Resubmissions

02/08/2024, 15:33

240802-szdywazcpq 3

02/08/2024, 15:13

240802-slr9caygpk 7

02/08/2024, 15:10

240802-sj92daterf 7

02/08/2024, 15:10

240802-sjz66syfqk 3

02/08/2024, 15:06

240802-sg5zmsyfkp 4

Analysis

  • max time kernel
    105s
  • max time network
    97s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    02/08/2024, 15:10

General

  • Target

    Bootstrapper.exe

  • Size

    795KB

  • MD5

    365971e549352a15e150b60294ec2e57

  • SHA1

    2932242b427e81b1b4ac8c11fb17793eae0939f7

  • SHA256

    faad2bc8e61b75e595a80ff2b6d150ff8b27187a8ba426cc1e5e38e193ab6d42

  • SHA512

    f7ba1353e880213a6bdf5bd1dfdfd42a0acf4066a540a502e8df8fec8eac7fb80b75aa52e68eca98be3f7701da48eb90758e5b94d72013d3dff05e0aaf27e938

  • SSDEEP

    12288:GYa9sBhIBdCdbX1USoeQDj/VNpA+dZIznBpGTEy:Pa98hIBdjSoeQDj/VNpZdZIznBpg

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 616
      2⤵
      • Program crash
      PID:1568
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2712
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:1856
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        1⤵
          PID:2504
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe"
          1⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2240
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5c29758,0x7fef5c29768,0x7fef5c29778
            2⤵
              PID:1380
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1392,i,10317666090370505983,14437089360382911341,131072 /prefetch:2
              2⤵
                PID:2340
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1392,i,10317666090370505983,14437089360382911341,131072 /prefetch:8
                2⤵
                  PID:3040
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1660 --field-trial-handle=1392,i,10317666090370505983,14437089360382911341,131072 /prefetch:8
                  2⤵
                    PID:1676
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2312 --field-trial-handle=1392,i,10317666090370505983,14437089360382911341,131072 /prefetch:1
                    2⤵
                      PID:2916
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2324 --field-trial-handle=1392,i,10317666090370505983,14437089360382911341,131072 /prefetch:1
                      2⤵
                        PID:2552
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3228 --field-trial-handle=1392,i,10317666090370505983,14437089360382911341,131072 /prefetch:2
                        2⤵
                          PID:2856
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1404 --field-trial-handle=1392,i,10317666090370505983,14437089360382911341,131072 /prefetch:1
                          2⤵
                            PID:2656
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3660 --field-trial-handle=1392,i,10317666090370505983,14437089360382911341,131072 /prefetch:8
                            2⤵
                              PID:880
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3696 --field-trial-handle=1392,i,10317666090370505983,14437089360382911341,131072 /prefetch:1
                              2⤵
                                PID:2988
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              1⤵
                                PID:2788

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                                Filesize

                                209KB

                                MD5

                                3e552d017d45f8fd93b94cfc86f842f2

                                SHA1

                                dbeebe83854328e2575ff67259e3fb6704b17a47

                                SHA256

                                27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

                                SHA512

                                e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                Filesize

                                264KB

                                MD5

                                f50f89a0a91564d0b8a211f8921aa7de

                                SHA1

                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                SHA256

                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                SHA512

                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                363B

                                MD5

                                0d9ee0691649f717b457717ce6c105c0

                                SHA1

                                afa77489d60a29957450fc21cb808b6381c36237

                                SHA256

                                6afad6a76652d7ad75b98d644c778445b7e9db83474e6c38d58f21389aa5337f

                                SHA512

                                fe03897962950586528fcc248f706b71666ac27af656b71cce08e68133ccc3261bc60dee696dd9a07a42a4b5194a236cbf4da800b9083b33161e426984730c38

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                4KB

                                MD5

                                17aee891909e494ca72a0ac62f064312

                                SHA1

                                f0c3435e753f904787e688a4aa77ae619500fb2c

                                SHA256

                                e75aee851715ae1316d62d430b418410fb734a1ca191eb273472f8942c10c559

                                SHA512

                                377d96c281ea6555265a93441786d029f594ce5e2f4d35ce624a230b5bef3045d1cfc80d24db4ef13f3b6322a2594e60c0cd0dd1576a6ed90b97d71d6e88f5b6

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                Filesize

                                16B

                                MD5

                                18e723571b00fb1694a3bad6c78e4054

                                SHA1

                                afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                SHA256

                                8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                SHA512

                                43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                              • C:\Users\Admin\Desktop\AddReceive.ps1

                                Filesize

                                656KB

                                MD5

                                aa27f345ff4191ec77ad880a6f2330b1

                                SHA1

                                62b96d657207d34b9b20c4fb641334c921d825ab

                                SHA256

                                e213a7deeca3e11c72cc466c8743f18bd8c4de05dc0c549a9f3c202925619a8b

                                SHA512

                                08a7ab4f2e29508f2651f5cdc3f940d9bf4ae52d7f66fea5c50a34f7967dfcf4872a13f3a388de34c5ff22b2268a20911c2c508ed9a54afeddc552f46f5eaaf3

                              • C:\Users\Admin\Desktop\CheckpointInvoke.DVR

                                Filesize

                                625KB

                                MD5

                                94f5565b8dc8c34b50a03e759e653c92

                                SHA1

                                7cdf14f6e857782ec6d370774bdc236a9641761d

                                SHA256

                                e19db46bb2b4345ce588525d631a59757962553fb089fb4e6dd6cd22e11ed2c0

                                SHA512

                                64111ca7f79b20e1b8f2d5975cf31a9d902b8991b200c8a058e3a1ee47a78f8c4c0de9af59eb4c34c2b0409b64a9ae7098faa7cf957eee2e49a32ebbe6089e05

                              • C:\Users\Admin\Desktop\CompleteUnpublish.ini

                                Filesize

                                419KB

                                MD5

                                cb99e615249778b28ecbf295e35ae560

                                SHA1

                                9442bab523febcc8d2c9c4b2e3ecd77a554c8f75

                                SHA256

                                df1b142838159b40faa0b1510ac2164726b549ce067d7bf31cf0fb75fa1a6a9e

                                SHA512

                                58e767809efe9cbe97fe32223dd595d4819e5890a7e2953db51a1d672d609e26d7a3eba57dda0aadf33f9c6c0f98085f904fc30c548296b77baa17bad0661ebd

                              • C:\Users\Admin\Desktop\ConvertFromInitialize.ttf

                                Filesize

                                514KB

                                MD5

                                4258439756966657f28ebebf92270593

                                SHA1

                                a03a281a74870f4de91554884f9b3a27a6194fc7

                                SHA256

                                994bb9a73df24b9b034e35467a8ba761f0704de4b95984d5f3cc96d207d92b43

                                SHA512

                                006e7278f315cb4a5703765cae698d069b4d1a8379237d7121a5300ed30be961cb6be925dd20515cb40aea0164715c4a21d5f2d09147a81ccb66a0ecc79e4eb7

                              • C:\Users\Admin\Desktop\EditOpen.xlsm

                                Filesize

                                577KB

                                MD5

                                333ab0772e9bbf6976642c0ef6f78611

                                SHA1

                                02471d38c9c92d22dd148dd8556f3b32b74004f4

                                SHA256

                                172c29c07865285ce7953ef50cd8332e57f46875e5a0d417f01bfa708579129f

                                SHA512

                                80eb2d9c5a2228a06bd4dd965340d381f1831f54283ece1e7e4cd0c911f3fae94e34a485d5e6f0fb1d5fb72f82e766c8b6f5a88b762d9d7d552a33e7bb903eb3

                              • C:\Users\Admin\Desktop\EnterSwitch.docx

                                Filesize

                                15KB

                                MD5

                                dd9f3151549a5cf145f0c1566f613198

                                SHA1

                                24d129f89f8225e35bc027368e02c4f48c309c54

                                SHA256

                                558a104a289273cb701d2e92594835eec5948ef04f87d48b421e2763ee73c6cc

                                SHA512

                                56919a2f5534e466b3d11582b5524865301e66d5b27631a15f393ae6a036113a119ec634ea16d15345e582e9e12ac70747bb9908d8966be09c3080695278a53a

                              • C:\Users\Admin\Desktop\ExpandReset.rtf

                                Filesize

                                482KB

                                MD5

                                a0dd7934d3a37424851ba2a7f51235d1

                                SHA1

                                1545fcf93e3357c9e528abfbdd998e942b5a71fa

                                SHA256

                                25e45c491e1214f2d45d6aaea158b08764696918279545c0c2e0c357290db1f1

                                SHA512

                                c6a3162e45827c01889c7da8d0e3a3dc23d3de0a5ed9d221d7172c157f48fdbecee1dd1ff8821a07924975647a60d369fda76518254d1193d8ae1edbf989e9ab

                              • C:\Users\Admin\Desktop\LimitStep.docx

                                Filesize

                                15KB

                                MD5

                                fc2c37676bea244472473d0b427a10ba

                                SHA1

                                7e5adb150d35c0f0c334bab53126ee4d5ef40745

                                SHA256

                                4b66d817c73ebcfeef90da1536b6c0b58b4357311c967096c24868c15ab46952

                                SHA512

                                e922d73514c6835668207ed75de7f50663a9f288f9393341c38ae6f6f3f73a9f3e121bf5cf64346b1b1f493996beaab563f81b2701f627b2332eb3464569da63

                              • C:\Users\Admin\Desktop\MergeRevoke.tif

                                Filesize

                                277KB

                                MD5

                                b780c73e3ee87dfaf245e191ff6c6cab

                                SHA1

                                fee927ea59c886ffe9a4130312bb6fceb8ffe18e

                                SHA256

                                d67a40c985a195c2e44c450c4812449b0db39fd14dc5a210745e47dfe8febd8b

                                SHA512

                                cf1895ad2eeac43d82f217048549f645440b9505921448df4a6d7d369448d8cc340d086c0d8c1f66d96fbcc91e6c6c92576972ed03bfbcae8c8ac6c9b8fa22ae

                              • C:\Users\Admin\Desktop\PingRename.xltm

                                Filesize

                                324KB

                                MD5

                                f7d38aea0ea0054f4fd0183b6de038ef

                                SHA1

                                38afdaa6c1a0396b8f14443a7f8cd94b2589d879

                                SHA256

                                51e77561bae4c57f2acc7a7cd4c5d60b4ec1e7031452facff28b969c73475db1

                                SHA512

                                0b82d37be722c39de20dff53e76309b145eb96eeb01e44238cad048fdb3085db0f2dc2312f5c7327abb8507bb05052f779efafc7e336d2173c06cef6dcd77674

                              • C:\Users\Admin\Desktop\ProtectUpdate.odt

                                Filesize

                                356KB

                                MD5

                                9438ac144a3c26570b25ba96cc23eeb0

                                SHA1

                                60f571a366f68257ef32e52f44ce505f154e28a3

                                SHA256

                                fb8d0a8372d4e17d20fa72328daaa482783da6994b63c0e42da9ac0f6a15a305

                                SHA512

                                249ff5eb8372907daadba0663da883cff0cde8e1a3e21663aa8c2b8ee97ed640eee839d2c5f94eeb303913070ad0209a7a9b1faecc4e2a13e15a38a520afae64

                              • C:\Users\Admin\Desktop\PublishEnter.ps1xml

                                Filesize

                                340KB

                                MD5

                                cb7c21190e61527a58a754ef4944c546

                                SHA1

                                312f9b92d95b77d0f97ec9ea37d4d1d094e06a14

                                SHA256

                                75662e8d40d2eff6f5d4d5e5acc9f960881ceb7914a126db34b81b5862203342

                                SHA512

                                cd2bc5e9bb18c212e7a718ff7ccc834b12dc7554efc2c9163fc080aefd8fea79a379583f73a2117f083201307f210d7e327240b255e24c4c40f9b838c6bff8aa

                              • C:\Users\Admin\Desktop\ReadRepair.aif

                                Filesize

                                609KB

                                MD5

                                5e30321e12bd86b9f546556d150155a6

                                SHA1

                                898a018cb16ac9358aeb217fdf50296b8fe287d5

                                SHA256

                                aa0e0de7020962fb33d7b4d21a9126f7764483e89f2532bbb70d5b31fd62c21c

                                SHA512

                                5adcc2d582e8f5384d4c4827b0d6a9645bdceeee118f24166432fe24ee3ae192727cc673dac66ffe9bbb67cfefaef6b7154238a5d9c8222fe9e51bc7bf0bb301

                              • C:\Users\Admin\Desktop\ReceiveUninstall.pcx

                                Filesize

                                308KB

                                MD5

                                39963559ebf1919882077cfeb2178420

                                SHA1

                                c9cd31f34e23ffb4450e8313f1b3b436a02f798a

                                SHA256

                                3b308dd2b139201e8e8f5ef4203dedcd04a6d07197027ad425cef155be5f3e10

                                SHA512

                                2111e9afb6a488480b5b050fe6de2fb811554dae16a7d6bb5f01cc7d74a0069a0577f67dfc91143f407d3123191b1742294606548d6cf8dd1989b2e87f744101

                              • C:\Users\Admin\Desktop\RedoFormat.xlsx

                                Filesize

                                11KB

                                MD5

                                585356c57b832e3e82c7050d9d803b5d

                                SHA1

                                2723627f89379a8805e726518f252470bd2c778b

                                SHA256

                                06213c3a8fb1ee8f6e782da4877ef434b5725e90e0d03ddca61f9cdfa5160aa8

                                SHA512

                                f1f897105ab95b4db17423284202ef81187d6e2b5c485f16301366da74c7dfd1f752c7d2768a1d34859ca6d4fd8f63045a66526cdd0bda79d7478266c7ec98d4

                              • C:\Users\Admin\Desktop\RegisterUninstall.dwfx

                                Filesize

                                901KB

                                MD5

                                a015ad26b70371788f8d826704c92ae9

                                SHA1

                                982b804237f4aa18d064f24ae04f17eb2f0f0b4f

                                SHA256

                                522fcdd1d1d071a770686a50315abc69d40e0841d887f1fd8ea0cf13efa6b7a7

                                SHA512

                                147b0faa996bbabf0af9293148a29b2839a667c16ab02b3d485a2b79dd8ff1fb25938ddf9dc6f51d7d787df6b80fe65baf26f6415cb83b516916c6daac7c2317

                              • C:\Users\Admin\Desktop\RemoveEnable.mpeg2

                                Filesize

                                498KB

                                MD5

                                fae098b8bcb7cec66383b43363329135

                                SHA1

                                16318a5c136b2fbcd5a0dac22868782adba15ca8

                                SHA256

                                d8868cc119fe8a8b6e923ac9cb2408a882f8f23316761e719e09c5b98209a3a3

                                SHA512

                                8cd9e3906f757392a83ae707731f944bbb916c3e2b538e422ff259ff657020dc4736c9f27898a5aac2bda905ff3f654e46f1211084f82ad27382d4aed6d8b0b4

                              • C:\Users\Admin\Desktop\RemoveRevoke.lnk

                                Filesize

                                292KB

                                MD5

                                9076b7deb41d77a29caac62ac6ca57a0

                                SHA1

                                19741a2b60e9c710f12a09d9d00b86ce0cb59b9c

                                SHA256

                                34f541dee91ae22122d6ccabd890f3b54e55bafa44ca8a3c3f1e517223125e92

                                SHA512

                                cfb07890d249063786ad1ac3eabbc573c5d551a96f32c96a3d057a6d44380370ec99617cd6b67a6c973c5f60e197f1b74be768542b8b4422c1e69558bbc702b8

                              • C:\Users\Admin\Desktop\RemoveUnregister.jpg

                                Filesize

                                229KB

                                MD5

                                869146dbb785ce9e7cfab620875a040f

                                SHA1

                                5052b161f29f8be1845e65b10f1e707a93ddeeae

                                SHA256

                                599628cc7f5fef16fa0513597eef3051974e8df31a2652dce65b5a4b2c5d026e

                                SHA512

                                124cb692d822c5fb229682acb934161e572ac74ff8b32117fd476ebd18637be0a7fd8918e0b21d86576af762a01c5e8e21646b55d4694c94810eab735f65e45c

                              • C:\Users\Admin\Desktop\RepairRegister.scf

                                Filesize

                                561KB

                                MD5

                                85cf8ea983ea573f2bfc11a2232cc127

                                SHA1

                                be6cc05c43b7246f82764428377a34e7804b39da

                                SHA256

                                08f615618900ffba125cd691d0476ef1420adcd56dcd1cb11c290bee204bd1f5

                                SHA512

                                1d46f57df050bdac395d6bf07b3b1b8e8b9faedc51bd669bf403b548fbb05674e4c49cdc5565d2802c522a7a2841ad509d34732440d5bd222e5021e3220000e0

                              • C:\Users\Admin\Desktop\RestoreShow.mhtml

                                Filesize

                                371KB

                                MD5

                                78523a156a5749c444a6264747cd1e15

                                SHA1

                                e7e279119374e9d1f1ea3cffab9103e3844bef38

                                SHA256

                                9a25313c29e3c8d9a027bb5d6726f2a82dd50b345ceb4ae15ef3deb1b7500584

                                SHA512

                                e5d83c42a89b2293477be98110fdea4445dcd3dcf0f4936fd0a8e235e887b91890f6c18e6e50d76d0af31d8b41b79b9d1e9e2c51c14824aec81041c455763b0d

                              • C:\Users\Admin\Desktop\RestoreSuspend.TS

                                Filesize

                                530KB

                                MD5

                                aaa30ca12787a02c6771077c752253eb

                                SHA1

                                33b0e633abe90165bf7100ff15946323697fbb32

                                SHA256

                                afe4e857ae58470422b2ea245ca92e42d016d0739c00caa2154c0324f2a588f5

                                SHA512

                                1f34b2f064f4ff0624abf09693752b214aa60715ed730a36142a643f0f0abe1dbb6307fb6254946d4a93e7cbb18ce030082b5d5217d25dc479ac0888a582fd8d

                              • C:\Users\Admin\Desktop\RevokeHide.ram

                                Filesize

                                593KB

                                MD5

                                102d17fc27fa18b7c93355c45f15d79d

                                SHA1

                                27267215ee3005ffce22519456e3332278d4a44f

                                SHA256

                                baf0996d411b6fbe1ccdadb907b23fdb7f86d17cb307f8c91d1e2a9864016768

                                SHA512

                                979961f99b57557a201ff504768fd0f45c619732835ef5c6ed986d494f3af058300b2b12549462d23ad82918425b59d1f87b6310832dbe1e970e3f32b7d581ab

                              • C:\Users\Admin\Desktop\SearchCheckpoint.aiff

                                Filesize

                                546KB

                                MD5

                                e99aeb75253a4d6564ddb5410992bf41

                                SHA1

                                fee5ce73d3ea2fd702f58c4bb50249461bb4bd02

                                SHA256

                                b6444c907bfa560ef43046bc95300692d25407f077835b7347b3c5eb15ec19fb

                                SHA512

                                534b17cfb9e629a8f0780e86d0b45a3d89658806d13419122bbdd426193515d8234bfa196ef13da21dcac21a0bdd33830dae9c9e147b4c95afdd8cb52bc9b12e

                              • C:\Users\Admin\Desktop\SelectStep.xlsx

                                Filesize

                                11KB

                                MD5

                                210f4363060702795f06cdb77d414190

                                SHA1

                                d4bfa2f45da93a7ae9f447312af4755aa7f0145c

                                SHA256

                                2729034d83de3a9cb943b16be0d89ca5495f76e69c36ea97fd6090170d2ae92f

                                SHA512

                                2d1bd965aeb64586fe3e1849cfe405dbce8d2955bebde7b5d7e886f9c98edba1349ffd7bef5fde813afdf5dd8b7e6dac3a6abfdc10e72c047ff1fa3a2c5dd9ac

                              • C:\Users\Admin\Desktop\SendClose.DVR-MS

                                Filesize

                                261KB

                                MD5

                                b542320ef7cf3bd5b38220a8fd1403dd

                                SHA1

                                38adb36b31956f2df20742e3a69ea2f72166b8d4

                                SHA256

                                73934311f8d02d80be367961d6ddb0cdc8c46061061a01b80b7b87389e87e21c

                                SHA512

                                e6208894f2ffea6d463697beb07d4dab09174592e0c93bd9df28b7e25429905652b3df271c576ca707756d024f85d6c82ea08b9f1ed64006639841573c95dee6

                              • C:\Users\Admin\Desktop\SetGroup.html

                                Filesize

                                451KB

                                MD5

                                a5f90b37525391d0122a185b540de529

                                SHA1

                                f31ac98fe41d8c81bb133d5f5aea9ce3f43574a6

                                SHA256

                                4e1b0fa8b9befd4cb82b8a14fc46f8957af1821caeb28f02b8ecb5702b6533ab

                                SHA512

                                3753ef3e47399484223a7c1d2a1ced661e323f4b0a2d0be61ee8bfea842e50e64a6b23adf5d1f51c1c3c996b80e35d612ef19b3950ae523e02f430c9e741f057

                              • C:\Users\Admin\Desktop\UnblockBackup.mp3

                                Filesize

                                245KB

                                MD5

                                674cbe3595604d38c92636147de71c1d

                                SHA1

                                05dfa677789f91707339b1b86789866e742cc432

                                SHA256

                                05fec3e9430c9cc7a7762bf33a8ac8f2a520664dcb94c05442f05970cadb668d

                                SHA512

                                f6d8d9e508f62687b363c62399acee8d35a8af4a96abaebf851b66083a4452b78b344dfa49fb748d2868ff4f3bcb7a30115c3dcb244cdcab9341fec3613e65b2

                              • C:\Users\Admin\Desktop\UnprotectCompare.vdw

                                Filesize

                                641KB

                                MD5

                                5527966a0eedf66321cc7533d53df2db

                                SHA1

                                d72010f40b8ac526e24c79f582cc0566f7f23789

                                SHA256

                                b672b9e38e1990b60f24a5cefcf0423dd5a149707ffd445490803a62b22dceff

                                SHA512

                                1272223c3a440d9769c816c34ff5c791a0781f3d311043ea2dc4c121d3026ba16bd9d3e2424ef1c9b6a849ebf4a045ddc63e9b2a55a9cce0f9393b6125089e89

                              • C:\Users\Admin\Desktop\UnregisterSave.lnk

                                Filesize

                                387KB

                                MD5

                                e16043524e63932748f0f0f78c8d0a8f

                                SHA1

                                d53e0092e9a62e3bd32e6afdbfd4e243f3d0c86c

                                SHA256

                                d2e0998628d775d263022756f0bcf112fffd469513c8fa7a5bccf8a232e8cace

                                SHA512

                                9ec7e65ef48929478ddd586a65bd29ead039bb4ac614aa3784f2e191c627d3536f7ca03c4e7a0a2591e7e82b8415ff10c4e11d66294cecc2e83e4247ca903bdd

                              • C:\Users\Admin\Desktop\UpdateDisconnect.dwg

                                Filesize

                                403KB

                                MD5

                                b92e0a69677952f43f49ba7859403ab5

                                SHA1

                                fe1c1370ba6958f4f922fafe13576cdf94034f4d

                                SHA256

                                67b67ec52133c5feea9a1c35c76ddfe6f223e5d5b8f48d8f55239e7e4b683f4c

                                SHA512

                                1136f0eb1115ade71b1fec821b49ead117c0fea32059641cd43288e33dd5d0e9f8344e601658ed37a114f3bba82d6a0c3ac821da9e09b4380070aba41469b1bc

                              • C:\Users\Admin\Desktop\UpdateGet.MOD

                                Filesize

                                466KB

                                MD5

                                9391626e6127cfd4510c18624730e8b5

                                SHA1

                                88b42229beb4273b898cc4742aa01ad9103a64f7

                                SHA256

                                fad83954437495ab0012ced63868b468372cb102ec4362c1ccaac5b3646457ed

                                SHA512

                                cbcfa116a2b28662c9ad215968362ec469b4e65185cb029e3ffc1dc47f938b5ff76faa87fcd4a5778a99f61587afdb471e90598c4f98107944efeb5209b48168

                              • C:\Users\Admin\Desktop\UsePublish.mpa

                                Filesize

                                435KB

                                MD5

                                96fa592435f47e16dc451d79c31ce25c

                                SHA1

                                5437841c9270bf990c503c33dff60785f9d662cc

                                SHA256

                                419c5b7e6ade196272864e283c1190cbb6ba33663b55f7ed1c268d758f5596a2

                                SHA512

                                ad77f700d14eeb5978b9d5c8a6ef1bfe3efeb898f8976fff4d8cc9e62e458b3bd4f9054326241fd55128ebcf86287458f363f7b1c56fc2ea06e1cabdadf8ea37

                              • C:\Users\Admin\Downloads\ApproveConfirm.ico

                                Filesize

                                513KB

                                MD5

                                4bd7998a56c44e52c7d1b890f1e67237

                                SHA1

                                f937f537bcec33ed1a2dab28313701a98831a337

                                SHA256

                                e81998b1671194afd8056f8ab50f748983e724bfb321cf8ef817cd75a2e3fa29

                                SHA512

                                6c434739df984be68bc3d9d92a77e8daca35ef38ce736a165cae3254655e97acef910781966a43541d09c2c8732b778dd334e03885752dd8cf401792ab965273

                              • C:\Users\Admin\Downloads\AssertCompare.7z

                                Filesize

                                361KB

                                MD5

                                9ffd3a29159f22374ea098a6ae3736b0

                                SHA1

                                7f33662ccbfc3c0fb3f71aaddb55b2c2113d4534

                                SHA256

                                a71c83b512caf7d52556c1f4d99fbc4e6600619654ccd4fe29f0b2a4dd1ffe4a

                                SHA512

                                8d1b4dfe54a8ca4e7bc2156b384d9441344ef7000932f64f4787163ebbf9a2ad0a07c002e757da3f3cfaa61ceb199c92accc43ea6c4e5aad2289e849bf3f361d

                              • C:\Users\Admin\Downloads\CheckpointDismount.au

                                Filesize

                                399KB

                                MD5

                                fc4d2007a9240c89b7eecf1b1baadc59

                                SHA1

                                dcbadf1dc15ce2ba91af51484fe309554fdd8bac

                                SHA256

                                91dd5bf9ea768ff755807811d15b48422d66cdfef441998a602de8e5aabd9ff9

                                SHA512

                                89125567cc3957738f75de1f10ed87f436d00cacd0f18eca9cfd77d8d286c2af3dfa4a3ce6e8ce2c7e8147bc3d3a7da07aa133457fb06b87b702d24951c23819

                              • C:\Users\Admin\Downloads\CompareGet.vsdm

                                Filesize

                                342KB

                                MD5

                                a82e97cb054fa2351772dca7376002c9

                                SHA1

                                3170c0093a6508fe944bce8ee3635ee038dced4d

                                SHA256

                                8cadf363fc54c2a28b1f293fc5136c0ee4aeb6051a24294f70fbdd929329da53

                                SHA512

                                18cf72e7c7dfad04513bb085be43bd58825e688debadf64eb1012d12913469b377fa2b0f450d7180859b4097e4ba8c729650732d35da392e4c884c1eede0900f

                              • C:\Users\Admin\Downloads\CompareUnpublish.asx

                                Filesize

                                817KB

                                MD5

                                08efe5cab802435815e699365fffd091

                                SHA1

                                67451ee7d84dc55ec0d43117989eb2a9701db8fd

                                SHA256

                                5953531eb1e7978a9a9f3ebdcdcda0ee2a03080ad193c03cb2dead4d76fe2f0e

                                SHA512

                                9c9d9ab561fb990277809173f33cb86ba4366b98fbd82b008330f94ee8685484b5508fdc7137e9f1bfd58d3d00eea684c907cc3f16efd062952e91d83cd660ac

                              • C:\Users\Admin\Downloads\ConfirmRename.xltx

                                Filesize

                                779KB

                                MD5

                                2cb2dea7345de948694e01b6c2c26708

                                SHA1

                                17e9ebc18f1fe6f06c6855ac661f9f3c4d331975

                                SHA256

                                2ac2e3958b92ad9f69fe6e74982df45ca6b9a683c365eb35bf376308b24045f1

                                SHA512

                                75c644164f83e7bb6d93ef29367b0557247be384b23ca9d9332faf5c0f4b6b5e11e3b02a4297e5c2ca004096b762f531f771abe0d2e4da69e11833cd12bef26a

                              • C:\Users\Admin\Downloads\ConfirmSkip.svgz

                                Filesize

                                665KB

                                MD5

                                a3b39e8c2555b428c42dffc4416cd85c

                                SHA1

                                54facd00578a9d93afa8d8afd0b3ec6436141ba2

                                SHA256

                                4f2553ed90f6cb8c6b9075d60af6c73d15f5cee2680d7c9221cf295193a5781d

                                SHA512

                                434f715eaad1b803fd36b05e443978fd081f40bfc392c72fdf93d2479039b5fe29bd41434b0a8816a8e40dbedf1ac2dc077cb81fa54803914671d45ad18ce15e

                              • C:\Users\Admin\Downloads\ConvertToRegister.vbs

                                Filesize

                                456KB

                                MD5

                                5ca2d14c2f141bd70b19d3fa395a067e

                                SHA1

                                34dbbf1bf54f9011ca8dba4eabeaf4308739ebd6

                                SHA256

                                b706c600375af673add8103a1d2719dc2af3523f242d4c20a40eb8c2d1565c13

                                SHA512

                                cf9413bfa3fd1256ec89ba3b6d21802d2752f80613d70f6c64c7043908e862f84cc88e176483bd7d87e07c89e7724a366a64e197a9f27f41202e96b6d3daf4b8

                              • C:\Users\Admin\Downloads\DebugSplit.png

                                Filesize

                                532KB

                                MD5

                                dbe22b1bc4ae32a224e8b4ae09c48aa4

                                SHA1

                                50c988a43001bffac816436108017b0a690792ca

                                SHA256

                                bba65ac98ab1a39f00cf5c898c609105c0d3b60dfc1d798e09f25f431b6b5099

                                SHA512

                                7db1ff88e665d7ac51c90a60490ba5fbe36685e1f2e99c1f2d51c206d513298d5115eff164018d29f22274f38608e53a3c752e1825d1e530279a877a667055d1

                              • C:\Users\Admin\Downloads\DisableSplit.eprtx

                                Filesize

                                836KB

                                MD5

                                ab0c8f695b3cd9be6cb6c3411121356a

                                SHA1

                                19bfb3d2e39989c67d53ffa1c34baff9a422d393

                                SHA256

                                c0bd24b0d883f2c5840c23935ddc1774359621a7817fa4eedbced77979ed1566

                                SHA512

                                d19c85ca2a11facd41f3d31adfd1791d8e9bbf88b38a9edada7dd6c2b0413128e95f0473c990911e85003f3e92cf2fb9823bbe6dedc236e072814556b7c1ac43

                              • C:\Users\Admin\Downloads\EnableCheckpoint.ttf

                                Filesize

                                570KB

                                MD5

                                9498b8f29f491ca4c8c81cd9288d4534

                                SHA1

                                68b744feed5748467b8f4d21896f6a61f177ad26

                                SHA256

                                af9558b59bcd2d202e72eb3f02eec5e12c4dd7f1c9eab8161a32b319cb9a42bb

                                SHA512

                                1a05ca22ffb6e0b982a5940ad24202265e2e1fdbf259b38d43e5bf330dcc9c4fe68261d209ee64ef4030f8c399180896e60269919ad97b96c5e0f32956b79763

                              • C:\Users\Admin\Downloads\EnableDismount.ocx

                                Filesize

                                380KB

                                MD5

                                f314cc03cc529a64627437d9031623b2

                                SHA1

                                e5b751dd6a002610149df5c7ad735e7c28c9f21b

                                SHA256

                                c1c41dda78db177ab78397d87ffdfa12ad3456c55e2573dea6b98076531e5d79

                                SHA512

                                9d7b75fc8c1e99b63f02cc5fcd8f77e44287a50684d8eb0a0a5e32947b992fa78fcc3dbb09f5c610ec6252c7f63c3966687a43e1bff9d689f4fede493af7ddf1

                              • C:\Users\Admin\Downloads\FormatUpdate.easmx

                                Filesize

                                646KB

                                MD5

                                9405c34f74a2d254ae63591b736eca9c

                                SHA1

                                678b08e105f4ea2e2e93b578758c9c14ad7a66d0

                                SHA256

                                52a03769c191d886e4855642617d1b68c35e5524d552d5b4f0c012c50304a1d7

                                SHA512

                                31845eddc4e448fd2ad91910ea51c77734975e00dead88eccb910605aa85fefbb209513497cdf2b74b025b9c5178d470b53460d118261ee34d437d9a9bf6ae7a

                              • C:\Users\Admin\Downloads\HideUnprotect.avi

                                Filesize

                                760KB

                                MD5

                                15e9ebf26b5ee398c6f47864cd053279

                                SHA1

                                6d899cccafab8ae4c24c00ef14d1bdfabe3f2bb5

                                SHA256

                                cd1d5d25e79401cc7ea99e8a67e581b2b0db01923c8d054a3e3ed9d9d127e3b5

                                SHA512

                                62ff5db254dc7a310fdbdb4683aff5f7acc9e1d8276815974ef21a62a5c4c08950f313e789a9d5db1edda0ff7810dea13e058865985a590b21a365b7a8c2823a

                              • C:\Users\Admin\Downloads\HideUpdate.tmp

                                Filesize

                                304KB

                                MD5

                                a9c108978fd013bfe0205bd2eb09781a

                                SHA1

                                626b84f09b4287da06f0843c554e6ad5f2d54ed4

                                SHA256

                                d1bd221ec28d6d9579445070450219cf4d3099a329edec5a112f45e2a2bfde38

                                SHA512

                                dec2d42d56ef69884b767bfef7525ad229836e271985c455f5b6da26f72c49c9d23d8920158d8b265b96b42e5fab9e0e96321c57a1db4f0f46f7908b80a958c4

                              • C:\Users\Admin\Downloads\ImportSave.rtf

                                Filesize

                                589KB

                                MD5

                                4c8d261bcde1aa2dfac3de375d275236

                                SHA1

                                bb1980ce4c41908439bfb04f2f7605e79afcd8b4

                                SHA256

                                5eaaca4cdd76a52ed645d4bb6f5ed4151284ee3afe349262096344e9027decac

                                SHA512

                                59632d0210b3475b3950c5d22f6d26e67307ff0f8d2d190504e3628ab5abc2e82bde0feec5b3aa2d9bc1c3c47aa2a18b1590b0f9222dbe541bb882468c7e383e

                              • C:\Users\Admin\Downloads\InvokeUnprotect.M2V

                                Filesize

                                551KB

                                MD5

                                6127fd21a42f94d15bc4e7ff7aac606c

                                SHA1

                                831f7f79a4033a28125202ac702269f4f54dbefa

                                SHA256

                                f8e250759c26fb005573b94fc03b903170bfc00b1d2ab22d5036564fc0e2907b

                                SHA512

                                a917ba38276836e32bce4db2bd4824f3c951897b2217840cae94133a3d5cb368ca86f65639ea7fc934166f478d5935017b1ba67af3f5327e1611fb3f6e80c8a7

                              • C:\Users\Admin\Downloads\LockSync.jtx

                                Filesize

                                627KB

                                MD5

                                319ee3a454068b22e15f473b382f0a29

                                SHA1

                                ffeb45b400be9b1d4c281a8bfe404a0fb6e0a14a

                                SHA256

                                99ccd45fb39b7852fcd614f7a5dd1e5fdc352a04d62abf2d87f20a423bfe83ed

                                SHA512

                                05389f7945d2513e1ff07ab003a404445b54eae90d7f16646519dcb2dc4b79a67cab9c7be4cc22888f931065c4af0f7120532595a7471206ca17d371ef72ab97

                              • C:\Users\Admin\Downloads\MeasureFind.tmp

                                Filesize

                                475KB

                                MD5

                                37c07e7a292066387b5014d21af8cdd2

                                SHA1

                                739e6e886cba7c365d8691680c156103fb20f341

                                SHA256

                                a5ffd7992400709db3837497afb51515895b816f98a744352adab17b4ba259f8

                                SHA512

                                b0822cd246519944917f218a17cea944d04eb6af36c31aacf58b5aed5c747ec65e0e37377abe5a5e25df0bba2190008668c81bcf06bbdb979d78c8edd991595b

                              • C:\Users\Admin\Downloads\MeasureFormat.kix

                                Filesize

                                494KB

                                MD5

                                8f847e106b1c758bd8b0b49c18b5cd57

                                SHA1

                                1ed7dab6ad566f6cf1c9c90a10d53009d61ffad6

                                SHA256

                                a3b415702f922b5b12bd0c98e234ac8e4f7e6a82a7cc299cf9a4471579e8871d

                                SHA512

                                c1bc3b61a18f7c7bd2baca7992aad390f0324c7ee3b991eea530020dc8c26194b9b60e13d11104b0166461ac5ca7a7d1eed44a44542b037883e103d397d615e0

                              • C:\Users\Admin\Downloads\MergePush.xml

                                Filesize

                                741KB

                                MD5

                                edfb32657f0ffa388c4d1bc88ffe1226

                                SHA1

                                4672e329de1c7bd05af1343b974080143da4f0f0

                                SHA256

                                d437d33127d9a43e0025e641c16236d192bba404621e6b0eee1a0c5e1307b57a

                                SHA512

                                c49d074b820e5e97d4d4e0535f737c62ce162935ae294f7ebcd03f4abf3c239be4c532d77281f494778d85e21888d395c947b721fe51520e6344f538a04aaedd

                              • C:\Users\Admin\Downloads\MountStart.mpe

                                Filesize

                                437KB

                                MD5

                                11ccac99cba806efb84a419d658f78e7

                                SHA1

                                2a508dd275ac4b0f1dca958a157a688606149856

                                SHA256

                                80a6c2d1ff78c2d159fbfc8f6d83398ca51be3f3ed45b5beb4640c937a3ae232

                                SHA512

                                8aa2e4cacbca29f6796cc9748167458ef5fffbf9530a48501931995bd69c7f790f1ccadcb4eaaa42f6cf2db047f49317617faac880d7dbe699bdfec5cb2f5625

                              • C:\Users\Admin\Downloads\PublishCompress.xlsm

                                Filesize

                                722KB

                                MD5

                                51bf80e29d82fba77b35254cc1182665

                                SHA1

                                428d86247df2692aa641fbedb12a65de1e5d7448

                                SHA256

                                12f15b470b808b005d82004e99355e44eeb51ea0bf84160525e16c397f9308af

                                SHA512

                                35c9fba5d56fd28dab6b5130fabdefbcf939506697d66074b3688c4a787d8ab0225683f2748908208a19519fa3609b9a31c4f56be4ff8e2b6001a5ae07199227

                              • C:\Users\Admin\Downloads\ReadAdd.xps

                                Filesize

                                608KB

                                MD5

                                79c0ab53385e9edde140b4255784e669

                                SHA1

                                4b9361ab66324559a123c9f697b06a033175a198

                                SHA256

                                280111b3e24c06c21281ab21418304bc19d14e3f7c68a1b2d12cbfc0116344c3

                                SHA512

                                d13258c37d8e5c99636aa6386d8c9744ee4aaadb2c578e4f0752a98eff4f9379a7d3d88a228d4d183367fe0154ee213f1dece0495c47114d2e36f15cbb6442b3

                              • C:\Users\Admin\Downloads\RedoTest.hta

                                Filesize

                                323KB

                                MD5

                                562d56d9a037da8bc2cfeb5baff89cd9

                                SHA1

                                1abc6df23a0579bfd5af45fec79c001b8490d78b

                                SHA256

                                a7d188a17d7356102d8c1ee35550c7fe293edb91666a364c55338032f26e1450

                                SHA512

                                b63561add1cecc966a18954c253240293984afb2efa96887f5fed6383dd12e437a0cf52e0b6bc50a3026c561d9290948b4c8b71be998ff5061e2ebab16c08b1a

                              • C:\Users\Admin\Downloads\RestartSubmit.raw

                                Filesize

                                874KB

                                MD5

                                8a2bd43325d846594e8a839bb99d9382

                                SHA1

                                c3f8f5342a588449ed5bd41f45f6b3dc3d887991

                                SHA256

                                0f616eec2ecb9734b71f01ea88773e64fa2c0dbbd650775509a22f4c27f6788a

                                SHA512

                                dee216c37839e07985ea403741a1307cb70cdcfe37ef046a0e077daf15d94f302c72cf1587062ade9bc81c5276dc39f3b94be3389f7ab7af0b075a54e337ebd9

                              • C:\Users\Admin\Downloads\SplitStep.aif

                                Filesize

                                798KB

                                MD5

                                827c9e1be54e767b25c4e6214f8969e6

                                SHA1

                                52bb798a03e25aab65ce113a762893f60c81b846

                                SHA256

                                afd04dc9870e1d02788a4256f895858eafe623784ba6b9bdd9e52eeac6c234a5

                                SHA512

                                5e9eccd7d3b852b7c9d2b7020c392759682d9c11edec41cd6c9577c5f377bde522f9b77d61c6f71555d6102e82eb5e6e863d2981dfa19e618150dddb3edb4136

                              • C:\Users\Public\Desktop\Adobe Reader 9.lnk

                                Filesize

                                1KB

                                MD5

                                a7e6f9a905255c07b98a47206e73b9ea

                                SHA1

                                d54bd8f1dbca16960beead2808513c5e705a85fa

                                SHA256

                                b74fed1daf0786bbc39a00202271c7b89af39584dd5034960f689480c9c3f7ca

                                SHA512

                                fa34d41ccb76be323c31b3a411ea4b8f385ed86d2e8c13fa6d55c643f2cb4f37798cba5d6a50dba07395d86d01ae6e83c9a1a4a8be12f374b4c661bff2ba2ffd

                              • C:\Users\Public\Desktop\Firefox.lnk

                                Filesize

                                931B

                                MD5

                                ef42e7d5b292343b11e0df6184bb43e2

                                SHA1

                                678d60fb4054f7bf36bde8ee17814e3ca69fce59

                                SHA256

                                9c24db9d276fb86b8f19607a294c715bcca6edfa4f5099dd05254f267fd1273b

                                SHA512

                                863e03a98fe54891f690784a56d0b10dbd9f783e44163566cd37ecbf094f8638ac2e87f2b71f40418e1bbc33fc7000b73f69bf0fd1f24d54fb0c2dbe48c7b4f3

                              • C:\Users\Public\Desktop\Google Chrome.lnk

                                Filesize

                                2KB

                                MD5

                                bb1a9fe6e9e20792d7527fce8b25057b

                                SHA1

                                67d7e940d16430d21044820b37c6fc047df196f4

                                SHA256

                                fe95ad2ce6e4d5b092517310901649f3f2e227977620a3a7f9bc2d7ee74a0a67

                                SHA512

                                849571e81d2d02dbb8e3e4edf662ca1f6d5a1ea012063cb0048d24f8593c556d9d47561c21c2fc170c447b21d5b4012e2fbb0eee4200d3aac4f501d7016a8e1d

                              • C:\Users\Public\Desktop\VLC media player.lnk

                                Filesize

                                878B

                                MD5

                                5d7728add5ea07795a24028b434a40a5

                                SHA1

                                47f54c2b8fcf108314dfbd6d41a62cbd52ed1de5

                                SHA256

                                d8f87d74f4e3630b909aca5c8ac2c3092bc71bc323c27773f0e1b58ab0ebdd5a

                                SHA512

                                d401d23cd4e8097980c72ad5d6240427020fe1d45224fb81b2e2137692ec71d23148c73d14435e88e3a41806a35055c7426ddb6feb1b15f5c49cd7dbada0c415

                              • memory/2916-0-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

                                Filesize

                                4KB

                              • memory/2916-3-0x0000000074A80000-0x000000007516E000-memory.dmp

                                Filesize

                                6.9MB

                              • memory/2916-2-0x0000000074A80000-0x000000007516E000-memory.dmp

                                Filesize

                                6.9MB

                              • memory/2916-1-0x0000000000E00000-0x0000000000ECE000-memory.dmp

                                Filesize

                                824KB