Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    266s
  • max time network
    207s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/05/2024, 20:43

General

  • Target

    modest-menu_v1.0.0_unknowncheats.me__unknowncheats.me_.zip

  • Size

    16.8MB

  • MD5

    13b33baf9597ae6ddc68fa9634af16f1

  • SHA1

    57f3a723634ec00b4f09d066bc0607084cc4b6e5

  • SHA256

    75a3295f8c688359fcb7555b80e3f71ee42c5ac1d4525a39b2571107acf06a45

  • SHA512

    ed38d6150cbeae60451b74ae50af1bbbaf035924fdd266cf8a8fc8b84fe403dcb689185d1a9b5db048f1c11106a1a655d14d4833c7593512c5661d4c587a2e1c

  • SSDEEP

    393216:L4fEsf5x2pN6HtduMm1hfs9mosX3jtV6sEgmOnCcgXPzhEgM1lpOmi:LaEsX2ONdF3sn39ESnh6hQXW

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 16 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\modest-menu_v1.0.0_unknowncheats.me__unknowncheats.me_.zip
    1⤵
      PID:2068
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:5112
      • C:\Users\Admin\Videos\modest-menu_v1.0.0_unknowncheats.me__unknowncheats.me_\modest-menu.exe
        "C:\Users\Admin\Videos\modest-menu_v1.0.0_unknowncheats.me__unknowncheats.me_\modest-menu.exe"
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:4180
      • C:\Users\Admin\Videos\modest-menu_v1.0.0_unknowncheats.me__unknowncheats.me_\modest-menu.exe
        "C:\Users\Admin\Videos\modest-menu_v1.0.0_unknowncheats.me__unknowncheats.me_\modest-menu.exe"
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:2216
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3508

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\Desktop\ApproveResume.dot

        Filesize

        333KB

        MD5

        c05164eb02cc30b5b4ae8037fae5bb10

        SHA1

        647a3138b5067de48cfd4fbc52426e809feaaacd

        SHA256

        8db36474a6dce12b7dc993fb2d5e53f4d70adc91c8073696365e941c4c534a65

        SHA512

        2994a06bf281a6c45381e6251571798ad5af5b06699b42d3ce29b6dd2ee34b65ca2af23be4682ddf89194b6eaa766d66fe8279178e6662ff1da741b387c472ad

      • C:\Users\Admin\Desktop\BlockConvert.vdx

        Filesize

        216KB

        MD5

        4f490c7e40b28fb90108992acb810a40

        SHA1

        713a4652797d4992c2967b2bde3dfa6d5456bc42

        SHA256

        4d133edf985eb3a465d6a9d2e4ccdb28280a3467ce20948d75bf4e413a441cef

        SHA512

        501c24066a1e7a06eba0dc62a4993413025ce0732f9840e5b2dc991d94916cb2b6f91f2edb459f3f984785d419b9a90817ced01cc4cc8757bd84eb0e9269fbb2

      • C:\Users\Admin\Desktop\BlockEnter.TS

        Filesize

        466KB

        MD5

        7355244e0c444be353ae667f22dde1ce

        SHA1

        e730d53dd4e88acc80cf8f725e134fe06e69bb50

        SHA256

        615a92b86738a8efff56fc73e465bcd51a4a3fe499494264c41661ab3dfeb701

        SHA512

        a687871645bf0383dfbe6fc299170c736feda33ca7dc27a074fb76b64be8d93d8fd9236327bea4ed143de21d41cc21e20819ff3ad84dc131c6c85a91e9ef257e

      • C:\Users\Admin\Desktop\BlockRestore.bat

        Filesize

        583KB

        MD5

        48916b8a8b8006197963d14f769ce585

        SHA1

        9170e0fb6efd8c18eda880dfc677ebe07b0e5c9c

        SHA256

        26e32718296e89ffd3586d6cbf5070a38fde57eb9dd93057797a38ba47ddc3f1

        SHA512

        540934e8004c7053cff1af8e591c5cddc792a53466d4398f5c4c795a92b9fbf41e6df32bc8d02a87d09a3858712ab7587d06634c372fd9bcf95df522014b2946

      • C:\Users\Admin\Desktop\CloseMeasure.wmx

        Filesize

        266KB

        MD5

        ba909dc7800e20fd16e8c6476b126fac

        SHA1

        b017eba6867fca1b14a0c95b5fa7460f80261b06

        SHA256

        ba4c49d4ac974ff1e6c6fb41e32d01e448c0970801e6d9ecfcfe123a5a0c902e

        SHA512

        d5826b2690501079897314b5a8c933f438a1dce7560b089999bc8111b8dac07b40be160e4fb5586e3a936da2423295508508162a78f7ee855ebe427c3970a135

      • C:\Users\Admin\Desktop\CloseProtect.ods

        Filesize

        349KB

        MD5

        c190b27b460ff4a2fcb336c2d86a0a8c

        SHA1

        c3a56c339eb9ad6151de4876d6df9d6b8a24e7e2

        SHA256

        f2b844d6b8f2202b73323c4cc98637f51dabbc8c7c9329dc1e004a86258d44c8

        SHA512

        5a6361220b069b4f6b7634bbff2201dd1a83d7cba61dd8da25ffa437848e042f314d7370b8bda8a8b2fc114a7f26f514719a9409488bb67176eb9ff70a5f7c73

      • C:\Users\Admin\Desktop\ConfirmFormat.emz

        Filesize

        316KB

        MD5

        8ded5fe14be81f5289b5e77cbc5eb028

        SHA1

        53784d517a5e34a4e42e1dcc08660034f6d4fd78

        SHA256

        93b0a46336080db10d9591c2036045f89070cb5a8d4daa8cbec5e1232e728e75

        SHA512

        b2949823b364c7c89577c239f0935a831176e69783385f9024741c500ae00b323c0569250578af2b0970c1a1a6fc98c05c1430de0fef7cdb7a9e05f84c686880

      • C:\Users\Admin\Desktop\EditFind.vstx

        Filesize

        449KB

        MD5

        2c40bf2c82c33beadaa2054ef0ffa802

        SHA1

        58c5b1b3b30d3897cea3551ccae7e25970f66428

        SHA256

        05e9b9d790311a93b38800f5bfa496427995d3be0f3695f0fe6471121419c619

        SHA512

        e83e92a4e632ab2de26cc1646e7bdc603172de09e0d19d13c805d12ac1e4d6ce4c3fe310e445e447c0161df68ffbdce5f8e36d45b8d884d75dc1ad48519b0369

      • C:\Users\Admin\Desktop\EnterImport.MOD

        Filesize

        516KB

        MD5

        2c8042cf33556b3432a7e76098bbab66

        SHA1

        d6b52b0301386cee1d40c9878ba5d33bf69f1ea8

        SHA256

        0c6e0f4d494a3e26ee8b4b53ab1a2ce182c11c80970771aa733bed9651fbfd36

        SHA512

        6894cde5ea90ff7c40464eb185fe9747786bd7c561e7cee955d92ded565dbd490b271ec8970ea88bb3e79439e1801941c6eeaf022b2637f30d5a30d244ceb52c

      • C:\Users\Admin\Desktop\ExitUse.mpeg

        Filesize

        599KB

        MD5

        2588a4a1ae545d6a6bb58358fd37a6b3

        SHA1

        7dadc4af9d2aac52bfb4e755baefff1959951df2

        SHA256

        f4b010f71545605b63b4524841048d1bbbea687009146c4ef75cb6f3aacd88ba

        SHA512

        e640e52c370a75f6f5f8ff4c65cf890d1f39ee9717afdc85833c67d590f4bd6baeffcdaa72f11900c4913a5d40ae74f5790e2fa0df2d4e590870e7fe867d7b5f

      • C:\Users\Admin\Desktop\FindUse.xps

        Filesize

        616KB

        MD5

        72a5ae162fbb45fbbe8cf7159de6d958

        SHA1

        d9255594538d610d18481e82c930f284cf972ede

        SHA256

        deba70fb0d454eb1582a15446beb21700a48586f1856533272ac08a3cb67fa01

        SHA512

        de7269381fab151f6d10d2dd39330efcc5b11003f83f7956fb7fc10dce5799e26e2637480f07adf47cd766b4b88e885ed450d0fc01be91533c1a6c1f2fcc055e

      • C:\Users\Admin\Desktop\GetCompare.sys

        Filesize

        283KB

        MD5

        76e36ed15495c496883e12ffe0514296

        SHA1

        f79ae26d080c03d1789c2131ec9b16fd33cb8dc7

        SHA256

        3f559244a28b84c2844e40e8b1577c23236bb2b9211aa86b76ea0e5f345c248f

        SHA512

        c94af132dc20cf27e033418e4c95c6a0c0d48b832b0d3614a0ca103f38079413b5be7e46154cea88a840b0af31ad86922ab9da9e884f8c93d2cc8e9b951a9e6c

      • C:\Users\Admin\Desktop\MeasureTrace.vstm

        Filesize

        299KB

        MD5

        1b935145bed4e7f93a6fb4dd4c3a4576

        SHA1

        e880eef13da9d9bbf43d04b03e672e5af20899a3

        SHA256

        9db5d54c9a1c90250576b0904a3d61f0fd9365487a920a483e9d3f708ac36cc9

        SHA512

        bc4eb01e9c3ed08fdeb328b13ad0fd655a1327394dd8a2b5a8678240c301673993b2cfb5dc09e08f1391b32af7b347fd84d038a27107aa077498d15f1542a656

      • C:\Users\Admin\Desktop\Microsoft Edge.lnk

        Filesize

        2KB

        MD5

        ccc9ef4179c717b0d381064f07ae8b43

        SHA1

        071c743bc00d36b035b6ff4f4112617e179faa4e

        SHA256

        7badd0e5b98770cb1a7c1426c199fb356e177c9eb0dcce63bd153245ab2c6717

        SHA512

        00df112330fc52c70105513ae5119cfc99b4e45088532423b029352956189798ec4af35a40c7c82c7d14a47c10d830914412bab3687bc1323adccf0cd30cb97e

      • C:\Users\Admin\Desktop\OptimizeRegister.xht

        Filesize

        849KB

        MD5

        b4dace1fbfe2ee7d9508df415274c66c

        SHA1

        39e163933003b3f98ab0b53143fcb3a7d21fa188

        SHA256

        4a8bb927697446dd474d52200ab95177049e52676522a5854dfc240e67612bf3

        SHA512

        849273536a01d53bd9c2e2f5fa0c925037d115a5ca605b107c7646e3682bc2a2ed9ba1e4fd5e2510ac5ab7b350c9e561c602e1d527bdb9473fedd6dcdd14e611

      • C:\Users\Admin\Desktop\PopUpdate.tif

        Filesize

        549KB

        MD5

        9407dd132a34986f5cc9f67376138807

        SHA1

        2cbd59a76aaa9edc9348e5885743cb4e07113409

        SHA256

        2d9fe10d7ecc6d4857bac2f7d6e7664fab8ae14bed7e0b88c7648b6e5636ead5

        SHA512

        db08f60ccb571c339b988d56dad5e08b098091de8396ba1d4e6b3fb6e5dd65ee99f598bf1e6cef270813e44e9adc65a348b76a2dbcef70a7c489a1a9cdecc691

      • C:\Users\Admin\Desktop\RenameConfirm.vbe

        Filesize

        499KB

        MD5

        abf6091160a02ddff781a3547225e22e

        SHA1

        0820e6dfbbe0d2aced18c09b67ad6f8760e341d5

        SHA256

        8a8273e7d64f509eb7eab806f0cdd3b12876ac9f143d49fa534804f3b4182320

        SHA512

        0f38947eb361e6244cf6f52904268aa5d5529342d2c4f8c0855c9b1e6bbef3efd6bb4307a45e8dacc8a901fefaacee481b3172b73d8d6a4e8261187ecd822e45

      • C:\Users\Admin\Desktop\RepairResolve.vbe

        Filesize

        399KB

        MD5

        9a60f4fe21a65554807d9f2ff2226478

        SHA1

        3ef9a43f60b80ec9adf990af50d10ee7e019c63c

        SHA256

        e396ef4dbb38a83dc28b59cdbdbd507c97212c413d7f8ed914e1ccd201d41d98

        SHA512

        954eeaa76eaaf676f545acff75d848c8724c3116b95cf3fb643595bee87ca24d765c0b1d6827915e672608b5f8b8177f61108f61be1bbcda614d487131e72dfd

      • C:\Users\Admin\Desktop\RequestRestore.mp2

        Filesize

        233KB

        MD5

        36572dcd2189dd54e444ff0ebadcad46

        SHA1

        4f44147a4e166df5cf268632dd90c76b430e4534

        SHA256

        b6f1a175936e441f047b155aa06ad9375b3b2cfa9b678bb69f338a89232f4867

        SHA512

        301ff5ebd28b2edbaeec5c540d858e871cf6f4b4ea3513c92041c04e89546c5e5ba262153afaabec4fc6121ea02da00b11d323eabc30ccf81bcdaa96217d8297

      • C:\Users\Admin\Desktop\ResetBackup.potm

        Filesize

        366KB

        MD5

        4cf9a7959f24cdf1fcf045b77d1ca38c

        SHA1

        f9fe87d96696c456ba7a58b96188bbc5b1078ec0

        SHA256

        e1218c4d95cbf014b73927a57c08150c5ccdfd344be0ab66133036b953c9bea8

        SHA512

        0cb294419348930d966e4eaae7f5e4c98d0c2682e8f7670d2b3a3d8b2e66a02393216a32006fcd4eda1c6e43d2f57b2c7f8d01e62d0175e7dbfb88492d490ff9

      • C:\Users\Admin\Desktop\SkipOptimize.xhtml

        Filesize

        433KB

        MD5

        2862fda66ed719b4a65e899dd0a4e728

        SHA1

        c56777247106b5183b87c860c2afdf7660fcc9c1

        SHA256

        93eeca642153ae0e96e793d66bf6b52fe037dd0edece76df34b7584f1c8d8a7a

        SHA512

        63cd957b953c3de5e331506e19fa5cee409ceba7515c56865246ec678da6fd2f10f72c845d3fcb9e53f48926602ddc4cfcc9d356e4af3416e3e95c7771533fc4

      • C:\Users\Admin\Desktop\SuspendUnlock.css

        Filesize

        249KB

        MD5

        25d42fc7ca6ce017cc851614b1c6514d

        SHA1

        d8f25c6a5c6151f7273b0b6a85b536a92b01f410

        SHA256

        74c35713ce1e8d31722d197421ba6b6fdee909df0c93d8946567784250e37f34

        SHA512

        b92cb3a7279e0a994ca250007f38fe5f52ba2503c31801df4d2ae4ed818235ace3f932c9c456cdc9b4bda248c1b12084fd2d944c00df4418be303d8167d8000c

      • C:\Users\Admin\Desktop\TestInstall.vsdx

        Filesize

        483KB

        MD5

        83324885e58d852fbb792b437bc6c385

        SHA1

        6da9fab63f1303cd40b5d02b8dfbceeaee8d5def

        SHA256

        fb3511a9ead194113a437d637b7d2f34c31cc9327ba2a9a51fe31aa6874655bf

        SHA512

        b0c08ee514105a9e9de85d504c05ebc3e03d600a950f53941f193a78d7e4f9dd802cb239cfb9d4e9d353ef339a67d4951f7d466027c28593e31225c418be0577

      • C:\Users\Admin\Desktop\TraceGet.cr2

        Filesize

        416KB

        MD5

        4aa06a4d9ecac0b6abc5c57f9fe52e9f

        SHA1

        379d4ffb0f994cc2ba1bfc551a9b73dc7975d63d

        SHA256

        bb1767e56bb30d11d30261f1a30fbae7c1052ebefef5a59875bde2229bfd8b56

        SHA512

        4522e7e73dbb5ba1caf6b824cc71865a1d335d2458a130e015067f1950fffd4ed14800894b2cd17d5207d5feba48f85e06e4397a6fd6be8faa4ed8703b08579d

      • C:\Users\Admin\Desktop\UninstallGrant.php

        Filesize

        533KB

        MD5

        3348ed3658eed644f3f81ea59986fc5d

        SHA1

        9d6a24067e37cbc1427ecd53985b5c4fa236f636

        SHA256

        4d512e8fbd2660020721bfd8a34a043666f11647573ab4eae1457ce2b8c25191

        SHA512

        f3dc0683cb56af6d39d2ec130671d9aa0307a1ad482c24defedaeeb6acad36d7969d814a91aaeadd4775b2f91cf540dfd3019c646699eae023141b875ff5a225

      • C:\Users\Admin\Desktop\UnpublishConvertFrom.mp3

        Filesize

        566KB

        MD5

        c02f9c163fad794732e58f1c68d3a534

        SHA1

        be92f736aaa4e93b95c29804829ce05f72509b88

        SHA256

        9596905d48ceb4b760d99f88abc92e946b8d748ad6bc084488b16130f960f0c4

        SHA512

        f20e39497ca83141930588a680f2fbc5aad8105b8ed3428c0dada9e6272fccf17684cfa9b6e050dabeaae257df8bc6c3e9703256a3961e3181a190b7ab45f434

      • C:\Users\Admin\Desktop\WriteExit.mpp

        Filesize

        383KB

        MD5

        354e9bbaa96e87421e94ad603a5b1c80

        SHA1

        92afc5da4e499039b6e46277ed3b8bc687f37119

        SHA256

        f79a1972d0e6fe5056dcab1a646119c9c5ef97fb0d671f57ce145fb38b982c68

        SHA512

        708923951bda46ab5ef66f8ac5ef9b5fc6a21c04d520aa3fa7647469caafe6da96415173ea4a96d65c7e046fdfca4150dd53a4236f9a88df5902b577ee66321f

      • C:\Users\Admin\Downloads\AddUnlock.dll

        Filesize

        1.1MB

        MD5

        d113efa28aea4316d312a513e46d227e

        SHA1

        11236193c7c7140c7dccfcc125f1591e1e939ef6

        SHA256

        479d342f0494c3f0a5e4aca843dbd469998c5167b274aee9f0f0b58cd392cc0d

        SHA512

        b69a374fa6d586da8611b5324bab88887861e5596d49f100b9058e10c8a535be68935d1138d8a9158665f668ef9e6dcc7a244aae9707a3744ed5d564415934cc

      • C:\Users\Admin\Downloads\BlockRename.rle

        Filesize

        610KB

        MD5

        1abbbed0578aa60794854689c6899d5b

        SHA1

        952bb0408ed32074cb251b7bea6dc876f861c40e

        SHA256

        52b24f66094822b4c18b18b32988b3dbbe38433881cb10bd6778de6ef5df1669

        SHA512

        9a234dfa6b8ee15ed342d5981653cb1c3a44b355ce28e8d73934b0127178f008f6d79e46de3f479c2496425e546622f5e7ca0b1c92597a30ecaced8934f2032b

      • C:\Users\Admin\Downloads\ClearUnregister.shtml

        Filesize

        493KB

        MD5

        dd0410ea29758c4300fe5ed9d562f07d

        SHA1

        41526e1cb24d17c02e06ed4e415676241e24d005

        SHA256

        dea8faa27a2ea60a8c16c7d08d08d10af6404b35eedbb229e8381bec142c8211

        SHA512

        de5b60fbdd586984d85c30f4915b4603a83b10f519f947f1de4600bf302977ba10f7b07ce85c263d50d5f7bbc4e37680a424f9a955b37ad509889e71eb7ead18

      • C:\Users\Admin\Downloads\ConfirmInvoke.mhtml

        Filesize

        727KB

        MD5

        1a94e1a3a9ade9b30c1d899ad2169e47

        SHA1

        d779aadd1a67afad770b04515410b52645c37bed

        SHA256

        5b0a2e6e42dd1ca5f2a1bb3631d8961f535f6fa9f27ff47f67acc5e9b0f8f0f2

        SHA512

        22388137f3646f73d4c229b883a85e527cbf242f9fb718359e27c5ff995fc31d253baf0cf62a18283a296158e1b17a6a91e406fb4ab720cdd7ffe35ff4ac4966

      • C:\Users\Admin\Downloads\ConnectConvert.ppsm

        Filesize

        710KB

        MD5

        390508c29df3cf508169a1f288e11edc

        SHA1

        a5122d2d6bc41db4a2cf2e83c7203e041472e734

        SHA256

        3e4938ed13a1570692d0aca253dbf75ef40db146a8f00f5f6b1129c87062b3b3

        SHA512

        61d7edfec5194a41eea3b41608790e92a2500c8220b307b6678ea2f496d01c2a9dc334e8c619dcda105706404f651af28181f42a35804c9cca9f0f21c4421f7c

      • C:\Users\Admin\Downloads\ConvertToGroup.MOD

        Filesize

        526KB

        MD5

        97ae67ee7a95ca7585984c9ed068e35b

        SHA1

        fdfc883511074b7931957d517d75ba9fa93070ac

        SHA256

        1e1ee6bbf1f3fcb5f2a22b5c968039530bfe8fc9bc24d25e6f286226178b6007

        SHA512

        4d652e57c63d2a26642dfa23a50e485e8d3adba3cd72a6f105b5dce368a086d9dcce573d2a9ca3a713cc64ea0d03eda12f357f8438c3cd1f8d5775dbbb7ffc30

      • C:\Users\Admin\Downloads\DisconnectAdd.snd

        Filesize

        626KB

        MD5

        7bd6be799dd334102430490b75e9834a

        SHA1

        44d55be17b396b979460f635b69caae677c21f79

        SHA256

        e08b89b397e680d2773b31c05e1dd4ed2581c951644e1af69ba56b60ba2e809e

        SHA512

        23cb70480865a79366f561e9d18aad32b42e35b7f96601e795fba0320b134baf0b8b1ea146485c5e2d7bbe3ecd3917cd4e5260f4c4ae56ad50720c05358c58b8

      • C:\Users\Admin\Downloads\DisconnectGroup.xlsx

        Filesize

        309KB

        MD5

        b81ebf537a36d12445deff65b5d339c3

        SHA1

        29fd07d7020063765b469894da541f243f3b7d72

        SHA256

        f953d3c93a3ddb4b38565105989148f1f1610ef7bc963942d34c05ca9b564bf8

        SHA512

        da734375fcc871d4c388cc8259a896e90b995ce7b8570baa35152547c469677e50a0cb42c6fada5147bf3f029cf0df327cddbbc03507fd2369578842410700e3

      • C:\Users\Admin\Downloads\EnableOpen.midi

        Filesize

        794KB

        MD5

        b385b9cbb6b1acb4a0339822fcbd2164

        SHA1

        c19486e835fbf2ff158925a478f75836b2298846

        SHA256

        1dfefd407b9f08ad794017b6fd77ad882baeac1d912bb2e7e056f2c11f3cf43e

        SHA512

        90c9141a039f88c9420a4efca63ab89b37b9c18b64021a763e8ac6ffdf95ea9a05cf428744d54d11e8010554ffa85a0f3f190327b44173e9206dc5836b6aff42

      • C:\Users\Admin\Downloads\EnableRequest.pptx

        Filesize

        576KB

        MD5

        bd189760e907982b5eba7fdf6beab279

        SHA1

        c2d21ed51417c27b05b3aae4970650b14913c599

        SHA256

        363df15a5c5a5d3ac88bd044d0b12b587630a875f0a519dd2dba100384909869

        SHA512

        56a1c2cf0bea3c1f734060954bdf78d4034fe040595ad2f78a6fb47c87c866ab160c9ee0993f439540100ab571268db14e778813e27ac3ab7af6d5e24457fd5d

      • C:\Users\Admin\Downloads\EnterAssert.mhtml

        Filesize

        677KB

        MD5

        d45241824a52c133e326cc1d9e56bf13

        SHA1

        9126ed0c0c1b8742c04bb17f00a5a6bcb9f291e9

        SHA256

        b3201eeea8e4e1df7930bc009b0e42ffd9586595bacd024055d33b8fae0e6241

        SHA512

        a62cfc2e28845f84d45e8c77471a5e4c886c57a3e682e95cfced50c94380e01d2bd5bc81cff2ca0fd0b56234f0c2798e7f4c27d8e5f1a9a508000ca7d60c7eb8

      • C:\Users\Admin\Downloads\EnterRemove.emz

        Filesize

        409KB

        MD5

        8f611f0ab7efd796611f60fd96762868

        SHA1

        b81cd5f19685f70b7cad97367988b4140b9f5af4

        SHA256

        2ef864b8c3ccfea17bc744ba552fcb1da8b24e562a1ec0aa9df423542094932c

        SHA512

        bc02baab00eed5d02883d88bb40b1cccdfda8585fa136c29b2e2b8b93e7c1df1ecb7bebad754fb4efca1800b24a22bda392ff0ec0fffc7160b6768783fda8c17

      • C:\Users\Admin\Downloads\EnterWatch.m4v

        Filesize

        827KB

        MD5

        ed58b11ae760834c69706412e216f918

        SHA1

        556b1e8bcea9599168ae5aff20ef293f10634fca

        SHA256

        41ea419635c25e1f53ddbeb64cf634198288774a8177dae6f5b0958812bf9ad5

        SHA512

        388bd1266a4e455a0aa814ce24e6dd4d32de8ecba467cecd538e2c7e785eedd06cd8755ef2fa5661905f8e9092911b37131258ff708dafeb10c7e1ead0b5bf50

      • C:\Users\Admin\Downloads\GetExport.MOD

        Filesize

        760KB

        MD5

        4d8b61abb4a8c21485753f7108c309d1

        SHA1

        c6f2026794d55a899c0274a6adc11e34668db898

        SHA256

        cd86f2d6f0b0593c7280be3c25a26fd49b6f447514da1f14bf26b51f8bdc0d94

        SHA512

        388ac493a88b7d12872e8d54e0f95b7157f4ee6791401394d4eea48c6a3bb2cd28019e38485ffee17db25dd9fe378d671cdb14435a24b4d0eb6c5ed05ba0f4d5

      • C:\Users\Admin\Downloads\JoinClose.lock

        Filesize

        660KB

        MD5

        779eba05a5e8be67f0054f41d1d88417

        SHA1

        28f59ea13fa6045e2a7899100582d3b5d66ea996

        SHA256

        d8e9fcb7c542d23a3c363ac26225e91e89ae68ca7444eb43b37c32ce427f3e76

        SHA512

        913d2085f1610064ddb7be2f7ccb060e88b44289abf7ed0457b5c2f6651495e1e621c228af534af98b70919dccaaff6c79a3438a38937af897b7415e60e84362

      • C:\Users\Admin\Downloads\LimitPop.midi

        Filesize

        777KB

        MD5

        a96ec75b6adfa695f29358aa4deb67dd

        SHA1

        5ac37f14fb04f06504663bfee1fd83d0305a361c

        SHA256

        e89f67c8ae30a0eae26292d5a5db298ab35cb73573cdbc02e342395482721926

        SHA512

        ed5f73a4c46f91f5f7321d7629c96fa78a7be088e9c6c54a3a559535c915f3dd2bb8ec1884dc3c7de8562cff849857ccfd833640d572880cd541e0546e2e4538

      • C:\Users\Admin\Downloads\OpenImport.cr2

        Filesize

        342KB

        MD5

        42c48141b74877bcde14e2eb62182fa3

        SHA1

        04b4af9776f2af5143fde96a110ae3c1bc78d1aa

        SHA256

        ec8427575b0803615450c139818fe3b623b6e16e2ce92fcaa9bfb79dbd41205a

        SHA512

        0844368014efb7aa03f9447698cc53b41c243ad933840667ea712cf9b0df868c335e028acd6352b03940a8c9249c3eff548669127a9ad663b161146df5cff1c4

      • C:\Users\Admin\Downloads\PublishOut.pub

        Filesize

        443KB

        MD5

        96b05e88ed3c151871ae6d3303fec7a1

        SHA1

        383fc3c2f6b070bae44082ae1e511a8309dc3876

        SHA256

        c0fda936d3ad86846b9091e77df3663b0c5a7cdf2221729b3497eb5d2c8ee438

        SHA512

        81d0d311e4d004685f9ab16c2e63f00f5817706d9f11d4d65b2a9c13124f046d3dad103bca4762ef205a8993cdd0c303233ab5d36faf0fee91b20cc9ee50b098

      • C:\Users\Admin\Downloads\PushExpand.snd

        Filesize

        560KB

        MD5

        74a9816fd16d95de1772b77c93484254

        SHA1

        314c366344e621cc36d9cafcdafdafe361a8228d

        SHA256

        7ad47c07fec7cd296220f2be0f4062078f040eb9bb6426b06394ca38af6c239a

        SHA512

        83ab4b1f62f5263b75e7dbe73c29da47d61056533e30a263690f9289ef721663238dfd71cbb7539ecf0246b2656d370e4b3af2f467e4c029c645b77b7589b9b2

      • C:\Users\Admin\Downloads\ResetRename.xhtml

        Filesize

        844KB

        MD5

        d1458520a507cd9d0edfaecf2fa11bd8

        SHA1

        a4ed71b29b449644992d24f7ddc9501c40034f06

        SHA256

        770a9cfc6c067df70d1bb915cbba7504cb4ca4435f906e63f8506b0c33133911

        SHA512

        d70cb644edc8b7c29fa15c0fd4e7fbe4f379a1bfc94a9f88ad2465b8d659effacfffbdbcb04b78c268e0673f9eb9092e5835fabcbf62864a9ab242689047efae

      • C:\Users\Admin\Downloads\ResolveConvertFrom.odp

        Filesize

        643KB

        MD5

        9d23b97eee733434ac44a90e928ec39a

        SHA1

        99fd099aed83278c5b052bcdca5dcb26d1501afe

        SHA256

        2a84c190f9ffd3ef63da1ad7299a7d46f478e3b9b1b1adfdbeee2fcb7a4d6c6c

        SHA512

        b2f4de6eeed1cc8c03a0b283e3dff6f05fbe2e0cd3394b44f4145cb724178b823056ecaa30ac0c2d1c0c063e35d4054e9ce0bda7f2ac8e049fc4c823e1ab27f4

      • C:\Users\Admin\Downloads\ResolvePop.scf

        Filesize

        392KB

        MD5

        36c40ab334af04f9dad3d4a5d1e5d4c7

        SHA1

        a3a01b132781acadb13f7279852e2009dff80686

        SHA256

        86702031f6826449b406cb0acf49908b6565482343e1c861bee03db31566c5bb

        SHA512

        7643ce94d8c47dfa9324a644092d372b4991b53dcbba01543213c75f16aed73a98867ff3c413ace166c6ac727f343dbd06c2c7ec99061d23f5db0e7ea23786ed

      • C:\Users\Admin\Downloads\ResolveStep.mpeg

        Filesize

        810KB

        MD5

        db0f3950b892c24fd8ea40eb75908ef5

        SHA1

        b852f2dc1bb06dc058e1aafe13264677342c6f14

        SHA256

        9a1d83f11ae5155902e3846f04155dbdd02dd872e6354f2e7131da66c5724fcc

        SHA512

        3a789f6f0980cf7cdf2030735e78816b8bfb21bcb06e1cee033171c367053e6a26c0eb667643333d289e489b6c36bbd8be610c37c402f54eb949c1a9d4ec1f0e

      • C:\Users\Admin\Downloads\ResolveSuspend.xltx

        Filesize

        476KB

        MD5

        33625ab643faad6035c2c91feaf351aa

        SHA1

        0cbd5029341dacf24b838303720505d5d7a28b69

        SHA256

        2664b330eef97ce480be89a0c6d8911b07654aff8a889fa2f1bae26582d75c4f

        SHA512

        3a15dab439e079f0176780b1d60f83d99146eee8ec194de10322002aee0ce6edc701147a9eeafc00b3fe8142a8f7b366c4af2f2b4dfe2128c7f62ec406d4d1db

      • C:\Users\Admin\Downloads\RestartStart.ttc

        Filesize

        376KB

        MD5

        37cc51d7a598b62fae42e20b2cfcb451

        SHA1

        e2632f5ff0e4c00c6d8a34237bd1843e54934a4f

        SHA256

        96c71c17c2b4f7f0741f460f9365daaf194e17253d3a4dd3c99c8b69e4343efe

        SHA512

        b0e3c8ce817acc5b7c2f3447c21b53f9f3bb3f07fc7246326478cb9cdfd7ff5542f385c53bdc96c17a3a4aecd6a8323e28ee9f74f0d1e1767f9af0edfe8aa4e3

      • C:\Users\Admin\Downloads\RestoreComplete.mpeg

        Filesize

        459KB

        MD5

        ff4e4b9ae258aaac9d75a7605eda81ca

        SHA1

        83839f84f06ea9a91f91b19b9010e93c4388eba4

        SHA256

        f0786332912e8ab1dc17aee461d999cef6aba2b05a831c0f674709cd15a17dc6

        SHA512

        e1ae4f61283af1584fde5ed7f1c26987a84da7fc58e874201109111ca335112a9d95e6d752dda71fb2bd4c636cef94efc473df3bfc09b0348741f756913dd771

      • C:\Users\Admin\Downloads\ResumeSearch.asp

        Filesize

        593KB

        MD5

        648180d095dafd0f42d80b256ea502b9

        SHA1

        aab1b007c72f6f11cc00691fc230495055933961

        SHA256

        6207643b0649d905999d33d965520299859cd6a7e28892804c56c00fdf684ce1

        SHA512

        bc228e6a13303dd924fe7423569f3f70a9cbd6b83029e2bf60f2cd4e044480b45f276e86bf7ff34d13204cf5af60adec53db0d4c4d0f36eb672f48f189d17e1e

      • C:\Users\Admin\Downloads\SearchRestart.bmp

        Filesize

        509KB

        MD5

        bed1aba438e20787c564b06da3eabd82

        SHA1

        1cb1e51fbd29b0c73bcba9667c4eea22acb4f4de

        SHA256

        6b35a3016675c820955d440b66176c3988961f3e27fbd6ad6aee1aaa96ee99c4

        SHA512

        20e13027078242c8c69eaabcead2f11e372488977d03945e202694b4abbd2592e7533c9945118616978510472d76127ed8c20ab029a072d86baf54bafc79832f

      • C:\Users\Admin\Downloads\ShowInvoke.vdw

        Filesize

        426KB

        MD5

        f4c808894b7f7c95fecc95020e2456b7

        SHA1

        625d88485ce14138cc3ac8e94cffc3878ab5d60a

        SHA256

        52620eeedf87d34defdc97bd80d56302b591e3eabbd679e0932ab3d1be3cec88

        SHA512

        6b2914cb8c967c19a7a2ec4ede78c932003b5fe571cdadf8bdfa8b4bf4de581c928f7a5fbb6d9d0005cd8502f26ae3d940448eaf01c37295e4706cf213e32e5c

      • C:\Users\Admin\Downloads\SwitchAdd.mpeg3

        Filesize

        292KB

        MD5

        78b6b3b3017d1da0ff1a038537f41013

        SHA1

        6863a7b7cf498b421b7ab17cda0643ed3759a9f0

        SHA256

        7f2c6c741c4e5915a4e0747e6fffd29972b3b9846afbd95cf5bef3c6a89fcbe2

        SHA512

        785fb9aa4d882b4b985f4c8a6eee8f6ddd170dc03a092a80609a27f49d557bc9d888f2f3767088d5d6fad5dc6f72b28931ed4e34082aca3c3af59e9d3e504dc7

      • C:\Users\Admin\Downloads\SwitchSearch.potx

        Filesize

        743KB

        MD5

        3090446f1fe178803efca7616d594ec9

        SHA1

        60b346352ffbdb0d24f8b1099139abd49056f896

        SHA256

        7dfd4d31bd29ac1ed0da086d5d89da85d0be22e89dc998bdf97e692c7c1bcdfe

        SHA512

        628c85183651c1f460db685f275557f643975da638731d8a12a8741a77a355fdea567c8a18a601daf74622475b09976d4414346348f668f2e4de07765ff67eaf

      • C:\Users\Admin\Downloads\UnblockStep.css

        Filesize

        326KB

        MD5

        8e752b7fb7d798bb73166adaf6896c99

        SHA1

        534a7aa012188cc5056a8fd0dc867a0372b0999f

        SHA256

        9bc64b640853f1a0fd3265939c3e45a6feab7a4fd3d19ac5f9724193b667c51d

        SHA512

        ea135e9cab44a07b080ff83522f19ecc59cf9115474e7dc27d4f1fdb940e4b6b20a79f27c006aaf526729fbd06a746ddf7a6aba4329e847eb5fce7bba29ba2cd

      • C:\Users\Admin\Downloads\UnpublishClear.avi

        Filesize

        359KB

        MD5

        0bb9cefe8ddcc15e1de9d9aabf502b29

        SHA1

        bc0563b696799b5e5165539071260d713026943a

        SHA256

        100cf19bbf8472ee9f8a33a7f0f7737af5017f7f502b12742f75428916a4f258

        SHA512

        9d143711ba2de5ad2487491089c763ce917c6350fa1087e73d253d64d8913ff60dfc221eb57937e0c26c8299ef9822b6170fe32ba792b746229cc3709c368ff1

      • C:\Users\Admin\Downloads\UnregisterSelect.ppt

        Filesize

        693KB

        MD5

        a7f9a4a8a1f455801f78c37212decf36

        SHA1

        be1fbdba92b16240dc82862129a595b884410912

        SHA256

        c505ed0740a3a57af669a66d9c367b5bb7393bf6b178af1b7345938864ee9dba

        SHA512

        96f65a6f78eb7fe258e0fa5f89e66711cfbd1b8239d3393d045eaddfeefff538b5ffb99fd8b21f91a7f5c35c31b9105dcebbdb554744f316e538ead72357fe56

      • C:\Users\Admin\Downloads\UseReset.hta

        Filesize

        543KB

        MD5

        3d96ba589bed0878d07139cc00f27585

        SHA1

        a7e4990c0002991d9bf46819ff28fdca89f77cdb

        SHA256

        e66feb2b8c9626a6eba934bf98f6fa0355a83fb91c9851e245af7323bc802212

        SHA512

        d47318099320942c5338894af78eef8cc8d3248e322fa8050d9ed3fc7a1ce331a4482167f6d8ded3d9cf078804672de4b14863f1cccfe75f71b9cfa0ce54f219

      • C:\Users\Public\Desktop\Acrobat Reader DC.lnk

        Filesize

        2KB

        MD5

        cd2e601ec2f44b0211fae65422446e0e

        SHA1

        b2ab43d71e0cfd537c1a4fb17d04b82f7201b6e8

        SHA256

        2b83847fdc0f0e3eb695aa504d2a332c5197a07eb25b37b0e184e0e5411caa14

        SHA512

        c0ef50cf3f82c3ed49d23c39b69513f84c0aa94059f618a4dcf7b628ee8e67d83998e59b6c1f23b11cbca4aba5b8d46ea741dd77967ff757d5b8fb10b1da0fae

      • C:\Users\Public\Desktop\VLC media player.lnk

        Filesize

        923B

        MD5

        36867f540d444fb05ba7469f61198517

        SHA1

        26e3ec466b5392d8bc47c49937b11bdfe30e8bea

        SHA256

        b0e200ab7b8320378557a7a5d4f14d9d3f7b8fdaae9541fdecab0c16f63e9f95

        SHA512

        d6637fa169b65dfb8f36c24c8eee3b944ea09185ccb1ac1d7197028ef04a6d0ac613e0ec4728a8cf756623bb227b0e6c108194f741636f958488ff4c595c6f99

      • memory/2216-73-0x00007FF784890000-0x00007FF78729F000-memory.dmp

        Filesize

        42.1MB

      • memory/2216-80-0x00007FF784890000-0x00007FF78729F000-memory.dmp

        Filesize

        42.1MB

      • memory/2216-79-0x00007FF784890000-0x00007FF78729F000-memory.dmp

        Filesize

        42.1MB

      • memory/2216-78-0x00007FF784890000-0x00007FF78729F000-memory.dmp

        Filesize

        42.1MB

      • memory/2216-77-0x00007FF784890000-0x00007FF78729F000-memory.dmp

        Filesize

        42.1MB

      • memory/2216-74-0x00007FF784890000-0x00007FF78729F000-memory.dmp

        Filesize

        42.1MB

      • memory/2216-76-0x00007FF784890000-0x00007FF78729F000-memory.dmp

        Filesize

        42.1MB

      • memory/2216-75-0x00007FF784890000-0x00007FF78729F000-memory.dmp

        Filesize

        42.1MB

      • memory/4180-64-0x00007FF784890000-0x00007FF78729F000-memory.dmp

        Filesize

        42.1MB

      • memory/4180-72-0x00007FF784890000-0x00007FF78729F000-memory.dmp

        Filesize

        42.1MB

      • memory/4180-71-0x00007FF784890000-0x00007FF78729F000-memory.dmp

        Filesize

        42.1MB

      • memory/4180-70-0x00007FF784890000-0x00007FF78729F000-memory.dmp

        Filesize

        42.1MB

      • memory/4180-69-0x00007FF784890000-0x00007FF78729F000-memory.dmp

        Filesize

        42.1MB

      • memory/4180-68-0x00007FF784890000-0x00007FF78729F000-memory.dmp

        Filesize

        42.1MB

      • memory/4180-67-0x00007FF784890000-0x00007FF78729F000-memory.dmp

        Filesize

        42.1MB

      • memory/4180-66-0x00007FF784890000-0x00007FF78729F000-memory.dmp

        Filesize

        42.1MB

      • memory/4180-65-0x00007FFE4E5D0000-0x00007FFE4E5D2000-memory.dmp

        Filesize

        8KB