b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

Analysis

max time kernel
91s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7z2201-x64.exe
Size

1.5MB
MD5

a6a0f7c173094f8dafef996157751ecf
SHA1

c0dcae7c4c80be25661d22400466b4ea074fc580
SHA256

b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4
SHA512

965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94
SSDEEP

24576:mGIyixBMj+/A2d+UKnvT+LwZWj7iDDVVYrz0rbzGTw3DoA/sk6smE:mGbj+/BpKnvyIxVV/XDoAfmE

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

7zFM.exe

pid process

3636 7zFM.exe
Loads dropped DLL 4 IoCs

Processes:

7zFM.exe

pid process

3148
3148
3636 7zFM.exe
3636 7zFM.exe

pid	process
3636	7zFM.exe

pid	process
3148
3148
3636	7zFM.exe
3636	7zFM.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

7z2201-x64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops desktop.ini file(s) 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

7zFM.exe

description ioc process

File opened (read-only) \??\D: 7zFM.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

description	ioc	process
File opened (read-only)	\??\D:	7zFM.exe

Drops file in Program Files directory 64 IoCs

Processes:

7z2201-x64.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2201-x64.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2201-x64.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2201-x64.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2201-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 21 IoCs

Processes:

7z2201-x64.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-144354903-2550862337-1367551827-1000\{79F92A24-7930-4107-85C8-616336D5C179}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

3636 7zFM.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 3636 7zFM.exe
Token: 35 3636 7zFM.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

7zFM.exe

pid process

3636 7zFM.exe
3636 7zFM.exe
3636 7zFM.exe
3636 7zFM.exe
3636 7zFM.exe

pid	process
3636	7zFM.exe

description	pid	process
Token: SeRestorePrivilege	3636	7zFM.exe
Token: 35	3636	7zFM.exe

pid	process
3636	7zFM.exe
3636	7zFM.exe
3636	7zFM.exe
3636	7zFM.exe
3636	7zFM.exe

C:\Users\Admin\AppData\Local\Temp\7z2201-x64.exe
"C:\Users\Admin\AppData\Local\Temp\7z2201-x64.exe"
1⤵
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
PID:4948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:216

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
92KB

MD5
c3af132ea025d289ab4841fc00bb74af

SHA1
0a9973d5234cc55b8b97bbb82c722b910c71cbaf

SHA256
56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

SHA512
707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

Download Submit
C:\Program Files\7-Zip\7-zip.dll

Filesize
92KB

MD5
c3af132ea025d289ab4841fc00bb74af

SHA1
0a9973d5234cc55b8b97bbb82c722b910c71cbaf

SHA256
56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

SHA512
707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

Download Submit
C:\Program Files\7-Zip\7-zip.dll

Filesize
92KB

MD5
c3af132ea025d289ab4841fc00bb74af

SHA1
0a9973d5234cc55b8b97bbb82c722b910c71cbaf

SHA256
56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

SHA512
707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

Download Submit
C:\Program Files\7-Zip\7-zip.dll

Filesize
92KB

MD5
c3af132ea025d289ab4841fc00bb74af

SHA1
0a9973d5234cc55b8b97bbb82c722b910c71cbaf

SHA256
56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

SHA512
707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.7MB

MD5
bbf51226a8670475f283a2d57460d46c

SHA1
6388883ced0ce14ede20c7798338673ff8d6204a

SHA256
73578f14d50f747efa82527a503f1ad542f9db170e2901eddb54d6bce93fc00e

SHA512
f68eb9c4ba0d923082107cff2f0e7f78e80be243b9d92cfab7298f59461fcca2c5c944d4577f161f11a2011c0958a3c32896eba4f0e89cd9f8aed97ab5bc74f9

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.7MB

MD5
bbf51226a8670475f283a2d57460d46c

SHA1
6388883ced0ce14ede20c7798338673ff8d6204a

SHA256
73578f14d50f747efa82527a503f1ad542f9db170e2901eddb54d6bce93fc00e

SHA512
f68eb9c4ba0d923082107cff2f0e7f78e80be243b9d92cfab7298f59461fcca2c5c944d4577f161f11a2011c0958a3c32896eba4f0e89cd9f8aed97ab5bc74f9

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
935KB

MD5
d36deceeb4c9645aab2ded86608d090b

SHA1
912f4658c4b046fbadd084912f9126cb1ae3737b

SHA256
018d74ff917692124dee0a8a7e6302aecd219d79b049ad95f2f4eedea41b4a45

SHA512
9752a9e57dd2e6cd454ba6c2d041d884369734c2b62c53d3ec4854731c398cd6e25ac75f7a55cda9d4b4c2efb074cb2e6efcbf3080cd8cc7d9bc8c9a25f62ff2

Download Submit
C:\Users\Admin\Documents\ApproveBackup.mhtml

Filesize
1.1MB

MD5
d107745483646cfdffbfb364f0e77941

SHA1
b579abb9968fd1e9ac1659ac5d46021e3fe03caf

SHA256
382d31fdbfcfaf5216f02af89dee0f6c36a9ace9346d3743b11b70d43cc6cd64

SHA512
74fb19291ed1ab4d740c27bdbf44778a4d2da652973a58b5323e23767d6849a3f59c8d6cbd07cd98605ecc5551f5d95172337bb216b8277dfb3dd842771fdfa2

Download Submit
C:\Users\Admin\Documents\ApproveStart.rtf

Filesize
644KB

MD5
f8ea2d68c81167c962f11ff4ecc58a5f

SHA1
2c85b1a9a8f3a6dd9bfc259c991019abac389980

SHA256
903ab725f6c864f31ab034dd86954a9cf881c01db6d822ca714b5cf293fabb92

SHA512
e01eff167c9d9ec6f87e03a02f9b0355590d39d08516c16700e2dbeefe2905c48b26ba9e4b619ba5b8730a3d8edc970408a362a8fdcd65e1eb0b783e714f8951

Download Submit
C:\Users\Admin\Documents\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\Users\Admin\Documents\AssertCopy.doc

Filesize
917KB

MD5
ca80105d6032e858bbf2f4f2e6523132

SHA1
d19bfba813da7398bf2c7f4debd5b71b90d3cc3c

SHA256
45a756ac609ff0371616218c1c32e8a7054c24c2c466d28f554f118bf874be09

SHA512
be4564a0e60203c91d0bc80ab64177bfd308520635dd2f2a148151106c9219b61c4510fad711c202e6bde3fea40f099786f4ebc90d718a23fef70f2c3ab8b627

Download Submit
C:\Users\Admin\Documents\BackupStep.doc

Filesize
843KB

MD5
c9125607620d8c4885ad77008ff13dd4

SHA1
bf18a34170a26ea46bbaefa486338bd71c46f066

SHA256
b35afd6402d175e8eca1fd6d5e1bf6f9558834d8db83379a7f3176002332539a

SHA512
2afc6c08d06607133921c45db822e73bb19a88c72071ca75aff6f71abfd8e4a02629ce4066ef090272c12b6fb410dfa207b91816ad00aaff8a16c599485e12b6

Download Submit
C:\Users\Admin\Documents\CloseUse.rtf

Filesize
496KB

MD5
6a0b502ac113b1b5b9a36d6a31fb2a08

SHA1
f8a83859ee3d3b2426ac13de7fc5ace01ca34da9

SHA256
9f03a2b868be6e3baa5e461701d21c1691c310a6d6fb8a869f1cd172b29c5fe4

SHA512
21eac1362cda2759ee5ba85b8c25d714022e8eba0e9e11599c47a7d8d67d4e291db0a5fd23fba28655ec2b4048c6085f93fe89d9cd750b8ab97ee61f1f56f23e

Download Submit
C:\Users\Admin\Documents\CompareCheckpoint.pdf

Filesize
669KB

MD5
0087b433138805b137e890f26bfc4263

SHA1
0c9f962a4b14fd6c27ec4882c5055a857c97891a

SHA256
96967465d1dc1125c8569ce29cc9501c720ea69302b098ed56532ea51053d6fc

SHA512
41b59e37c500a3262acb0fda00fb41ea54076412fab883b94bec7646cca17f3c1b9677374cf06f42271fecde16e0d344abb1b215a02b8e20b73aa5d766ef26f0

Download Submit
C:\Users\Admin\Documents\CompareShow.xlsb

Filesize
1.6MB

MD5
6548e95368f41b827dd7ddf0e390bf92

SHA1
06e338a8ccc72c4b6a072d7dad32e8f33511af54

SHA256
c5b8ef67c4159b0680498a10c2c6cbf7daf841ddf863cc68aacac09e862d66dd

SHA512
1f5bbf2c640e3f65b64a353d8d1976fb4a8c2306ac9ce41e4c790310d9836da39a2af72cc33b2c7d5ace2978b51bc4260f4a4ae621fd8b315882dec737024fff

Download Submit
C:\Users\Admin\Documents\CompareSuspend.doc

Filesize
1.2MB

MD5
0d2841d9e3376627df2892bd16ed5210

SHA1
5195c22eaf2a03ea0fab4aeb11121bc882c833bb

SHA256
1d0b01a8202c366604ddd717151f6160d0e852dac1aa788663c2251050f57b85

SHA512
64d5f7e955cbaabe7502ea859609368b02eff22604c8a8b105f4cfbef1c6d94856e3d0bef08de5023c2a37110273c6216fcffd999319b4fb96b904c906700dc4

Download Submit
C:\Users\Admin\Documents\ConfirmGroup.rtf

Filesize
1.1MB

MD5
56703b3a224dd0af64dce863c18ef6bc

SHA1
e626e903ea5047d605b67bc4156c01bf53eed217

SHA256
421eb1a026844bc254f441cade20e2d09338003065fb610f7cdbfcd8331f9304

SHA512
b5e654a19dc2d492a8d5a8bc0f11c53cfe9b373b06795fb159990d23a7498db36695172bd506abd44e7a7e3eb9568a567655c6a04a9195cfe73299f4ebde92ef

Download Submit
C:\Users\Admin\Documents\ConvertFromSelect.xlt

Filesize
892KB

MD5
1dc4a87bbf69a53e6f3a3eedd775463c

SHA1
8646aadaff3f876293893d7cae7611f6ac39a2ce

SHA256
0d644fe294d52c516646931e37866b4c226bcfea5a80b15fcb3b35a843385421

SHA512
ee3c31dce1db99ba0c4db0fa0784e55bdca346cb34e81f3882d309ec0bc59e84b6cf4ec3cb6d2675b2ea10708e99e8043a0bba5df3845ae587b5e9ad7294363e

Download Submit
C:\Users\Admin\Documents\ConvertFromWrite.csv

Filesize
545KB

MD5
1f4bea87916828a416d64ab182c85a7b

SHA1
e7f8c74ced5e79eb27934f2719c9bf98e7308f2c

SHA256
3e9a8c609b62c7dcf7e8afa8ee9fc8331134dd6a514978d09fd36ea5b9dea600

SHA512
4e86420e8d900c0f49132f525530d5b7bd2a982a15ad58990b44729d3ab9964e5788083a6da7b998538b2b266e197bd6b848cf13250215c5b2a2209a7d263179

Download Submit
C:\Users\Admin\Documents\DenyInvoke.ppsx

Filesize
620KB

MD5
f725a60be70c51166d3d32e0afb12df6

SHA1
101223f8b6de988b6240b0e5a2411bceaabc8613

SHA256
ecea439a659ef220f914cc139c8a921f48f52eb9383cec65714444da52450367

SHA512
f9bb1bbd646da6f32a6110714d2b8e3ec1c9d54d6be47c89ec98acefbc097da6fd1a159524932eab75e86359ae1a6c77b636a6b2f639bc5781992dc4aa768fe5

Download Submit
C:\Users\Admin\Documents\ExitRemove.xltx

Filesize
446KB

MD5
7468d1808e86aca47ba0cb01022b9b6a

SHA1
59bb5cacf99feb64c834340e11580b3f57488d87

SHA256
f4996f06688b065c2afc9a27f8247d6544c2a741bdea1eece4f535c7db666aec

SHA512
3f08c9628803ec32e2dcb56ea307669c98051878824efbd326f756966b8f7d663091131de48d5d3151052b9086aab55f09b31a2d96d38e4fc4553944f17c876a

Download Submit
C:\Users\Admin\Documents\ExportMerge.pub

Filesize
1.2MB

MD5
b4dc4d1599e4f06b5daa43a857a1bc6b

SHA1
47a192a539e00d6709d8bc6c6314e970eeb27bf4

SHA256
1ea57031dba1204efc8d7b1d333b4c48100856a9bf2bae3f0fddcbd367f8ccae

SHA512
166bab5aa704f3ff15c2e420a485e960cc3ef62fbf2086d65aeac2bb9723dc41739efbbf3af92799e861a0e03bf7165aa819e458c1c0a998c2db83d23f9e5721

Download Submit
C:\Users\Admin\Documents\Files.docx

Filesize
11KB

MD5
4a8fbd593a733fc669169d614021185b

SHA1
166e66575715d4c52bcb471c09bdbc5a9bb2f615

SHA256
714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

SHA512
6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

Download Submit
C:\Users\Admin\Documents\FormatMount.odt

Filesize
793KB

MD5
a67a91b9a566972d0fcaf6c3b33e265d

SHA1
b3b43ee319c56b1a5b55b76430f1dc07ec0ee5d0

SHA256
f18c9fcbb9a71d2772b99adc9be1310068cc9e5ae67d5a39cf75911ed6f67f30

SHA512
973b1173d6a546f3198e793b24ee89df94dc24270b1845a0fa7d0cfa704b677c9423c2ebc9c60b777a56b251d18fe91061d38f8512f345aab9422650e5314bec

Download Submit
C:\Users\Admin\Documents\GetPing.potm

Filesize
1.1MB

MD5
11c6b538974d83968015e920c014e319

SHA1
77eea745fe7e7ebff8086fc79feec348ad09153a

SHA256
47a20fed21cd1d3c4535daeedfa8c21f37e0043315607eec2d6dd652ea5c7cd4

SHA512
b2036f3392f41cb4812fcad8d4abb65822510e30259bd77a6f43500566b6490e8806b01c6889e2eaebcfe8352a9ac500fbe20445d1ef77a7fdb83642d5525b7f

Download Submit
C:\Users\Admin\Documents\GrantLimit.rtf

Filesize
744KB

MD5
b4d70e19f2a1e07c5f3c9332ea575ba9

SHA1
7100144467d3c4aa5daf2b0fb5bac49cb0184ea0

SHA256
708d1c0fa466bef1a67be204706c427ef97caef246388ca7d5744e322d7d7201

SHA512
283ddebd9ff61c2a29247f876f06e20b36d293438632d32c84afb5ff67175f8cab230127cbcb631391cb63e7b32fd2325fdc7577263e6edee82e397e77d9a1ab

Download Submit
C:\Users\Admin\Documents\InitializeUnregister.ppt

Filesize
942KB

MD5
c411227beb1066eb8424086bb67c0bbb

SHA1
5b0b9b5800966239205ba1a5c5e819f65ce92512

SHA256
82a8c9985c9158ce860e464ca0e6a6a3a286649c80a03234c5cba2dada537c91

SHA512
2aa240b44f51b39b9ade2b2c8180fac1582aaf7712f30b88f22d2cc9f889d12e319b4b67599600f73c2652e628e5b2798440e3dfe3e524d5e6ab9e058e125b1b

Download Submit
C:\Users\Admin\Documents\MeasureDeny.vsd

Filesize
719KB

MD5
197f7f7edff827e0fefe791e71fbbb2d

SHA1
49f5be3fc8569c83674865491bc712b364dc8fb0

SHA256
6c0383320b46536bf39328ca2004d251cb92954cfcb94a5072b0c033d3e1f7b4

SHA512
cfe5c2fb355e4c2d5b51675987e5aeaa97083a76d525c9079dd91a4b1c08ac3ea2a00e257138af8e0ea0c7c065fcc52259ca34bce4ab7272304ba8a77fc2f956

Download Submit
C:\Users\Admin\Documents\MoveStop.xml

Filesize
1.1MB

MD5
ea4a42c9c0f2412d2aa9161b35d08eb5

SHA1
4a782b56eb165a70b845bcfcbdfbc1b78c08dd6d

SHA256
5e33cecfc01d20aca5033bdc97ded036f04a48696634024efc28760c683e6efa

SHA512
9d61e1565dfebbfa483828ff442e0e2ce95abbee9b5eee0a5029f6dcf6a0976206ef8433998c58713a95e56c1f537e4ca689e9af0d705cee3a8720c13b305432

Download Submit
C:\Users\Admin\Documents\My Music

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\Documents\My Pictures

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\Documents\My Videos

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\Documents\Opened.docx

Filesize
11KB

MD5
bfbc1a403197ac8cfc95638c2da2cf0e

SHA1
634658f4dd9747e87fa540f5ba47e218acfc8af2

SHA256
272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

SHA512
b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

Download Submit
C:\Users\Admin\Documents\ProtectExport.ods

Filesize
818KB

MD5
fa2186138fda1d57d75214b0e8b99f37

SHA1
126a42504e423f0e9aa156081326f23ff6924efb

SHA256
ea9ceb76d349c4927ba0ebd7e6971c95499a04f2da215f26e21f4e76f3106cd4

SHA512
c3938cca2f69b80ef383cd9f854970568c4e9d115fb0755d6c2e7b42f27ae5776b2defe69db2fb19f524511dad0bfa61ad2b53b995a1ad1fb68f1ed5c1d51a29

Download Submit
C:\Users\Admin\Documents\ReadResolve.ppt

Filesize
1016KB

MD5
93a21ea95d5156e7153bf45133493f7b

SHA1
933cdff1476b9104d62f89cf0622fbc605c38268

SHA256
17a3316731b36ea045b883d2641727f548d8511ee3e008191e28dad873e0ef2e

SHA512
b4e6865fea7d74ff2336fa9e28973bbb6a4588acd328880946a681e7e80e652929730e5e43bcfe30c5a1b91e6b3f5ae58163a7caabc487fdd02c0d5cfa418e29

Download Submit
C:\Users\Admin\Documents\Recently.docx

Filesize
11KB

MD5
3b068f508d40eb8258ff0b0592ca1f9c

SHA1
59ac025c3256e9c6c86165082974fe791ff9833a

SHA256
07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

SHA512
e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

Download Submit
C:\Users\Admin\Documents\ResetRename.xlsm

Filesize
1.0MB

MD5
d8c4561fc8911f581417274fe56d48b4

SHA1
27a2d176ee391016128357aaa8094730bbf27842

SHA256
b474e0ee32030273cc65bcdbb3dc92f89de514fdec798ec4967e78d9e8cf4de5

SHA512
ef9a90fab29ef9d755c8c3a5414c013e7f773590e46ff1b82ffd58f3b968187f8b3d189bec73f6d3a78e0eb7a827acf74ff71055f9b0704f865443e15da43084

Download Submit
C:\Users\Admin\Documents\ResetStep.pub

Filesize
694KB

MD5
2350202a6c40c44e6ce1567c2a2cb6f1

SHA1
70d864fbef50b8750fff9d3f323a625e6f15c958

SHA256
b8f3be9475f9a9bace6bc26d499383ce9f96fc548d9fcd8e64828f2fd84e41b5

SHA512
d13210f19c8ecba37546a13963bd1719fbf3d42088e88462d479b261168ac200a0418c5c9d6ec072fa7af7988ffdb573e89ffb45dfa268ea5bfc457f0c45c02e

Download Submit
C:\Users\Admin\Documents\ResumeSync.vsx

Filesize
595KB

MD5
87a45f62a459b4e4f98b85e20f274905

SHA1
eaf26ff1ab2fe315ce3d45d1b3eaceb07eec9901

SHA256
532163b5eb559f726f2f4fd5d4bca8fa312eb9d1a591fb2b572c12f062b22ec6

SHA512
f5c00177cdfda7f158461e15b9af07913b2904780bba7b70c3105376fd38aae7c0b35dcf7d9cd9d8df8b6d74efa1fa1a2a782a73c2d9d6f9e9c121cc4e699842

Download Submit
C:\Users\Admin\Documents\SelectPing.vssm

Filesize
421KB

MD5
457cd1e54d7d22ae91148823177fb7e1

SHA1
d143c471755808034e6d76bf83ca20c8449ce560

SHA256
ec69d102e18905df6d387abd07882e1dbe3f1e1f990c8d9ad6762aad36347741

SHA512
9a60881f7a81dcade172d6701e3f82c6fef10b0e6017f4afd6eb3b35a79392a1e80144d21819c578d70dec14cbe7fb08f1979c83f68eb3f53e999ba2e438efd5

Download Submit
C:\Users\Admin\Documents\SendInvoke.docx

Filesize
520KB

MD5
e9a6c935be57932ba6d95da6f67d0c37

SHA1
032ac015e18adc760a8dc01d49a067ce13ae9015

SHA256
fe7d645e88710b4c7c15075ded61bd0b02d62b8f0977e8f1c3b2041f7ab5c8ec

SHA512
97fa7f0293b6b8a570eceb3d6fc405b7ccbe593cbd7dff395066520d7bf342a297e436ea710528729bec6c1e3881f0bffd24fe78a7fbe0d313d446bca4c40aec

Download Submit
C:\Users\Admin\Documents\SkipUndo.vsd

Filesize
1.0MB

MD5
b743a897985a09dc8fe83fff1efc5402

SHA1
5268d1a192741ffeace3e58eecba7178d1f73838

SHA256
9d2123adc7931b98a145e786a16e1ba0c5431458045dbd5b6203845c9154afee

SHA512
989b445be5196595a7fa317216c6eb56c8968064d11d86aa70a4812f400f8ed3b3eec6cdfda71a2a2598be2cbff001f6cd0896b03cfb37862a8b4ccaf362079e

Download Submit
C:\Users\Admin\Documents\StartInitialize.odp

Filesize
471KB

MD5
f4f59d31d7b3995f9c17ed5c0cd62d4c

SHA1
81429567f388daf3601fbdcb2f9d049ba40b6439

SHA256
6dadedd4dc4286ff765e8990698741aeb289bfa17f3d96d73914add987ecf564

SHA512
d21593c7a7f00f497ce26d7daa125a48e2e816465c45596f01ae16a04cb56750a97b4347261ab78acafa414948559c6f1096d8e160388490a3cf891cbc8cc339

Download Submit
C:\Users\Admin\Documents\These.docx

Filesize
11KB

MD5
87cbab2a743fb7e0625cc332c9aac537

SHA1
50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

SHA256
57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

SHA512
6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

Download Submit
C:\Users\Admin\Documents\UndoRestore.xlsb

Filesize
570KB

MD5
4898d87e23a968c42eb7f178d0d34b6d

SHA1
3285b1427daee97de6b50b4eed6444aed267d426

SHA256
87b8c4d896c557f9f973808a2a1849dbe0131f445eace4a6966fdf83d7cf7267

SHA512
859fa75e32d1daba938d808d9731b7994f22efd2d05b45b97c88bf8d767ee86bcb55b213e09cf5de5130445f3d7fd2e2db2c60d2f9dfa05317fa95cd8e7baea4

Download Submit
C:\Users\Admin\Documents\UndoSave.ppsm

Filesize
768KB

MD5
7d5e39865dd70c2336ec64db311537fe

SHA1
f0d96c5d94817716fde8e6eac076b073374b8c43

SHA256
fb61b49230531ef88a353cf69ec719ade54dc6b240585fd43a253766c570535b

SHA512
9ca4d99950c584d354931232ae34bc399117274960b3ec8073df6a6ddd474e327ced4e72df7ae3e46e71fec1d828e8d6b474da75c28d58c7065a7b79c8bab5c3

Download Submit
C:\Users\Admin\Documents\UnprotectConfirm.ods

Filesize
967KB

MD5
8fffa3ea1743e186cc739e4b729cf04e

SHA1
17b976ed6d2d26456c61f30b61a63dfd76cabe75

SHA256
4f72c9997da8da04f31d546f4368c71e6783a1f60b81c258dd27f83623f828cb

SHA512
bbf761e0c0f48938ed63a5cb2425af386fdd8a0ea0796570e97aa201f5af347c3ca63e4cfff7d378bd0f3c34dfa65a8f079b8431d48a604fb2378d355e5472e0

Download Submit
C:\Users\Admin\Documents\UnpublishPop.vssx

Filesize
868KB

MD5
888e1cf1987cdaf7c730bb2bb8150bbc

SHA1
41ee96b6f20ea2c52b0d41bbcaf423cccfead844

SHA256
6edf81358ae52d2c261d08eb84eb6a0e1ad94cf8990714d96932414d1daa65a3

SHA512
2922f85e9db270ac06de5b44f96366a1db815af168d7f12c3bc8d1650b8db155d0805ccbf1bc37d32c064405b04d7c4e00a2f5d1704d0f158579ad3740c5a74b

Download Submit
C:\Users\Admin\Documents\WaitTest.htm

Filesize
992KB

MD5
e09cff41bdb55600a018498af834c5f2

SHA1
400bfa202637f6047a18b0b48eb21b4820906754

SHA256
a82223006f01e1a0bab29b61a736614e1a521c8160e910ffd4d18b82adcf10f7

SHA512
0aadc085c908154dbc430ce13398cc52787c8dd71c782ae695114581fc55026bb08b298b4a2ee395eaf63cd0036284be142871a3d80ce0b0cd1eb8b230d51a29

Download Submit
C:\Users\Admin\Documents\desktop.ini

Filesize
402B

MD5
ecf88f261853fe08d58e2e903220da14

SHA1
f72807a9e081906654ae196605e681d5938a2e6c

SHA256
cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844

SHA512
82c1c3dd163fbf7111c7ef5043b009dafc320c0c5e088dec16c835352c5ffb7d03c5829f65a9ff1dc357bae97e8d2f9c3fc1e531fe193e84811fb8c62888a36b

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/216-369-0x000001EF9D7D0000-0x000001EF9DEF9000-memory.dmp

Filesize
7.2MB

Download
memory/216-370-0x000001EF9D7D0000-0x000001EF9DEF9000-memory.dmp

Filesize
7.2MB

Download