15eb27f4f2

SHA1
0c27d79e52beb756fcb3a53d3518961b1ed12866

SHA256
f61313bcac5a38725e90cea8fa95b5706969c7cfa8a6eb45d7e9246a20cc65d1

SHA512
2ad29323f9f7d568cf9be8a316e6c2a5bde01ec80797adc9df6603bdc3c162a9f9e4995d210b34eaa11e4ee5db176d6e3d3310ba18269428b80ac334442e2aec

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
923B

MD5
3dab1836df6125a8d0d24768bc5833ac

SHA1
c23f9608c1cd5ce117e4e297e1fea967735ac7e4

SHA256
fbcf3112990b69a85ac04990410802b02b63d29e18ebdf889c51565ab5f095f7

SHA512
5e7d162043944acc41528f1806c301ced0f01874a5ede4be017f39f415bc1cfe360b288a71f2c33e5efa39260968f778b3bb04a91566d998301ac88fe8df72f4

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-83325578-304917428-1200496059-1000\KRAB-DECRYPT.txt

Filesize
8KB

MD5
ca5d14fd141c9ef05d3759e87d40d68f

SHA1
b659446485e9f1bd99db46a47af00e8580ea5a1b

SHA256
d5b95506d8596e33b6531c72e558dae5a85cfc21e2e2e369e62ac961dfd240dd

SHA512
9797d014b8f356cf411251ce6be1e8962386921cb1adf4b7b24f06b12c6571aaf23981c0f1bcda2953f3200bf4d7c2f283f91f8e4075914c9e56fd700dbff547

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-83325578-304917428-1200496059-1000\VANILKQEUN-DECRYPT.txt

Filesize
8KB

MD5
0da8180e4849c3b193193e14ef5ac571

SHA1
bbb74ba3a830f2556186f0a3ac0e7c7f96392e09

SHA256
31c851cfe38b4e9cca847d7dfe5f5b3cd02f04bc03afef3d297404675b125c33

SHA512
8a02ded2fd0dc79222f81efc500e577240e12829d06aac0f4b0e45470ad15cc281a2cb184b20f9bf243b562f81e4f55dafa97b18b25dbf7a21be72873784d527

Download Submit
memory/1432-3380-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/1432-3338-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2684-2959-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2684-880-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2684-1730-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4088-3328-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/4088-3366-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/4384-3326-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/4384-3363-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/4700-3133-0x0000024410960000-0x0000024410961000-memory.dmp

Filesize
4KB

Download
memory/4700-3134-0x0000024410960000-0x0000024410961000-memory.dmp

Filesize
4KB

Download
memory/4700-3127-0x0000024410960000-0x0000024410961000-memory.dmp

Filesize
4KB

Download
memory/4700-3125-0x0000024410960000-0x0000024410961000-memory.dmp

Filesize
4KB

Download
memory/4700-3135-0x0000024410960000-0x0000024410961000-memory.dmp

Filesize
4KB

Download
memory/4700-3136-0x0000024410960000-0x0000024410961000-memory.dmp

Filesize
4KB

Download
memory/4700-3137-0x0000024410960000-0x0000024410961000-memory.dmp

Filesize
4KB

Download
memory/4700-3132-0x0000024410960000-0x0000024410961000-memory.dmp

Filesize
4KB

Download
memory/4700-3131-0x0000024410960000-0x0000024410961000-memory.dmp

Filesize
4KB

Download
memory/4700-3126-0x0000024410960000-0x0000024410961000-memory.dmp

Filesize
4KB

Download
memory/5700-879-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download