exelastealer | hxxps://workupload[.]com/file/dxBTQqwMGr2

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2024 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://workupload.com/file/dxBTQqwMGr2

Score

10^/10

exelastealer collection credential_access defense_evasion discovery evasion persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5436	netsh.exe
224	netsh.exe
5544	netsh.exe
4180	netsh.exe

Clipboard Data 1 TTPs 4 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4812	cmd.exe
5936	powershell.exe
4588	cmd.exe
740	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
6048	karma.exe
4992	karma.exe
2252	karma.exe
3384	karma.exe

Loads dropped DLL 62 IoCs

pid	Process
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
4992	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe
3384	karma.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4992-283-0x00007FFC5A8C0000-0x00007FFC5AEA8000-memory.dmp	upx
behavioral1/memory/4992-285-0x00007FFC74130000-0x00007FFC7413F000-memory.dmp	upx
behavioral1/memory/4992-284-0x00007FFC6CE90000-0x00007FFC6CEB4000-memory.dmp	upx
behavioral1/memory/4992-287-0x00007FFC72400000-0x00007FFC7240D000-memory.dmp	upx
behavioral1/memory/4992-286-0x00007FFC6CDB0000-0x00007FFC6CDC9000-memory.dmp	upx
behavioral1/memory/4992-288-0x00007FFC6CBF0000-0x00007FFC6CC09000-memory.dmp	upx
behavioral1/memory/4992-289-0x00007FFC6A2B0000-0x00007FFC6A2DD000-memory.dmp	upx
behavioral1/memory/4992-291-0x00007FFC56930000-0x00007FFC56AA3000-memory.dmp	upx
behavioral1/memory/4992-290-0x00007FFC5B160000-0x00007FFC5B183000-memory.dmp	upx
behavioral1/memory/4992-292-0x00007FFC5B130000-0x00007FFC5B15E000-memory.dmp	upx
behavioral1/memory/4992-295-0x00007FFC5A8C0000-0x00007FFC5AEA8000-memory.dmp	upx
behavioral1/memory/4992-296-0x00007FFC56300000-0x00007FFC56675000-memory.dmp	upx
behavioral1/memory/4992-293-0x00007FFC56F20000-0x00007FFC56FD8000-memory.dmp	upx
behavioral1/memory/4992-298-0x00007FFC6C9F0000-0x00007FFC6CA05000-memory.dmp	upx
behavioral1/memory/4992-297-0x00007FFC6CE90000-0x00007FFC6CEB4000-memory.dmp	upx
behavioral1/memory/4992-299-0x00007FFC5B110000-0x00007FFC5B122000-memory.dmp	upx
behavioral1/memory/4992-300-0x00007FFC5B0F0000-0x00007FFC5B104000-memory.dmp	upx
behavioral1/memory/4992-302-0x00007FFC5A8A0000-0x00007FFC5A8B4000-memory.dmp	upx
behavioral1/memory/4992-301-0x00007FFC6CDB0000-0x00007FFC6CDC9000-memory.dmp	upx
behavioral1/memory/4992-303-0x00007FFC561E0000-0x00007FFC562FC000-memory.dmp	upx
behavioral1/memory/4992-305-0x00007FFC570A0000-0x00007FFC570C2000-memory.dmp	upx
behavioral1/memory/4992-304-0x00007FFC6CBF0000-0x00007FFC6CC09000-memory.dmp	upx
behavioral1/memory/4992-307-0x00007FFC700A0000-0x00007FFC700B7000-memory.dmp	upx
behavioral1/memory/4992-315-0x00007FFC5B130000-0x00007FFC5B15E000-memory.dmp	upx
behavioral1/memory/4992-318-0x00007FFC6C8D0000-0x00007FFC6C8EE000-memory.dmp	upx
behavioral1/memory/4992-317-0x00007FFC56300000-0x00007FFC56675000-memory.dmp	upx
behavioral1/memory/4992-314-0x00007FFC75D90000-0x00007FFC75D9A000-memory.dmp	upx
behavioral1/memory/4992-313-0x00007FFC56F20000-0x00007FFC56FD8000-memory.dmp	upx
behavioral1/memory/4992-312-0x00007FFC6C8F0000-0x00007FFC6C901000-memory.dmp	upx
behavioral1/memory/4992-311-0x00007FFC56930000-0x00007FFC56AA3000-memory.dmp	upx
behavioral1/memory/4992-310-0x00007FFC5B160000-0x00007FFC5B183000-memory.dmp	upx
behavioral1/memory/4992-309-0x00007FFC6CA90000-0x00007FFC6CADD000-memory.dmp	upx
behavioral1/memory/4992-308-0x00007FFC70080000-0x00007FFC70099000-memory.dmp	upx
behavioral1/memory/4992-306-0x00007FFC6A2B0000-0x00007FFC6A2DD000-memory.dmp	upx
behavioral1/memory/4992-319-0x00007FFC6C9F0000-0x00007FFC6CA05000-memory.dmp	upx
behavioral1/memory/4992-320-0x00007FFC552E0000-0x00007FFC559D5000-memory.dmp	upx
behavioral1/memory/4992-321-0x00007FFC5B2E0000-0x00007FFC5B318000-memory.dmp	upx
behavioral1/memory/4992-394-0x00007FFC725D0000-0x00007FFC725DD000-memory.dmp	upx
behavioral1/memory/4992-411-0x00007FFC561E0000-0x00007FFC562FC000-memory.dmp	upx
behavioral1/memory/4992-412-0x00007FFC5A8C0000-0x00007FFC5AEA8000-memory.dmp	upx
behavioral1/memory/4992-439-0x00007FFC570A0000-0x00007FFC570C2000-memory.dmp	upx
behavioral1/memory/4992-438-0x00007FFC725D0000-0x00007FFC725DD000-memory.dmp	upx
behavioral1/memory/4992-437-0x00007FFC5B2E0000-0x00007FFC5B318000-memory.dmp	upx
behavioral1/memory/4992-432-0x00007FFC6CA90000-0x00007FFC6CADD000-memory.dmp	upx
behavioral1/memory/4992-431-0x00007FFC70080000-0x00007FFC70099000-memory.dmp	upx
behavioral1/memory/4992-430-0x00007FFC700A0000-0x00007FFC700B7000-memory.dmp	upx
behavioral1/memory/4992-425-0x00007FFC5B110000-0x00007FFC5B122000-memory.dmp	upx
behavioral1/memory/4992-424-0x00007FFC6C9F0000-0x00007FFC6CA05000-memory.dmp	upx
behavioral1/memory/4992-420-0x00007FFC56930000-0x00007FFC56AA3000-memory.dmp	upx
behavioral1/memory/4992-413-0x00007FFC6CE90000-0x00007FFC6CEB4000-memory.dmp	upx
behavioral1/memory/4992-436-0x00007FFC552E0000-0x00007FFC559D5000-memory.dmp	upx
behavioral1/memory/4992-457-0x00007FFC56F20000-0x00007FFC56FD8000-memory.dmp	upx
behavioral1/memory/4992-464-0x00007FFC570A0000-0x00007FFC570C2000-memory.dmp	upx
behavioral1/memory/4992-459-0x00007FFC6C9F0000-0x00007FFC6CA05000-memory.dmp	upx
behavioral1/memory/4992-458-0x00007FFC56300000-0x00007FFC56675000-memory.dmp	upx
behavioral1/memory/4992-447-0x00007FFC5A8C0000-0x00007FFC5AEA8000-memory.dmp	upx
behavioral1/memory/4992-456-0x00007FFC5B130000-0x00007FFC5B15E000-memory.dmp	upx
behavioral1/memory/4992-502-0x00007FFC72400000-0x00007FFC7240D000-memory.dmp	upx
behavioral1/memory/4992-501-0x00007FFC74130000-0x00007FFC7413F000-memory.dmp	upx
behavioral1/memory/4992-512-0x00007FFC6C8D0000-0x00007FFC6C8EE000-memory.dmp	upx
behavioral1/memory/4992-522-0x00007FFC6CA90000-0x00007FFC6CADD000-memory.dmp	upx
behavioral1/memory/4992-521-0x00007FFC70080000-0x00007FFC70099000-memory.dmp	upx
behavioral1/memory/4992-520-0x00007FFC700A0000-0x00007FFC700B7000-memory.dmp	upx
behavioral1/memory/4992-519-0x00007FFC570A0000-0x00007FFC570C2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
99	discord.com
100	discord.com
101	discord.com
102	discord.com
105	discord.com
121	discord.com
98	discord.com
120	discord.com
122	discord.com
123	discord.com
124	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
93	ip-api.com

Network Service Discovery 1 TTPs 4 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1424	cmd.exe
5424	ARP.EXE
3856	cmd.exe
1880	ARP.EXE

Enumerates processes with tasklist 1 TTPs 10 IoCs

discovery

Process Discovery

T1057

pid	Process
3352	tasklist.exe
5280	tasklist.exe
6132	tasklist.exe
5236	tasklist.exe
5420	tasklist.exe
5136	tasklist.exe
1260	tasklist.exe
4300	tasklist.exe
4280	tasklist.exe
5256	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1456	cmd.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3108	sc.exe
1624	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5260	cmd.exe
1644	netsh.exe
5116	cmd.exe
5568	netsh.exe

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5420	NETSTAT.EXE
4084	NETSTAT.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Collects information from the system 1 TTPs 2 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
4504	WMIC.exe
4364	WMIC.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4944	WMIC.exe
5780	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4448	ipconfig.exe
5420	NETSTAT.EXE
3420	ipconfig.exe
4084	NETSTAT.EXE

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5636	systeminfo.exe
1600	systeminfo.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
4368	taskkill.exe
3964	taskkill.exe
1552	taskkill.exe
4764	taskkill.exe
6000	taskkill.exe
4024	taskkill.exe
1868	taskkill.exe
5776	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1960	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
1748	msedge.exe
1748	msedge.exe
4224	identity_helper.exe
4224	identity_helper.exe
3672	msedge.exe
3672	msedge.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
5936	powershell.exe
5936	powershell.exe
5936	powershell.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
740	powershell.exe
740	powershell.exe
740	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	6128	7zG.exe
Token: 35	6128	7zG.exe
Token: SeSecurityPrivilege	6128	7zG.exe
Token: SeSecurityPrivilege	6128	7zG.exe
Token: SeIncreaseQuotaPrivilege	4944	WMIC.exe
Token: SeSecurityPrivilege	4944	WMIC.exe
Token: SeTakeOwnershipPrivilege	4944	WMIC.exe
Token: SeLoadDriverPrivilege	4944	WMIC.exe
Token: SeSystemProfilePrivilege	4944	WMIC.exe
Token: SeSystemtimePrivilege	4944	WMIC.exe
Token: SeProfSingleProcessPrivilege	4944	WMIC.exe
Token: SeIncBasePriorityPrivilege	4944	WMIC.exe
Token: SeCreatePagefilePrivilege	4944	WMIC.exe
Token: SeBackupPrivilege	4944	WMIC.exe
Token: SeRestorePrivilege	4944	WMIC.exe
Token: SeShutdownPrivilege	4944	WMIC.exe
Token: SeDebugPrivilege	4944	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4944	WMIC.exe
Token: SeRemoteShutdownPrivilege	4944	WMIC.exe
Token: SeUndockPrivilege	4944	WMIC.exe
Token: SeManageVolumePrivilege	4944	WMIC.exe
Token: 33	4944	WMIC.exe
Token: 34	4944	WMIC.exe
Token: 35	4944	WMIC.exe
Token: 36	4944	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1956	WMIC.exe
Token: SeSecurityPrivilege	1956	WMIC.exe
Token: SeTakeOwnershipPrivilege	1956	WMIC.exe
Token: SeLoadDriverPrivilege	1956	WMIC.exe
Token: SeSystemProfilePrivilege	1956	WMIC.exe
Token: SeSystemtimePrivilege	1956	WMIC.exe
Token: SeProfSingleProcessPrivilege	1956	WMIC.exe
Token: SeIncBasePriorityPrivilege	1956	WMIC.exe
Token: SeCreatePagefilePrivilege	1956	WMIC.exe
Token: SeBackupPrivilege	1956	WMIC.exe
Token: SeRestorePrivilege	1956	WMIC.exe
Token: SeShutdownPrivilege	1956	WMIC.exe
Token: SeDebugPrivilege	1956	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1956	WMIC.exe
Token: SeRemoteShutdownPrivilege	1956	WMIC.exe
Token: SeUndockPrivilege	1956	WMIC.exe
Token: SeManageVolumePrivilege	1956	WMIC.exe
Token: 33	1956	WMIC.exe
Token: 34	1956	WMIC.exe
Token: 35	1956	WMIC.exe
Token: 36	1956	WMIC.exe
Token: SeDebugPrivilege	1260	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4944	WMIC.exe
Token: SeSecurityPrivilege	4944	WMIC.exe
Token: SeTakeOwnershipPrivilege	4944	WMIC.exe
Token: SeLoadDriverPrivilege	4944	WMIC.exe
Token: SeSystemProfilePrivilege	4944	WMIC.exe
Token: SeSystemtimePrivilege	4944	WMIC.exe
Token: SeProfSingleProcessPrivilege	4944	WMIC.exe
Token: SeIncBasePriorityPrivilege	4944	WMIC.exe
Token: SeCreatePagefilePrivilege	4944	WMIC.exe
Token: SeBackupPrivilege	4944	WMIC.exe
Token: SeRestorePrivilege	4944	WMIC.exe
Token: SeShutdownPrivilege	4944	WMIC.exe
Token: SeDebugPrivilege	4944	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4944	WMIC.exe
Token: SeRemoteShutdownPrivilege	4944	WMIC.exe
Token: SeUndockPrivilege	4944	WMIC.exe
Token: SeManageVolumePrivilege	4944	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1880	1748	msedge.exe	85
PID 1748 wrote to memory of 1880	1748	msedge.exe	85
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 4380	1748	msedge.exe	86
PID 1748 wrote to memory of 2016	1748	msedge.exe	87
PID 1748 wrote to memory of 2016	1748	msedge.exe	87
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88
PID 1748 wrote to memory of 2284	1748	msedge.exe	88

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3352	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://workupload.com/file/dxBTQqwMGr2
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6c5646f8,0x7ffc6c564708,0x7ffc6c564718
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4653097586474431165,9066851484538635958,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,4653097586474431165,9066851484538635958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,4653097586474431165,9066851484538635958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1888 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4653097586474431165,9066851484538635958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4653097586474431165,9066851484538635958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4653097586474431165,9066851484538635958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4653097586474431165,9066851484538635958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,4653097586474431165,9066851484538635958,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4653097586474431165,9066851484538635958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4653097586474431165,9066851484538635958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4653097586474431165,9066851484538635958,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4653097586474431165,9066851484538635958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4653097586474431165,9066851484538635958,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4653097586474431165,9066851484538635958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,4653097586474431165,9066851484538635958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4024

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5624

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\karma\" -spe -an -ai#7zMap7673:72:7zEvent9033
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6128

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\karma\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1960

C:\Users\Admin\Desktop\karma\karma.exe
"C:\Users\Admin\Desktop\karma\karma.exe"
1⤵
- Executes dropped EXE
PID:6048
- C:\Users\Admin\Desktop\karma\karma.exe
  "C:\Users\Admin\Desktop\karma\karma.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:6092
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:4944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    PID:3852
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:3708
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    PID:5548
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:4500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:5376
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5556
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1456
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Views/modifies file attributes
      PID:3352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    PID:3940
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:5204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6076
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1748"
    3⤵
    PID:1960
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1748
      4⤵
      Kills process with taskkill
      PID:4024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1880"
    3⤵
    PID:2288
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1880
      4⤵
      Kills process with taskkill
      PID:1868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4380"
    3⤵
    PID:5596
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4380
      4⤵
      Kills process with taskkill
      PID:5776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2016"
    3⤵
    PID:3168
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2016
      4⤵
      Kills process with taskkill
      PID:4368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2284"
    3⤵
    PID:852
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2284
      4⤵
      Kills process with taskkill
      PID:3964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3184"
    3⤵
    PID:4768
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3184
      4⤵
      Kills process with taskkill
      PID:1552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3612"
    3⤵
    PID:4776
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3612
      4⤵
      Kills process with taskkill
      PID:4764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5956"
    3⤵
    PID:5128
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5956
      4⤵
      Kills process with taskkill
      PID:6000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:3952
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:2860
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:5196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:1160
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:5116
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:4280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:3540
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:5936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:1424
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1600
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:2816
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:4504
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:5784
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:5596
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:2900
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:3268
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:1252
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:4436
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:3460
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:5304
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:5852
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:5848
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:5772
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:5844
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:5220
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:5256
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:4448
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:3704
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:5424
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:5420
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:3108
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5436
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5260
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4988
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:216
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1140

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:2112

C:\Users\Admin\Desktop\karma\karma.exe
"C:\Users\Admin\Desktop\karma\karma.exe"
1⤵
- Executes dropped EXE
PID:2252
- C:\Users\Admin\Desktop\karma\karma.exe
  "C:\Users\Admin\Desktop\karma\karma.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:1248
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:5780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    PID:5588
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      PID:5844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:5512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:1444
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    PID:4448
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:3208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:5460
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:1264
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    PID:5436
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:2608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:4408
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:6012
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:5132
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:3992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:4320
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:1968
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:5904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:4220
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5116
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:3856
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5636
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:5112
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:4364
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:5604
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:4072
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:4812
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:4196
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:1720
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:4908
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:956
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:5068
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:1868
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:2624
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:1096
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:6136
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:2916
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:5236
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:3420
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:4240
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:1880
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:4084
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:1624
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5544
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:5564
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:5212
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
6a6042920f15b42d43a0208663dfcd1f

SHA1
560f9425d5ab64291f2e534418359cdf9a3d9b26

SHA256
67a10d6c1d4fabada07cb972ebb22ae10c078f765e426223145c66316ef144b2

SHA512
5389f50c103e6dad1abae00f2d34651fefa2bd37649c0a5c9858cd44873a215929cd77324b911ec1bd52e0e97403ae7613592a2c38db7319cb38ee55ac08e3d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c091081c07bf3fd6f29b636fdd31bef4

SHA1
3856f12da234fa7530242115ffab603c7de295e8

SHA256
16a93fb1bb8aef0d926d0d2a27f1e62acb8bdb053fbd5421b77c0f2d50994223

SHA512
aba5f8244aa51ead85503b9d7bf05ac3941f78a0520bcea2ba9890e23a890046131e00ce807e717ebbb683e0d81d60ec38bf5d6afa42978b904c04f7b7977f25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb3d600d782f30f77e229ace0c26eaa1

SHA1
53f502abca02db067845471da8ea76a4fa85d0fa

SHA256
f063caa6dbfbf2eea8fc11f8eca0b32668d7cba00164b26dce632cb635e485b5

SHA512
6db85d12c115964ad6ccf1f86206f931db416e019de23ddc5bc77990be7e6e6a0ab53afca6b24078c742649807ed241e76fb0b4d42f4995c9a9864f9508c831c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e6153f27b94bfe00fcf5109e0def6264

SHA1
5ac4a3224a2c6f15114d22ef05144f4e175faf21

SHA256
8446d41f73c093e6054c981a25989a8ddefc60c637e8bf0b59d9c259929779c0

SHA512
1d4ba7b54323f7bd2e6d70fd9319ff54e7b51a9d3e57657ab8a7a50ee08cb000d203e82cfe26be49b40b03b29de7fcad353f4f4db377959552553aeb16a0f7c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1df19c6d73bbd503c48e702bdea7f221

SHA1
f26058ca10ab77cfda39ac47cfe59f41a1619387

SHA256
e643487cfebde8fe1e1d6532d3563871f1f8d3b23bbb3306e835c9174ec6c9c6

SHA512
d4ec07b00aeb13249b31aa5afad3cadb8e3644f6489f4578a94ce604ea9c43602d2fe7d7ee8daa7e2de7c9f2decb082745c0cc8ca1a8c2ea15f1694860b9d6eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
552a4fcb049131cd1095f8f3f5060a89

SHA1
cba385031a59f1a5848e12ae28b71d138a1aadaf

SHA256
b43df172dd421464acdcf7e39be840ce5f2130b41a67a1f6adcba5745611cbdf

SHA512
d76ff25612ffae29e2ee9c1df919de13ff895ed228ba2441155b42224f19ba1a8e5b6f0a676a33a229172d9835fffffbc8687b972a3fb0bd4d3329e2fecf1514

Download Submit
C:\Users\Admin\AppData\Local\Temp\HistoryData.db

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\HistoryData.db

Filesize
124KB

MD5
51ccca21dc4b1af0b3c9d229756c0d9e

SHA1
36b6debf00111c792a367df112bd8b72daa7feab

SHA256
9bd7f4255101c8a8f4ff65a410e857f0b837ba19df731f66cbda1788890676a2

SHA512
a0829057a0d41f1692ab2aa1000ac91f074bff277ddb2c9362b122782037054d9ac1c679d2c862d5c45dfbe53e63a863abe5d2e55a965ece1a7fd6809e80efc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Web.db

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Web.db

Filesize
114KB

MD5
c3311360e96fcf6ea559c40a78ede854

SHA1
562ada1868020814b25b5dbbdbcb5a9feb9eb6ba

SHA256
9372c1ee21c8440368f6dd8f6c9aeda24f2067056050fab9d4e050a75437d75b

SHA512
fef308d10d04d9a3de7db431a9ab4a47dc120bfe0d7ae7db7e151802c426a46b00426b861e7e57ac4d6d21dde6289f278b2dbf903d4d1d6b117e77467ab9cf65

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wb5vlj0v.awe.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\ApproveMeasure.ppt

Filesize
1000KB

MD5
a1c88acec6ca87ea4b6c56646071d0da

SHA1
8626598617d84290e9755cf579710e8f4684c8da

SHA256
79d6133e32ae0659a5446a8b05323156ac59aea8a66878e2446b1ee302d09bba

SHA512
cb98633de564e862d3ac3ee4c340c429eaf727769dc4972dfa437c602cee225e5154356808921776126a903fe45ad830049e00e7a128ec4102b26a750afff831

Download Submit
C:\Users\Admin\Desktop\AssertSend.vsd

Filesize
1.7MB

MD5
2873a10e077240626d9cc21464ffaed3

SHA1
df7db0d8a8da2e855416eaded7a4dc61a1242184

SHA256
8b5c5bf1543b58b554ee1af45bc382432cb0be05f8f6641abd13c304014219ae

SHA512
e53d82251ac1f87f4289731a5175c0756594eeb086a49ee01cb56ce7123bd7f7cb5a52f4295fc11e89b53f754103ae5ec5f9299c433541688f5a4105ee8b31f7

Download Submit
C:\Users\Admin\Desktop\BlockConfirm.WTV

Filesize
565KB

MD5
a9b59096064fe90413cdcda18cf960a4

SHA1
6f2c9070f1110895ffad8e0254bc1e45fe2580bc

SHA256
fa20dc57205f7fba573fb15f54868665b161afb61dcefe46d3eb12db07839462

SHA512
e57c3d5b711bf357981a1f9785af8308cb8cf78333b314cba9f12a2c65183f9076ea272bdd03c1d84d86f57679ef2edcae7f770136710cb8b7bbae973401c73a

Download Submit
C:\Users\Admin\Desktop\CloseFind.xml

Filesize
1.0MB

MD5
959ee6abe374b28caeb79a90e18882a8

SHA1
51469a628a7e6587489e2e3243bda9df0e3e96c1

SHA256
07ff457f800ca4e5140e1eb32eb14d322156fe9225d27eb3ec895fbaf3cd9e7b

SHA512
838a0c800910e3fea54885baf431ba5411aba576dd9c03f1f5e5cf05157c05569d44d53c01e2370b54925c62112d819ce7ad9699c605ddf56f29afb4eefe4561

Download Submit
C:\Users\Admin\Desktop\ConvertFromUse.mp2v

Filesize
826KB

MD5
8382f9fe7f2260766cb7bd1cfdd75b4a

SHA1
cffc131b103b8046ae542f34e2d0d7ca2b2b3144

SHA256
3ebc8bf69b21397b709f6251dd63561a98ca35128ca494bc7558ab076a9d1f36

SHA512
d8b4c1a35ea2f3c97f4c53d48f727974be6f2c51ef1c7cd9815a4d6e361f0d471d94223b4dc431ee739209c4b6f23789d0107112504bd6919033473ad6a1643d

Download Submit
C:\Users\Admin\Desktop\ConvertJoin.xlsx

Filesize
10KB

MD5
b00bb7934022aab35fb68aa32f3c3f19

SHA1
9cd4f981920c7c12f5f8fc7b51c4f6f06dbe89c5

SHA256
949b57669613036711a476403bd4151369d1e2471d72e9c865293c77e03bcec3

SHA512
ea5247d6f9055190bc45ee6626dd5c460db9f72164eb72d1dd7044aaa284b0281dd99a3af9941fd2dbfe04fb74c2ead2ec12c245eacee3fb16ea224023783901

Download Submit
C:\Users\Admin\Desktop\EditCompare.iso

Filesize
913KB

MD5
db47acda105bbd6a5d0b2cb2befce570

SHA1
ed20a0583400df785f0495c9814dd5eb07fd28b1

SHA256
da73d4836975070fe3c198830dcc04d646cc86025f207ac3dfa38abe73a249ae

SHA512
b0a7c6121a066652a6472d57868e97928bfd72260f7bb507efb78dedb3672b3cef9095496c77c34efecdb12396ae8d2105df5bf15052a69be842bdb2234a7cdb

Download Submit
C:\Users\Admin\Desktop\HideUnpublish.dotx

Filesize
435KB

MD5
5bfaa066d54b5ecdeeb18f943b6bee80

SHA1
5e9991b291756387e88a2868db76475338ae93f1

SHA256
bdebc18a0ac4cbdf1c35c5daddda9fe07065e45c330cacdf4aeccaedcb144d60

SHA512
06442705e76ba6fff337c5fe329adba11271436e34e59e66cd962d71f9d57488223f5b79d55497537ecd10578b8a81248454d48164948da3f00829c386613652

Download Submit
C:\Users\Admin\Desktop\InitializeRestart.cab

Filesize
1.1MB

MD5
87b26ccc89f68e69c0e4d4c66dd3fe34

SHA1
21eca13f6a64aa9e5c9d253f8153b1570d41d3a5

SHA256
d1ba001590f5aba35889d856500486a9a8eb228d387bf5359b350cefe4097934

SHA512
8a1a8b0859f4364b8bfa9976f11cf2a6bb60f831ef9c97f767fb6b114e07f5eed7c9cc9bea4ba1c91036c5dda49a01e299ca9723868fece3fd6b286d551b077c

Download Submit
C:\Users\Admin\Desktop\LimitOpen.DVR-MS

Filesize
522KB

MD5
a40993727f4214fdafa07fcbe9d117f1

SHA1
2fe4405d07f9e19c0314d603ef0a35fb90d5fe31

SHA256
45b311b70090fb05dee04c4fbb2bf3c8ffc4c47c28d7d7fc838672396650a7fa

SHA512
6cebe6c511b0066f9d8d8935bb83ffeaca86f6c2a89d35e150c4d4112a9a54d7e7ecc3e078d2fd4af3aae70f41a9b65674a5f65c1b37afb7ba633142f652b8f9

Download Submit
C:\Users\Admin\Desktop\LockMount.vsx

Filesize
870KB

MD5
b1702e6ba70b763345f05aea08749e87

SHA1
0343dfd93407283f79daa6d9fb03804ed342a626

SHA256
11a2023e1faa46274061ea21625fdcdc039322c9a1f0f5386b747d25defaf6ac

SHA512
4df853b90e129c897be89971a0ced33379444a6dc52df1a6dd251f64803554caf22e9423eba6a9bc9aa88fd68ca0637e728c7540378406dc0249f7efb1ae6dd2

Download Submit
C:\Users\Admin\Desktop\OpenProtect.wmv

Filesize
957KB

MD5
e25518ea9f7ee8eef8894d986646041b

SHA1
cc16239aa93b3aadce0034d614c22d21581a0bdc

SHA256
38dfa5054854b094a668c030a81806bab3939c07439f6fa7eec384a95143c5fc

SHA512
0763e8c0d757f99a10981daa9706595eb061983116881bfdbe78f976679de3586f921b9b54d73fb2a9b87b13b4540ad029cb60021346ace34849eb76e86355da

Download Submit
C:\Users\Admin\Desktop\PingRead.edrwx

Filesize
783KB

MD5
b0777dc7e1f5d787bf45195037c52355

SHA1
1fbff9a2fb60f3bec6979b137b2c4b44d2a48487

SHA256
150ef7df747282c5e3e63f041e412a3bb02dac360ba32d3f9ab2fc56bad991e8

SHA512
878249f05cbb699e97bf199d2ffa494b5c471429e08a77d49f3baef0609614af13cd3a96984f2f4194c7151d787285f58edc42b3b84b4bff9801694ef35d846e

Download Submit
C:\Users\Admin\Desktop\RegisterLimit.xml

Filesize
478KB

MD5
f7b3a9f6c1f8c664277fb5cfa2bf6ba7

SHA1
63cdfcf9cd387263ee48d068cb529a2308cd8ab9

SHA256
55eae01009296efe8661605c25df7fba5e454453062818b4291b95bd25df0332

SHA512
0422d9597a526334510e87b7ed5be08182c911a91a1fcc802d6c17aa1befa781f6a6b70830052402bdc4ffbfcc0b69d844fb6bad60e6fa8f3ca4b4a2486e05d4

Download Submit
C:\Users\Admin\Desktop\SaveInitialize.vsx

Filesize
696KB

MD5
8b2ce904cd1a2e493b9f058e3a78ebad

SHA1
74a379494fbdbf4f1601a3a7ef732e4a76a15c91

SHA256
bcc058ab55eff12507abb4b4d4e962ff8f4a04dcc6f43b7eb86804672730d4b7

SHA512
f04ea24194f4c8d18518abdc56afd1ff06a86d1039c20d65f5f910439ec08217e2e699516852884ff1fc4b25817b7528025aa69bbac0a1eb98326c5f03093752

Download Submit
C:\Users\Admin\Desktop\SaveSkip.xlsx

Filesize
13KB

MD5
910152db6fc1fdcbade447fc62f1cc9b

SHA1
33193c3725b85264ed5a4dd65e778d8c7f67423c

SHA256
e0c4b582817464553582799e8db4ba9c7cd7495f59e2e890713ee3fb8692a4d5

SHA512
c6e48d87e5ef0fc7555afc0322f95df4120f34787fae45bdf93890a878865c0f8e95732092b5eb163ec232588a1390b9f5e537e11995b4404a74157eb14dfe1b

Download Submit
C:\Users\Admin\Desktop\ShowConnect.xml

Filesize
1.1MB

MD5
1822b6dd4167e57678095f9e8fbd33d5

SHA1
6626f774a2498c6b1ecd524971988cbe04010d33

SHA256
55150cbaa3b81c87a6ffc4ee74dc7d2a731b8045cc11bb09d8b40f03964eba0a

SHA512
92171d0e213b6be958d342164686c633ea7971e0b61db0a491c7b7864bd11476b0d9261d913990a01c29373500dec8a4d94e058a1b8b6f322e11098005dcdd63

Download Submit
C:\Users\Admin\Desktop\SplitCompare.au3

Filesize
739KB

MD5
a1bbf39bf580865f421379345f119767

SHA1
75b622267881303f4d692d27342e09e2ccbe2b09

SHA256
706f828cf43588247b192f43714823f8ea5dba1e0d81eb84ed2c3edd1fe090f2

SHA512
37a625a5120a06273ee6ec5382f7d0577ae951a993c2bfb852f5ab401c61597bb3335add6dd89f29877080f2fc9b154cf2462fea2cf7c4abbfb7bb2de5c228d5

Download Submit
C:\Users\Admin\Desktop\SplitCompress.xlsb

Filesize
1.1MB

MD5
432bdc74ceaffa3d1077a0eb1683c726

SHA1
813cae2204a2fb43964d7c8732769b89cfc85fe5

SHA256
1cd445e8b2dc0d7010df72315fe49222920f031091bd49e2b3db3eaf92ff921e

SHA512
c79de681d622ecea6f02009a6933d5341198c803724eb97701299f0bbca44366704071e424a20fad31f2f2902a882990d468f34af26f78516c00ae1728e2ad6d

Download Submit
C:\Users\Admin\Desktop\UnlockSelect.clr

Filesize
652KB

MD5
fdf777a5fc9e6c21e52da977935b2f2c

SHA1
c985bcd9e443558b399e24a03a27664ffb7ca077

SHA256
f1330b358a8316dfe45f1e7f7f5a34f4fca2871e4ac08ec3566d63344fce03ba

SHA512
d1fae7096ae06eb57e256fe2b4d032c584cf0ff6352ad03647f0e8fa4cf3eea2a949c2ce2aa88e1d67932b3a0a5edfe5453c9f2ca95fa44b230a6098701a686e

Download Submit
C:\Users\Admin\Desktop\UnprotectSave.3gp

Filesize
609KB

MD5
fe32a310837c406ac651b29384f7b26f

SHA1
fbda6f6d5e8376e368ef2450b2e05a5b27061efa

SHA256
8be70cceef42314962f3466fa4c7861a1d4df3a2f152e16b3270991f215325cf

SHA512
58a71bf17c371dc683ac7ba76159526c1435a51d3907ccc76229335d6cc9b18cdfe407768cd425d0f74eec8e57ec5871cb2934c5d55a99978c03983a204ebb4b

Download Submit
C:\Users\Admin\Desktop\UnregisterLock.tiff

Filesize
1.2MB

MD5
e92a8b42ce21eb72a8e7b2652ef1992d

SHA1
75bafa8a54260e68dd797dd4078e4d034662cf83

SHA256
f30a9152176d643179e2eaa4261c9f94599adcb4f6ec369c85ea5d592797e556

SHA512
312f3784956f9407cdc620d68ebef21f87ba469c757619c923d12a452a066dd4fef1c1adf056c32b62401d60a7ab164e30f2e70943945d4d34274f45d27fc622

Download Submit
C:\Users\Admin\Documents\ApproveUnlock.pptx

Filesize
1.2MB

MD5
e4d0afb62e4a6d616ef6c7942196b7c8

SHA1
96be042c064a6ed1ce41a6c845e9ccb15239384d

SHA256
498abce96360459e33f83f2c61a0034a6361af4408297e87d2ab1865e03ee35e

SHA512
955e620f5976cc7c3f95bad5073e98bf1890d1211eaed763e85b23d79463ab90add0e64a2a321466328682afbeef6d57b54bd10af305ee3c6dea698e4db38812

Download Submit
C:\Users\Admin\Documents\ComparePop.xlsx

Filesize
10KB

MD5
82ac336364801c44604d35133fe28048

SHA1
e51a2074b131bbf7976bdde20da33a1d24f81bca

SHA256
7ac088aa88590051f3c48bc5a727bc670c94d89568db2208d8fbe85b014fb9e9

SHA512
0d97329cc674ec0b60300cf7a79ff18c0531706245733214d273f842e1d8c9f3e9985844daf85fa8269ace1e5adaea1f1e13c1775f9736e92c3688896ef21749

Download Submit
C:\Users\Admin\Documents\DenyStop.vdx

Filesize
1.1MB

MD5
954be345f3c05b8e2c5cfeb1c4d5e39d

SHA1
372c35e39300dd71d47b1656d8f21725ad4f0a21

SHA256
c4785a3e977a34dc247425e0336ef89161aaa8a89acacd896e6fee7e8984c8d5

SHA512
88b80c43e2488a3f6df131043d45bad7f94820b4b140075ea434363a6dd028552960dccc79dee8c77ed18960eb567e554a166952e1fa54c41231599639c2ff28

Download Submit
C:\Users\Admin\Documents\EditDeny.xlsx

Filesize
1.6MB

MD5
39f0e3a62f354338bd954c4eb0266756

SHA1
7426cf8f6ce0d5a6b9cc81afcedaddf446f628ed

SHA256
967df86fc679f93568bb079b62ba32df1c0ad139c6059d2310c545c8751a3070

SHA512
59ebe85c2ec2b47a6c0c5ba52d33cab72b416651551cb9c9affc2bd66aa0497863f05920670b79bdc73ea47c4f7f98db028ceb773b0198b0f025b00103e7964f

Download Submit
C:\Users\Admin\Documents\ExpandEdit.odt

Filesize
1.3MB

MD5
38afe4539711659ab55a4bd23cf40867

SHA1
2a63da613eb91471dd5abcacbfa45153c557e6ab

SHA256
58829d92ae775c66e092f3688953b1b81c1758b4fb00e32ae3feb563b6906aaf

SHA512
304baf81ed64cc2ce86e16e8efe9e10c3e2db640b6f3768cd6945eaa936835ec674da7c519f9abe6590fd00fb0c8f022090aa3ec591dafc6d955285caee03810

Download Submit
C:\Users\Admin\Documents\FindMount.vstx

Filesize
1.6MB

MD5
f7d57c6d9063a7725b06f70d68476d32

SHA1
c7b9867d0367d91cd18c806aebd263489064d208

SHA256
6153124bf1aae2bb41c9dc3ea106704bca9d4110302f4a18862daa1a34911766

SHA512
4b39b141203f2556635677d52815060f96f2ee50510e68407f93d4d782448aa90ad2e2d98654e22ec3af2eb2ec023b865203f14fb6469bb26b798524c6cac446

Download Submit
C:\Users\Admin\Documents\FindPush.mht

Filesize
1.0MB

MD5
3fe8de5ee1e09b077c9bd0e32b04c87c

SHA1
512f3e873cdb7952e0b29b127a60f3a698541d65

SHA256
14b481a91f2e8b70a07412dc91452b9b11c90f36a1808f8062fb8822c50649bf

SHA512
7fccd54df29dc2e9ea9baaf087c99863112ad24839ee946353a4af35d7cfaf8c035b9941dcf79a1a0adf2b4616aa7cb5782d0c32ae5b22e0dafaa1a4a44595f9

Download Submit
C:\Users\Admin\Documents\GroupAssert.ppsx

Filesize
967KB

MD5
6ff6aeb8ba7bef536a74b8c7db5f6957

SHA1
d6a2bf0034ca46097df3e7407b6d01e2b39985e9

SHA256
82596ca78cc8747486dcf305b739002d7c6b85c774d3184a198131ea4b8b399d

SHA512
aa5bd858567a1f9ac08898ae8947ce6736dea6591ce219c56d64c68d3b72030db19b70783e0491582caa1fc72e3fc5cfc2e7b255562d0a615bde10dab5aa2a36

Download Submit
C:\Users\Admin\Documents\GroupConvert.ppsm

Filesize
717KB

MD5
2d78dfccaf2514cfc9f67b7d749dd480

SHA1
4593f03b3a257d2037ec60fe1b4f046041cf79a7

SHA256
ee66a4abb3c7701282575e708a1e35848b6bb85261b0be4a78714b1a99a69d7d

SHA512
41e0964ae584df2839df988d643feeaf4daf8b7ded43348ada8582964ed77f17b6aa6f5d99d1a352322ed06dcc600f31bbf6f22444bd9a8ee6c51c73ee532985

Download Submit
C:\Users\Admin\Documents\MergePush.xlsm

Filesize
2.3MB

MD5
0ab7a355427d36ee5408835ebe84f2f5

SHA1
5447c34f88ec0142e22e73fba2ef5d1170802771

SHA256
56269d2dcb67611d7440b157bf7721b64da3c61f4d065e3ede5f1830792b2e2c

SHA512
bd0761bc880e28da948d99bbaced181c967c7871a1c1b393bccb4934de064dd8b4e3048b9de585bdcfd0b345a1080b104eed127cd8bf70c13625af948090c715

Download Submit
C:\Users\Admin\Documents\MoveLimit.vdx

Filesize
1.1MB

MD5
cb81ff6f0737d22a24a0d9a367836f95

SHA1
193a22003e382a1b2c645e8f27c09a401ac40c89

SHA256
0dcdcad25401d582468162eb3d1a4274be34b8fe32b82a9424bccf94158eedc9

SHA512
3584e0d207ebbb6c591c6d6e85da27214f11f9c0d68a2dfd172377da529aa77a4801071c9c39d1fa885648e2a47e4555e047f78a69c29bbfd9f481e3ddd8a3bd

Download Submit
C:\Users\Admin\Documents\ProtectRedo.wps

Filesize
1.5MB

MD5
6871059ef89924851a1cb0edb7f8ab56

SHA1
af81a7ab9dab6b09eac7b608b20f08598d44b0bd

SHA256
9a6bfde0b361303205604daffb9d69d9472b02c8a0573204375b1d140054f830

SHA512
87a1b0db0899a6b327ac6f80bfef80d8ea8997a5884d33633f916f280b6b52ee4ad9fb6f76cc29696da2a254fb093f85006e436ac7c3fff7158826106086f524

Download Submit
C:\Users\Admin\Documents\PublishFormat.doc

Filesize
1.4MB

MD5
7928c8f816d3b9133112fceaa81edb27

SHA1
48858920302210e9cb64fb684d1b4f0ffc328e5f

SHA256
c92ed162f7cceacdbf8926b7ae1c9bcbb781895412abc8f0a90909070ff4ab1a

SHA512
3e2684ce947f9c61cc75a2bdb0699f994ccdd088a71bf8b0708bea4adf94bbb2bf5e372e142ce8744c5f4863ef42cf757002825075667ba0a9fc60d8aa75a622

Download Submit
C:\Users\Admin\Documents\RenameRedo.ppt

Filesize
842KB

MD5
422e3430aafad2a073d79fc7a7470447

SHA1
4208469de13b77a55bb413140aab35b84b347055

SHA256
ceaed9e4693f635b1832b9b851d939549b9561c9bd66148045f73ab90e459647

SHA512
2b4bd6a40073a96094e6557e06950c1c311c0c4e20b488ec2cd98aac5dfafb2d5881a236858b9ac8ed61db2ed4220de6650c3aeb852a40eebe6d92b2d8a96af7

Download Submit
C:\Users\Admin\Documents\RestoreSkip.vstx

Filesize
1.4MB

MD5
9937d7dac18f9bad40dceba83c1579ab

SHA1
1ab6369d72f0b2600476bff49b04b0ebc54b4019

SHA256
c020bb89aafd733a5a3144e679d752a5df57a8c01511c3fce92bf8f391d9dd9c

SHA512
29366bb133aa06131f3924e61c9efee5d9b655379116151df52f0f0a2a447fecc77e4c15ea625d5bfa9efaec050434f17a86a6aa9fd069efaf284c4f38645fdc

Download Submit
C:\Users\Admin\Documents\SelectCompare.xml

Filesize
655KB

MD5
a6c4e8e4626f55cf3762d9b3ad642540

SHA1
985bc0a74f6f19201136edd82932a0ba12999115

SHA256
a2c644ad35ba90c1afa0a6169b491193900759a57260b6be90d777618e1ba021

SHA512
2eed0e3ce7bc07979cab1414ad071cbd6a1b3041a6c39188c7b2daa6be3318ddef49a88a82581ea72db0b6c873c74b351f54b94fa6ea70d78a89aacfc2e62235

Download Submit
C:\Users\Admin\Documents\SelectConnect.potm

Filesize
1.2MB

MD5
c598edb56471c16f576d0d53a727c800

SHA1
b90e9676601e04b45eac00d44c8d66c4110afad9

SHA256
744f83fcc9b000c67f63fe38b62e4596a4b4d6f837308b56e18fefcdd65de6bc

SHA512
6055ed95583653930ff9bd0e73988efd4a7524c9da3b4fec6f2760fa1e26312cf9c1c667a71c76ee1ff2785462ad78dbb12037d851cb48c70f0d108019ea75e9

Download Submit
C:\Users\Admin\Documents\SkipTest.docx

Filesize
13KB

MD5
0ad58f45f6c1717d421b21bedaeeef92

SHA1
e408f2ec8f9a549afd1c48e6f1814862b61999c4

SHA256
681268f978c6d6b60d2f8b98899cd297de9be1a6818cfcf4758aea12254d60f6

SHA512
66c2d6dfeeefeb5489af47782de0d07cd26a5c710f850bfa58fb0988e16c54a1307ebb2d39285d3be38a2f5fd6ac2f989dca9b7a0c0d7485f3aa3c128b0f3710

Download Submit
C:\Users\Admin\Documents\StopConvert.vsdx

Filesize
780KB

MD5
da23c326eb4e3aa0bd3632d3726142cc

SHA1
fb7d7d73071a02b12b41daeadd7c87985d915126

SHA256
982c80e92cdc375bf37208d54718f2b6801a70d2d7e58d848f8cc8402f7328d9

SHA512
4c46092a8e4fdec193a316d4a9f9f5eb3f54792475db33562b66f64e48b6a3aedd46accec5514ffeb0e254807a414ed06dd5609e7e5aee3a4e41bcf8ae87c7f5

Download Submit
C:\Users\Admin\Documents\StopRegister.docx

Filesize
14KB

MD5
74d238f7a533708c6b8fc104c452df25

SHA1
4ceb84723434b1925f11432db58aae0e17a390f2

SHA256
fd6ecdf286c6e5dc03d4c70953e4a70d5d31499a99b032eebbd7f9ec0abfe865

SHA512
30c44d6adbf34182ff8aa7d5a5a5b5bf384bf47bce56756d15c5283153066a42cf3cc8019bcdd5d83597dc67b2310ff3ee5763fc343ccad8076f136358997756

Download Submit
C:\Users\Admin\Documents\TestCompare.vsx

Filesize
904KB

MD5
132e713820933016aa1f67a64e1e744c

SHA1
0de13662e448c1cb67194249acd34437399a2895

SHA256
5dfeb1b76a4ce7a5be64b6f84fc873a9cbd25d38379e121219a58b76c4c42590

SHA512
26d4314fcfba0715fbd64f7e22aca0b6ae09eec459c614ad8608932baf6f9b10cdc14a0395be2ab94252196ee9641f3710d3769ab4bb723eb33359aba0c16e3d

Download Submit
C:\Users\Admin\Documents\UninstallProtect.csv

Filesize
592KB

MD5
ba7d0480317ee7258b238a16c606b569

SHA1
3046fa9851c33bf656a40d6a6983afd0451b7774

SHA256
f9bb548e80c98d369fba48d842bc643bbed46ef519f8e52917e752af76b63a30

SHA512
8c3e97aa4ae9d024fca27af4ab73f861664393d6d29ab57621407e2a7e3dde0d793697f7e54da56f4e876db555822534c5e257530607464cd712b7416fbabdcb

Download Submit
C:\Users\Admin\Documents\UnlockWatch.xlsx

Filesize
12KB

MD5
49d16c5136df34f607e5de133c6a1aa1

SHA1
9ff1f159600c79ad7644ce68f3c7161d3d357c56

SHA256
9f140b1524b5325b9c5c375c667a27277f439dc67be51f0f2e0913c1cbe5422f

SHA512
f4ef853c5a4154b28c29a45141a3c3942cedd685a21ec26a67d45ab00f3b961bdbb3d1d8a6df3e0821c6924ea633881f1b3e88b8d7d2de9bcefd483cbb5d40da

Download Submit
C:\Users\Admin\Music\ApproveLimit.xltm

Filesize
1021KB

MD5
880c1038bf7a027eed8a6fe66c33682f

SHA1
384a4acdcb3c85be38bdb108b18c0ace51a1486b

SHA256
6b6e09646481c33c0cc7196d158ba2b6151c81a3e2ac7342386f150ff375dab0

SHA512
af6ecd5bd2551926bd9e5436e3e43c38d1be3f0023337041f1e05383270a50be69b04d7f9ec24c994cda403efac213b4dc06c37e2df788172e5e5029c77a83a3

Download Submit
C:\Users\Admin\Music\ClearStart.asp

Filesize
427KB

MD5
7b5cc3d2163862f96f8d8bb7476ed5b9

SHA1
0516620c7715d9fddc428e513ce884191fbfc249

SHA256
4a5c762d53265bc13dd6e5a282135bcca274200da1233d7fbfe728666fbbdd7d

SHA512
73d188875e626fe707049a8b45822e8e94dd4421624d717a917b01aae7a7ee2b57c453febe99c562ca7fecee0f43c4f3256f3010f123fb476eaf6daa2e1b2be1

Download Submit
C:\Users\Admin\Music\DebugSync.ps1

Filesize
947KB

MD5
d986bc0254ac56022ef858766b24e64c

SHA1
c34f7c3f311def1cc67537a0f007caba4308f520

SHA256
e9f56150e57aa45ef94fbdcc998415a9827cc670fc134297d8280008c4a77ebb

SHA512
900532061c5006d286afe18bc67255aa575cd2353d74266e6250e20cbbc70cfce19330b1d731c4cf86fe289bb45e4b8d63c1961241bbaa901692b2b905558a1d

Download Submit
C:\Users\Admin\Music\ExportImport.zip

Filesize
390KB

MD5
f853c26b2d20f71c9097a6eec0bd4308

SHA1
10ddb6eb5ef8506a1ac8a0f9c55c191aa5634e40

SHA256
ddd87a6ed2e3ec374b6197f8fcce27a55c6a0b02d4dd2bfa351e4395424ecdc4

SHA512
22ec1e6d7c3cc6889ec69658cac5bb6e980d037b65372d80f675ed0de1878add42fbfb723ff4e06548763638dab81d5b52319f312d0e57d3be3779ccebe37b5d

Download Submit
C:\Users\Admin\Music\MergeWatch.wav

Filesize
835KB

MD5
2da22b6a89976df3c9fd82e300432482

SHA1
4be3bde3cee310d1b54e9ea9b16f5cbfb49312c2

SHA256
bd1f6714d008b70d9920c3fd649ba870d937cc1e48801b6adfeeb4d452481c34

SHA512
b784bafb28c69f305f7cafc945a0f5355537f2c7c12b2254baa5abae145ce1bfe7a0742a001922fce97d067ad27c5f354c4156d420f9a3de8b4d0a2dea2fe4d6

Download Submit
C:\Users\Admin\Music\MountFormat.m1v

Filesize
761KB

MD5
f72089e529d557ab4ab59a5136c7b029

SHA1
3d59424cfd01df9f1c3f801f22d414352b6d03b0

SHA256
2535182104bfdaf8b4db76a0b2aad33edb8604c1e607e5dc42fe4b26e4f0c79d

SHA512
1bb1d13669996cc993cb41250ff2350f5d6e7b35666199b5941cd60ce6cc2a8edca1f1f4a30ac20213312584024dc2f725b460663ba6332c4a73344bb1c7d9fc

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk

Filesize
2KB

MD5
1b99e9c0b18a8ff11628c78ae7ec8b22

SHA1
1c7498935760542ffb55042b1107b187366ab867

SHA256
16a6a0ee84ea6ec319455a8cbdc0a07d9cc6611e82990f9409693540e33e4cb2

SHA512
4971dc65ef122cfe0f2f692bc9e51a1155528b54de464a70803166e55e3c36901615e8d56a73a7628f5ad2e805c0f352a93ff6a8bbd86ff4a9f06573a8f994c8

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
923B

MD5
134ef290d60394e43e872257422568bf

SHA1
51bc930c102728866e0782014e29a117d07467d4

SHA256
59ceb15e1204242d95ccf8774e928507c8ca0f7ef390c03a07b0fbcfa85459bc

SHA512
ad2b62d2920cd50a6fc170c15bacfd58e817e8f8b868245fe9e478cf2bdc985ceb745c7f237eb0bc39ccbbe2aac9197dcd9643b30aa618d658f6df417e983a88

Download Submit
memory/2112-344-0x000002281CC40000-0x000002281CC41000-memory.dmp

Filesize
4KB

Download
memory/2112-355-0x000002281CC40000-0x000002281CC41000-memory.dmp

Filesize
4KB

Download
memory/2112-354-0x000002281CC40000-0x000002281CC41000-memory.dmp

Filesize
4KB

Download
memory/2112-353-0x000002281CC40000-0x000002281CC41000-memory.dmp

Filesize
4KB

Download
memory/2112-352-0x000002281CC40000-0x000002281CC41000-memory.dmp

Filesize
4KB

Download
memory/2112-351-0x000002281CC40000-0x000002281CC41000-memory.dmp

Filesize
4KB

Download
memory/2112-350-0x000002281CC40000-0x000002281CC41000-memory.dmp

Filesize
4KB

Download
memory/2112-345-0x000002281CC40000-0x000002281CC41000-memory.dmp

Filesize
4KB

Download
memory/2112-349-0x000002281CC40000-0x000002281CC41000-memory.dmp

Filesize
4KB

Download
memory/2112-343-0x000002281CC40000-0x000002281CC41000-memory.dmp

Filesize
4KB

Download
memory/3384-584-0x00007FFC6C340000-0x00007FFC6C3F8000-memory.dmp

Filesize
736KB

Download
memory/3384-576-0x00007FFC75D90000-0x00007FFC75D9F000-memory.dmp

Filesize
60KB

Download
memory/3384-588-0x00007FFC6CBF0000-0x00007FFC6CC02000-memory.dmp

Filesize
72KB

Download
memory/3384-585-0x00007FFC5D350000-0x00007FFC5D6C5000-memory.dmp

Filesize
3.5MB

Download
memory/3384-586-0x000001B3197F0000-0x000001B319B65000-memory.dmp

Filesize
3.5MB

Download
memory/3384-583-0x00007FFC6C8E0000-0x00007FFC6C90E000-memory.dmp

Filesize
184KB

Download
memory/3384-582-0x00007FFC6C400000-0x00007FFC6C573000-memory.dmp

Filesize
1.4MB

Download
memory/3384-580-0x00007FFC6CE90000-0x00007FFC6CEBD000-memory.dmp

Filesize
180KB

Download
memory/3384-581-0x00007FFC6CAB0000-0x00007FFC6CAD3000-memory.dmp

Filesize
140KB

Download
memory/3384-579-0x00007FFC6FDE0000-0x00007FFC6FDF9000-memory.dmp

Filesize
100KB

Download
memory/3384-578-0x00007FFC74130000-0x00007FFC7413D000-memory.dmp

Filesize
52KB

Download
memory/3384-577-0x00007FFC6FE90000-0x00007FFC6FEA9000-memory.dmp

Filesize
100KB

Download
memory/3384-575-0x00007FFC70090000-0x00007FFC700B4000-memory.dmp

Filesize
144KB

Download
memory/3384-587-0x00007FFC6CDB0000-0x00007FFC6CDC5000-memory.dmp

Filesize
84KB

Download
memory/3384-574-0x00007FFC5CAA0000-0x00007FFC5D088000-memory.dmp

Filesize
5.9MB

Download
memory/3384-592-0x00007FFC5C980000-0x00007FFC5CA9C000-memory.dmp

Filesize
1.1MB

Download
memory/3384-591-0x00007FFC6C9F0000-0x00007FFC6CA04000-memory.dmp

Filesize
80KB

Download
memory/3384-590-0x00007FFC6CA90000-0x00007FFC6CAA4000-memory.dmp

Filesize
80KB

Download
memory/3384-589-0x00007FFC5CAA0000-0x00007FFC5D088000-memory.dmp

Filesize
5.9MB

Download
memory/3384-593-0x00007FFC6FE90000-0x00007FFC6FEA9000-memory.dmp

Filesize
100KB

Download
memory/3384-594-0x00007FFC6C310000-0x00007FFC6C332000-memory.dmp

Filesize
136KB

Download
memory/3384-596-0x00007FFC6C2F0000-0x00007FFC6C309000-memory.dmp

Filesize
100KB

Download
memory/3384-597-0x00007FFC6CAB0000-0x00007FFC6CAD3000-memory.dmp

Filesize
140KB

Download
memory/3384-598-0x00007FFC5C930000-0x00007FFC5C97D000-memory.dmp

Filesize
308KB

Download
memory/3384-595-0x00007FFC6C8C0000-0x00007FFC6C8D7000-memory.dmp

Filesize
92KB

Download
memory/3384-599-0x00007FFC6C400000-0x00007FFC6C573000-memory.dmp

Filesize
1.4MB

Download
memory/4992-310-0x00007FFC5B160000-0x00007FFC5B183000-memory.dmp

Filesize
140KB

Download
memory/4992-321-0x00007FFC5B2E0000-0x00007FFC5B318000-memory.dmp

Filesize
224KB

Download
memory/4992-320-0x00007FFC552E0000-0x00007FFC559D5000-memory.dmp

Filesize
7.0MB

Download
memory/4992-319-0x00007FFC6C9F0000-0x00007FFC6CA05000-memory.dmp

Filesize
84KB

Download
memory/4992-306-0x00007FFC6A2B0000-0x00007FFC6A2DD000-memory.dmp

Filesize
180KB

Download
memory/4992-308-0x00007FFC70080000-0x00007FFC70099000-memory.dmp

Filesize
100KB

Download
memory/4992-309-0x00007FFC6CA90000-0x00007FFC6CADD000-memory.dmp

Filesize
308KB

Download
memory/4992-311-0x00007FFC56930000-0x00007FFC56AA3000-memory.dmp

Filesize
1.4MB

Download
memory/4992-394-0x00007FFC725D0000-0x00007FFC725DD000-memory.dmp

Filesize
52KB

Download
memory/4992-312-0x00007FFC6C8F0000-0x00007FFC6C901000-memory.dmp

Filesize
68KB

Download
memory/4992-411-0x00007FFC561E0000-0x00007FFC562FC000-memory.dmp

Filesize
1.1MB

Download
memory/4992-412-0x00007FFC5A8C0000-0x00007FFC5AEA8000-memory.dmp

Filesize
5.9MB

Download
memory/4992-439-0x00007FFC570A0000-0x00007FFC570C2000-memory.dmp

Filesize
136KB

Download
memory/4992-438-0x00007FFC725D0000-0x00007FFC725DD000-memory.dmp

Filesize
52KB

Download
memory/4992-437-0x00007FFC5B2E0000-0x00007FFC5B318000-memory.dmp

Filesize
224KB

Download
memory/4992-432-0x00007FFC6CA90000-0x00007FFC6CADD000-memory.dmp

Filesize
308KB

Download
memory/4992-431-0x00007FFC70080000-0x00007FFC70099000-memory.dmp

Filesize
100KB

Download
memory/4992-430-0x00007FFC700A0000-0x00007FFC700B7000-memory.dmp

Filesize
92KB

Download
memory/4992-425-0x00007FFC5B110000-0x00007FFC5B122000-memory.dmp

Filesize
72KB

Download
memory/4992-424-0x00007FFC6C9F0000-0x00007FFC6CA05000-memory.dmp

Filesize
84KB

Download
memory/4992-420-0x00007FFC56930000-0x00007FFC56AA3000-memory.dmp

Filesize
1.4MB

Download
memory/4992-413-0x00007FFC6CE90000-0x00007FFC6CEB4000-memory.dmp

Filesize
144KB

Download
memory/4992-436-0x00007FFC552E0000-0x00007FFC559D5000-memory.dmp

Filesize
7.0MB

Download
memory/4992-457-0x00007FFC56F20000-0x00007FFC56FD8000-memory.dmp

Filesize
736KB

Download
memory/4992-464-0x00007FFC570A0000-0x00007FFC570C2000-memory.dmp

Filesize
136KB

Download
memory/4992-459-0x00007FFC6C9F0000-0x00007FFC6CA05000-memory.dmp

Filesize
84KB

Download
memory/4992-458-0x00007FFC56300000-0x00007FFC56675000-memory.dmp

Filesize
3.5MB

Download
memory/4992-447-0x00007FFC5A8C0000-0x00007FFC5AEA8000-memory.dmp

Filesize
5.9MB

Download
memory/4992-456-0x00007FFC5B130000-0x00007FFC5B15E000-memory.dmp

Filesize
184KB

Download
memory/4992-502-0x00007FFC72400000-0x00007FFC7240D000-memory.dmp

Filesize
52KB

Download
memory/4992-501-0x00007FFC74130000-0x00007FFC7413F000-memory.dmp

Filesize
60KB

Download
memory/4992-512-0x00007FFC6C8D0000-0x00007FFC6C8EE000-memory.dmp

Filesize
120KB

Download
memory/4992-522-0x00007FFC6CA90000-0x00007FFC6CADD000-memory.dmp

Filesize
308KB

Download
memory/4992-521-0x00007FFC70080000-0x00007FFC70099000-memory.dmp

Filesize
100KB

Download
memory/4992-520-0x00007FFC700A0000-0x00007FFC700B7000-memory.dmp

Filesize
92KB

Download
memory/4992-519-0x00007FFC570A0000-0x00007FFC570C2000-memory.dmp

Filesize
136KB

Download
memory/4992-518-0x00007FFC561E0000-0x00007FFC562FC000-memory.dmp

Filesize
1.1MB

Download
memory/4992-517-0x00007FFC5A8A0000-0x00007FFC5A8B4000-memory.dmp

Filesize
80KB

Download
memory/4992-516-0x00007FFC5B0F0000-0x00007FFC5B104000-memory.dmp

Filesize
80KB

Download
memory/4992-515-0x00007FFC5B110000-0x00007FFC5B122000-memory.dmp

Filesize
72KB

Download
memory/4992-514-0x00007FFC6C9F0000-0x00007FFC6CA05000-memory.dmp

Filesize
84KB

Download
memory/4992-513-0x00007FFC56F20000-0x00007FFC56FD8000-memory.dmp

Filesize
736KB

Download
memory/4992-511-0x00007FFC6C8F0000-0x00007FFC6C901000-memory.dmp

Filesize
68KB

Download
memory/4992-510-0x00007FFC5B130000-0x00007FFC5B15E000-memory.dmp

Filesize
184KB

Download
memory/4992-509-0x00007FFC75D90000-0x00007FFC75D9A000-memory.dmp

Filesize
40KB

Download
memory/4992-508-0x00007FFC5B160000-0x00007FFC5B183000-memory.dmp

Filesize
140KB

Download
memory/4992-507-0x00007FFC6A2B0000-0x00007FFC6A2DD000-memory.dmp

Filesize
180KB

Download
memory/4992-506-0x00007FFC6CBF0000-0x00007FFC6CC09000-memory.dmp

Filesize
100KB

Download
memory/4992-505-0x00007FFC6CE90000-0x00007FFC6CEB4000-memory.dmp

Filesize
144KB

Download
memory/4992-504-0x00007FFC6CDB0000-0x00007FFC6CDC9000-memory.dmp

Filesize
100KB

Download
memory/4992-503-0x00007FFC5A8C0000-0x00007FFC5AEA8000-memory.dmp

Filesize
5.9MB

Download
memory/4992-523-0x00007FFC56300000-0x00007FFC56675000-memory.dmp

Filesize
3.5MB

Download
memory/4992-524-0x00007FFC56930000-0x00007FFC56AA3000-memory.dmp

Filesize
1.4MB

Download
memory/4992-527-0x00007FFC725D0000-0x00007FFC725DD000-memory.dmp

Filesize
52KB

Download
memory/4992-526-0x00007FFC5B2E0000-0x00007FFC5B318000-memory.dmp

Filesize
224KB

Download
memory/4992-525-0x00007FFC552E0000-0x00007FFC559D5000-memory.dmp

Filesize
7.0MB

Download
memory/4992-313-0x00007FFC56F20000-0x00007FFC56FD8000-memory.dmp

Filesize
736KB

Download
memory/4992-314-0x00007FFC75D90000-0x00007FFC75D9A000-memory.dmp

Filesize
40KB

Download
memory/4992-316-0x000002DA70860000-0x000002DA70BD5000-memory.dmp

Filesize
3.5MB

Download
memory/4992-317-0x00007FFC56300000-0x00007FFC56675000-memory.dmp

Filesize
3.5MB

Download
memory/4992-318-0x00007FFC6C8D0000-0x00007FFC6C8EE000-memory.dmp

Filesize
120KB

Download
memory/4992-315-0x00007FFC5B130000-0x00007FFC5B15E000-memory.dmp

Filesize
184KB

Download
memory/4992-307-0x00007FFC700A0000-0x00007FFC700B7000-memory.dmp

Filesize
92KB

Download
memory/4992-304-0x00007FFC6CBF0000-0x00007FFC6CC09000-memory.dmp

Filesize
100KB

Download
memory/4992-305-0x00007FFC570A0000-0x00007FFC570C2000-memory.dmp

Filesize
136KB

Download
memory/4992-303-0x00007FFC561E0000-0x00007FFC562FC000-memory.dmp

Filesize
1.1MB

Download
memory/4992-301-0x00007FFC6CDB0000-0x00007FFC6CDC9000-memory.dmp

Filesize
100KB

Download
memory/4992-302-0x00007FFC5A8A0000-0x00007FFC5A8B4000-memory.dmp

Filesize
80KB

Download
memory/4992-300-0x00007FFC5B0F0000-0x00007FFC5B104000-memory.dmp

Filesize
80KB

Download
memory/4992-299-0x00007FFC5B110000-0x00007FFC5B122000-memory.dmp

Filesize
72KB

Download
memory/4992-297-0x00007FFC6CE90000-0x00007FFC6CEB4000-memory.dmp

Filesize
144KB

Download
memory/4992-298-0x00007FFC6C9F0000-0x00007FFC6CA05000-memory.dmp

Filesize
84KB

Download
memory/4992-293-0x00007FFC56F20000-0x00007FFC56FD8000-memory.dmp

Filesize
736KB

Download
memory/4992-296-0x00007FFC56300000-0x00007FFC56675000-memory.dmp

Filesize
3.5MB

Download
memory/4992-295-0x00007FFC5A8C0000-0x00007FFC5AEA8000-memory.dmp

Filesize
5.9MB

Download
memory/4992-294-0x000002DA70860000-0x000002DA70BD5000-memory.dmp

Filesize
3.5MB

Download
memory/4992-292-0x00007FFC5B130000-0x00007FFC5B15E000-memory.dmp

Filesize
184KB

Download
memory/4992-290-0x00007FFC5B160000-0x00007FFC5B183000-memory.dmp

Filesize
140KB

Download
memory/4992-291-0x00007FFC56930000-0x00007FFC56AA3000-memory.dmp

Filesize
1.4MB

Download
memory/4992-289-0x00007FFC6A2B0000-0x00007FFC6A2DD000-memory.dmp

Filesize
180KB

Download
memory/4992-288-0x00007FFC6CBF0000-0x00007FFC6CC09000-memory.dmp

Filesize
100KB

Download
memory/4992-286-0x00007FFC6CDB0000-0x00007FFC6CDC9000-memory.dmp

Filesize
100KB

Download
memory/4992-287-0x00007FFC72400000-0x00007FFC7240D000-memory.dmp

Filesize
52KB

Download
memory/4992-284-0x00007FFC6CE90000-0x00007FFC6CEB4000-memory.dmp

Filesize
144KB

Download
memory/4992-285-0x00007FFC74130000-0x00007FFC7413F000-memory.dmp

Filesize
60KB

Download
memory/4992-283-0x00007FFC5A8C0000-0x00007FFC5AEA8000-memory.dmp

Filesize
5.9MB

Download
memory/5936-406-0x00000239072C0000-0x00000239072E2000-memory.dmp

Filesize
136KB

Download