Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    110s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21/08/2024, 23:06

General

  • Target

    UserPassLog-main/loginprompt.ps1

  • Size

    1KB

  • MD5

    dfc672662ec7e8fd9b9180f0f04b5221

  • SHA1

    eede1ceb16f99e4ae4a42e16979481d1885e49d6

  • SHA256

    9ea649729ce1c0dede37c6cf385b96753df9aed560c02f7124f11231074a1e7c

  • SHA512

    11de2a7e714ff8ac6822f938d99e3b2b8355675710bfa88e6b1f768619beab1b6a1f32caef7bb3e0d0d102726bd1c19b9dc88eaf1a2856711575e557cc57d3a7

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\UserPassLog-main\loginprompt.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1764
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3168
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:912

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

      Filesize

      10KB

      MD5

      eed1599235b9dd933e13cbd5751d7eec

      SHA1

      d461f7edc8bdb31b672f97b18d34e38bb7c96c4b

      SHA256

      13ee96f0fd8b45de1603cea7aa86ddaa749ea580989d6cb806d944f3547fbf43

      SHA512

      9679690676ef1ede8030e26359381a092eaec7cb671d51e91d8cd446006301bcb98518b977fd5d475e777baa11dd28e69135c517e3b3d74475134bfed4e8da9e

    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

      Filesize

      10KB

      MD5

      88c83953edf8df304c61067c2ef6ea08

      SHA1

      b82b925968af806f4f8d4f6d84e60bdba5d6a6d6

      SHA256

      e3162b49b8537965feb00b240a8ab0b4dea0208c05d118bc135ec9dc47a5e677

      SHA512

      c2e263942fa3fa857bce67c7e907d09c05703ef21ec0cad0251707ea8b46bf76b3a9b3cbdb390642ea9ff1ed62b7be3b81fc4d2f106ef063242abb2420ed9f1f

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d3uty11w.tau.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\Desktop\AddRemove.wpl

      Filesize

      658KB

      MD5

      f067f20729f8d44e85f0edb6a4c8ecbf

      SHA1

      855758b2889457a5ad575322af99719df2dc94cf

      SHA256

      c492fc3a9af66e6f3cc7becd8e83fbefb712a7e4c90d6d9854ef674d5ce6dfdf

      SHA512

      01bd6a050cc588d61f38a58584de41d2976b491baf01b9c42f7bee41f4ef3bd54522b28672763afe5e2cd5b3ae058b286297951892014936ce83da96179fc613

    • C:\Users\Admin\Desktop\ClosePush.rar

      Filesize

      245KB

      MD5

      4cfa80c8f8609e112c183d9969a86db9

      SHA1

      d0f6f9321a933e0532b79a964fdd0f8e1928b196

      SHA256

      f858dd5442145e7ee213000e56c9261988e377ef0bcb41c90507d03368e2677f

      SHA512

      ffb41b65216524445d164328febbe58d2609debea8912a542140b8ad9fba782b36dd44db99148e87f1a7375a0728b29bdd08ee2b027aba6306a88bf1cc9ad9d1

    • C:\Users\Admin\Desktop\CompareSend.vbe

      Filesize

      383KB

      MD5

      17fe792dfe6a376d98af5839d2f4dbe3

      SHA1

      c64a4f19eac4967ee53e4fe7502e01d944b544e6

      SHA256

      509e6d7922ad46ff7296f6b9eb2af6852ba9f5720541d4581551e74aa3761903

      SHA512

      c8c9ccda76f4a3305b909bdf2cf80a610823bd7d4e12ff730dc8f8e4f827e06f0475e975f0e73bccc6d052a6b0ab8a34c71c218215a8852b5e3b814582c971b7

    • C:\Users\Admin\Desktop\ConvertFromRestart.TS

      Filesize

      599KB

      MD5

      c9d320bfbb5e86df1601aaed91b82589

      SHA1

      5175cf6f56893a5332fead67ae529199b0dccf5b

      SHA256

      cef9ccda3e21e474469306af7e3727f990194342cae96b35a892622d48884105

      SHA512

      71d6f63c30eac26afdae42b029dab19a3b42f92bcf17eb9a2783d5669cd56b1f1d0588ac27ea59647561abb67ea3e9b721e5d47650cc2588227a87a065f5bacf

    • C:\Users\Admin\Desktop\ConvertSet.cab

      Filesize

      324KB

      MD5

      5004785e3e164960e69e8f9870a0a490

      SHA1

      83faba7d0ce918973e82eeae1eb7933d706f4922

      SHA256

      139fce9bd350e64a2d052d692b74f76765b8a2e4d13fc6c536978d028c07b235

      SHA512

      a6b28eed0d812ff2151f2b7d1a13c1ce7d3dbcc76247e5f046e5372f16fb7f938852a6d3917e90a9a298022622041ca495e59049383022a095039f56796354fa

    • C:\Users\Admin\Desktop\ExportExpand.avi

      Filesize

      963KB

      MD5

      7b345d3fdc12798bad92f5dcadc343be

      SHA1

      995b391256e213a74b3504ec122af53f2ceb54ae

      SHA256

      a499b8430e6ff886495d679420ddccf07ed579404f72d9fa8863ccb16f663991

      SHA512

      713a3cb8f8fda90dc38202c3e08c474c71812150858e7c1235adaa5be6c42b87b17be1694823a15a6a10a9ce3bf8147c79784851b79d37e40a28206b81e2a776

    • C:\Users\Admin\Desktop\ExportSwitch.asf

      Filesize

      422KB

      MD5

      0926ba7b53438d35928794cce0c12739

      SHA1

      2aef5322601b5a68ccd9ae6dd079179793e9a6cd

      SHA256

      365d085ff954215faa9ce589a18fe1a6df3bba2caa6b67d4a4d71cd377ac9134

      SHA512

      267707c7051f73579f1a0949b1eedc4cad997c9286651fdfc0273bf1f3d0b23da969a4081cbe3ec746b7484c6f92b9af85ab608d0092d1d9f9185aeccb64c73b

    • C:\Users\Admin\Desktop\GrantSync.wvx

      Filesize

      344KB

      MD5

      695682f95e05fb25cd1ef87cf7b58959

      SHA1

      aa078a64b14998317c9e2f332b6860ea5cd66fb4

      SHA256

      06401af2cc442049c26e3d97a73ec6af97321ac357e35af640964bfe20241969

      SHA512

      b4f51ce352a55e7c6b6966895428f7614d4b1e740054dc1b8f42a24585ed601c44bc94503d983fb61965cf812eddc4ee18c33b85c3b15575c98d1ed57b735b05

    • C:\Users\Admin\Desktop\GroupBackup.dib

      Filesize

      481KB

      MD5

      6a7567795b89a90409a18da3b5359a55

      SHA1

      aa6bfb32c410e4f0ac9960381e8bbf7b36f7fd98

      SHA256

      882f32a341530bbdec9b807db2b2f8ace8c6cf6b0ab14f3da74c023f58c0f343

      SHA512

      793b4d754136e3e6fed6ffeb67617c6ed9b5517239dec6fa7f2d4ba94d400dda6f32afccb59a0b25f714e54a3445b8761d2dfe5cbeed3ff5ae0b38fe4d662be9

    • C:\Users\Admin\Desktop\HideTrace.gif

      Filesize

      442KB

      MD5

      08bdc1e48c9d8d2c6fdd29a2b66e4ce9

      SHA1

      132fdffd9c4be158309c9f61e6b29d3f5ac97d2a

      SHA256

      30df8c27dd3bc11615c5c666ebf03582ce49c6a1424bcff0645b52676c8cf015

      SHA512

      f4cb9f8c110d078e985d0e6975c0ca80a802c28c8167818bc6dbd660fa8722f24d89421b2d6446dca51854118d1c3077a0d3d414bae51ff7e9f1890c8e503c53

    • C:\Users\Admin\Desktop\ImportConvert.vdw

      Filesize

      501KB

      MD5

      920a901c4212c67d93b5c56604bd8f54

      SHA1

      ed6e24eef379aef1789583f5347896a00375d768

      SHA256

      8088cf59318ca61cafaceea3ed4316daa94f7c7f8d7d4db2254a2384f1510216

      SHA512

      5238b1c30852b94c14b7fd779768cc3e130d20898493df8150b138030765dfc416997e40b8d8c1b0a3cba9e6749fdd4d0c125a35e456355155fa7ebef8493f0b

    • C:\Users\Admin\Desktop\JoinSend.dll

      Filesize

      619KB

      MD5

      c15d65e8fe9be068f1b09f90bb13e1cb

      SHA1

      c78d5555d7d5761e80e35fba9099f492163fc532

      SHA256

      78474c51bcd47ae4d7a1c1ef8aa26b30cb078e57b76f97c750f0f9b35c54ebe8

      SHA512

      278c2de1f59e8d73907ee0064eaacd1fa6a9933a1da0fc09228cf708d00cd5e26f70893dfc195b3e7e38d855f026904ad6044cbd8b74904821983310bdab201c

    • C:\Users\Admin\Desktop\LimitInvoke.css

      Filesize

      304KB

      MD5

      0e4a86ce01e0ed011bef3788f1eb8ad2

      SHA1

      e81557c7030af60ac7d36f5515a1b6065d67bd52

      SHA256

      47a25a5f4419ed711434f1b0e0961cfa826ba49b262ce0acd94aac26a0b30e34

      SHA512

      7ea1966f44e7f0d74e4f8c8161e41ae21a38ab923bf607e0c9374471f51192c0e9b26de1ffa1e2a6be08d888c0dd502a1cc54850c75a2f0b02791958431bd63a

    • C:\Users\Admin\Desktop\Microsoft Edge.lnk

      Filesize

      2KB

      MD5

      a48b1c74f6054bf3275e482c6830151f

      SHA1

      04c9dd81f96782e32bec23a1e2fa9015616ad256

      SHA256

      45b056271ad79b60268484ec8a32ac6eb0a5ce7b50c9c330ecf2b07a52e916d8

      SHA512

      69cbed9829b2a1053287f7530dc9d2ee59fc4855ca5c7988897cda92d0ce6215b92b9993e5cb3f7947d81d55ef8b2d481f1a7950d05764c36752746f202220d3

    • C:\Users\Admin\Desktop\NewTrace.ini

      Filesize

      265KB

      MD5

      31f2c7dbb1e9d524d5a988b34e22df29

      SHA1

      d7df32d2ee7fc03afbc7e0a2507c96f3b06d895d

      SHA256

      bf6ee400993ece24ab985e5b192d3adb89686648a2b247178bae7d618124e2ac

      SHA512

      812d9c15ba0094c3eb2ffcbffa623cf12b1337753dd34b8d2651dd98fff8ff13f7658b360f8147263a4c07a0ccbc9634005f70908fb611128031710c5fe61d4d

    • C:\Users\Admin\Desktop\OpenClear.dotx

      Filesize

      462KB

      MD5

      a6b37ea68dfb535c52ce80481bf793af

      SHA1

      1620f7f59cc706c7b3370001654591849a101815

      SHA256

      dba332ae9e4639485997ad694b86f6df8b88e9fb728b04e580d14401d0849904

      SHA512

      75b773f3ef89672b5f38df3ac3046ebe7f12b39c7fcd594e05062e23f4bc1dc16d313552b61fb26eabce40838adf8a7b8a7234aeb1d810fa89327fdee53a19e3

    • C:\Users\Admin\Desktop\OpenWait.ocx

      Filesize

      697KB

      MD5

      4b92d708a0c574c06768de19cfa7fdd1

      SHA1

      d1f313e3d2b35ae7d0a8642f1f9de47ea0aed5ff

      SHA256

      9f11663a6b2be07d26f45a7e1e5a0bf21f8cb7f0dc3d8ca245fb152acf96432a

      SHA512

      f73ded36152e6d6e741fd8c6fc83103dde3867c6a3ec0aed8d6492337b29929a9e141a7de6074afbcc9cd671dc94f9a30e54a609aae5b4f55efdd2330dcd54f6

    • C:\Users\Admin\Desktop\PingExport.mov

      Filesize

      403KB

      MD5

      79acf5f35355563bf467ad8a4cb44cec

      SHA1

      65f4f4a66a4affe084f53e0709d35346cef9faab

      SHA256

      03e0cfd5fd07ea63461c1ccab580acad64856a50205e5461bdfba909a6618264

      SHA512

      30b0bf72087f73f5b5a84e245e8c076a06a00f9b98311851c1a3f9a4a0867ab3315195ac888c4144f06abb20ae79b2bb96a159f7b9e40705bc36e4a3d4c935c1

    • C:\Users\Admin\Desktop\ReadAssert.nfo

      Filesize

      560KB

      MD5

      bbb855ceb235a8c5c072c17a2c4189ce

      SHA1

      c6aaf91252dc278951df797719ef6b519fe09b4f

      SHA256

      1e44a39800c19b436ed5f5e2067b9a21e2bf67c56663c83e2dc1673e7fbf40ec

      SHA512

      bceffcc6a1117d745ea8308d50b4435f447aa89d295873b034b3d2252f2139a62d4128d6302abf577845e9c6fc2451482d75ac153d65983e16550b2c4efa77d5

    • C:\Users\Admin\Desktop\ReadUnblock.7z

      Filesize

      678KB

      MD5

      e64fa9e08a7d2e8a365f694b859aa538

      SHA1

      94afb3c10b46b6ff2eb973b3d111cf171a636c95

      SHA256

      90ba550a5486babe5947151724941778132f0e879c7bca6ce46c5afe9a1a540a

      SHA512

      9c117c56698c141f00f00931d5bf5fe2ec9a8038600d3115933a3f9e8307e4571ebe04fa1a9fbca99b3fa4ad905dc1f2084348e3175e6ce7498b54bcdb9512f3

    • C:\Users\Admin\Desktop\RemoveCompare.xlsm

      Filesize

      285KB

      MD5

      fa2cecd2d930949ba195b0c28505e846

      SHA1

      7168849dec581eafed274f387e72e8731332f4b1

      SHA256

      c7cf9d7731cd513390081ec09b40cfa698a31d5087b824f148f091c6e8d6708b

      SHA512

      b9da3c8f918ae556c3a6e1c339b9d20151db69698e5b3228b99baf7a8e9cc53dc974d80134f139c35c68244e3ad7254946599f0a07e80c895abeff796302122e

    • C:\Users\Admin\Desktop\RestartSync.mpv2

      Filesize

      521KB

      MD5

      fb207ed6e475fd9c71f4174be4838d66

      SHA1

      ee7dd190bd31cbf5f8b0a8472096d8bd602de17b

      SHA256

      25a7a11fc61bb10a91eb27ee55ba9d9d9806d77370cb65d2a892cd6651ef86ed

      SHA512

      9e1f3895d4523a440c60494c5a05464943e84b7118ca5a68b32eff665337f311bf49af28aac3fa3327f8dac75ea1a526256392dc6be8959de800a02acd084a6c

    • C:\Users\Admin\Desktop\SendSkip.odt

      Filesize

      363KB

      MD5

      cd5b0c3c3cb681b1551ff285e5d752b0

      SHA1

      a3f6520c0e3f961eac72249d826d50d529e8573e

      SHA256

      bd535144d976297947466d50692b4be4301e73c0b01d0e64aa896022f9478f48

      SHA512

      097e04c552ee1837054a36599d022370fd046789c958c4d2c5754cf056be978e3a84519458f3ee677b92fed3e8f65ba5fb3ef49c2b2eeef5b0d26bdc35c867ac

    • C:\Users\Admin\Desktop\StartUnblock.kix

      Filesize

      638KB

      MD5

      375fe76ab86d7f10028dc6ba4deee71d

      SHA1

      9464cb4b70d36ac0d1f3d3fc6e313782940598d0

      SHA256

      46f5e87eb0d9872a1064dc8e33b2758665f9526ca6e83d3dee2607786b9c64fc

      SHA512

      4542772d6562ce346301bd82dee4b67e2336827caa714c23e7ba0b58c04c4e4bdaf247a56ff1a8b838ed91a102f83041e5f5184548f8700c0509adeffbc5628e

    • C:\Users\Admin\Desktop\UninstallSelect.ocx

      Filesize

      540KB

      MD5

      ea3cf5c60f7a8f0539d0212994384b0c

      SHA1

      6550033f65255af848a355a9f8a0be280844c672

      SHA256

      871b02ee7aa48267fafef7fe382b215fcbbe9997d240f671bc624861c726d9ae

      SHA512

      035b7c96a2793e4a6a88694a9ac8b59db3667f76d6e9eff2b0f20588ee076970b5d2029ff82f2b5be94ec20062fa6655769819b71cd9db9e9f259d2127cfa706

    • C:\Users\Admin\Desktop\UpdateStop.tmp

      Filesize

      580KB

      MD5

      74dcc2f5883b0f442fb27982ff7d1ea6

      SHA1

      0dd09560f102e1f5378e609f6491c60bca4e3172

      SHA256

      0e577fa4cca36c8d49c0231edbf6799289b11a04f3e3a7bb9d8313c52ec99de1

      SHA512

      9e229759af9403888c78183c8cefea66b653251642a9ca0b213c31102a54e3bbc2231db429e26c387686fa3822ae81c39210e4321fb18e29a1cd7802a0897492

    • C:\Users\Admin\Downloads\BackupMerge.jtx

      Filesize

      744KB

      MD5

      1969031bc90a073a43e7b722d8483f66

      SHA1

      509c51c93682ab50d234c889e78544f12efeb322

      SHA256

      25d00d3dfeb2f9c487a1ab1afbae917cb9f63955f0af4694cab49b132e200a2c

      SHA512

      cf4ffaa73351201dac8acb97082eaa4f8d0fbc51abb8eced674869ede28d0af91651e4190ed1faf03469bd3f58f01762304ad713a589efcb91fbedb42c83a963

    • C:\Users\Admin\Downloads\ClearUndo.DVR

      Filesize

      287KB

      MD5

      f75e464934a8734f1cdc94144a2d24d1

      SHA1

      b1107d40572dd555ebcbd383e2b1ad32237bf1af

      SHA256

      cfc20dd70aac207dff7a9ed1aa37f7a6db8bc0f348a79b9a68276cc9f8bb1e8a

      SHA512

      e1345672cb98cb919f51b7417f78831d7129f0f463de3b5e7a9b4f843c1041e24cb36b5914abb8bd664b74b0033244f5b09cfd4238ebe02ed59451948f5c5f7b

    • C:\Users\Admin\Downloads\CloseProtect.wdp

      Filesize

      526KB

      MD5

      3c64e7e1d60a2ec626466df12592fe74

      SHA1

      5af67781b2b1223163b55279335f30f69ae77e1d

      SHA256

      ecc0c48331222f032b752c1372b42107f00b07daa02908700642c82bf5cd24cc

      SHA512

      d84d5c82cfa1d66bb824ba7b3fd4a413b1c83d32b76b403b24cf6d15af8928ca395a983aa12ce00ac318d0c0cf0cb8a2b05b6c7deb7b38d308ec5500138702df

    • C:\Users\Admin\Downloads\CopyRemove.vdw

      Filesize

      416KB

      MD5

      35df336699f75424ab723ae816805c7d

      SHA1

      9dbdb64873ea681d28dfd41f7d2ffe25d28dce54

      SHA256

      829f37b18ef866571e21147f851b9918ed9308177d1deb77526c454d40a02901

      SHA512

      e2ef88080334c50eea3e9c4a8e9ce0e1d0bdf5bfd3d1f1dd9dfeeab89089ba049a1140f7582bddad5dc2d4fc32ea7a7b6a27b7dde52aa961818cb613f1440771

    • C:\Users\Admin\Downloads\DisconnectGrant.iso

      Filesize

      496KB

      MD5

      b47fec4368d1344818cb94a893d799b7

      SHA1

      d50d021ac614476e27813f3dc1241a5a27cd2e00

      SHA256

      e52b500840887d4c9702496538ca6ecbf723daaccb5506df4ead4364e3a36ef2

      SHA512

      37500beeff01e4e67d337106ad5956b4f14a3515b9966f378f88b2e37135f83c88ad9d6633c15e3fc9c50493c852cfd7921b255517285003e1518616426a62f1

    • C:\Users\Admin\Downloads\DisconnectUnlock.docm

      Filesize

      367KB

      MD5

      4efbb2136cccd22543a190e33cce9b4b

      SHA1

      db967bcebe5334c1844cd8477af8fc53f3e9d841

      SHA256

      ac5d3505d99027f286a37174fa85b0f8e8ac7bb98bed033ad73cadcf0e810025

      SHA512

      3a62d1706675d44509b4c00bf08dce73e36db438c21cae41729de7e3b1ac998bf47b8254d1c27f009996c9e668238c6d719b3db75b6e1ec867b89c8267713499

    • C:\Users\Admin\Downloads\EditSplit.docx

      Filesize

      536KB

      MD5

      929853a3ba33bbde95602ace94411bce

      SHA1

      9566d041d695c15cc804059a48d7f45f8eae6a4a

      SHA256

      36c795b232f9e27c7ad9c4b8d0d7de000a341265ffb388c5e9a580291b578356

      SHA512

      d3387e7ed2536858cb2e8c54627f247c320e70021015d27f7d61124c90a32cf1f9dd72122e1492bfeebff51d4d14d4fc405c886f54cd2957ec9e5ab0e7afba51

    • C:\Users\Admin\Downloads\EditStep.wmv

      Filesize

      327KB

      MD5

      e465349c1c14c7ef212a79b39e464097

      SHA1

      d3d3358e503e2023f72931a11ca235e7812cf33d

      SHA256

      5578a726c3d935a3f3bb69541a700f15231582486457a85bcc72f25d72cc574a

      SHA512

      139f889e6fb44621f5ff47829161b0bdf24cbb8eacea89c11f95f76841151891bceef41db1bfdae0449d4e6523ad212425334bf29daf9cd60e3ca04023f86c01

    • C:\Users\Admin\Downloads\EnableConvertFrom.svgz

      Filesize

      248KB

      MD5

      bd5521aeae570ad6f50d106128f2679f

      SHA1

      2f6673563e09fbc05c48e2e209ff636d43499b8b

      SHA256

      cd014d86e37fced1fc672ca3a4a4868ab92972cb8c3e47f76ed65a9ec587a887

      SHA512

      049b9f7735a5de48de3b703c596789818cf73ebddc5830d879455c583e7653b3bd92a43f3ca715654ffbdbe01feea7ed935b3174455d223319d00cd1518322f1

    • C:\Users\Admin\Downloads\EnterWait.vstm

      Filesize

      506KB

      MD5

      544cbb8be359d79cce14dc6d30ce6a20

      SHA1

      19c72e72433c551318aba0b6791b517ac588b8f5

      SHA256

      9383550b55c978d74508b9b8afe688925794868c5dfdb6761a82f4665f82c691

      SHA512

      d7f178bbba132df1ee43d58cd24896c1c1ce4e2d997f29c74f600b6819308ae83164d3503c536ea0ad152a41567ff97529b8581f56ef2362ce9e8cd2ab0961d8

    • C:\Users\Admin\Downloads\GrantOpen.vstx

      Filesize

      268KB

      MD5

      f684d21319c6eddaf6543e6359a4f306

      SHA1

      e3fe1f9ac6ab41ddff1e67f45836aaf949475c87

      SHA256

      da36776708c1359517e545ea87d9f1c3e20b4ef7c156eed0bcdd5b22de2d554c

      SHA512

      39758fc24da48fc124a8102b583f4865b29c6c29e9a4f46a81486fa22cb047f256b9f1d12a8e4cbf85fa240e12a1c0e6500563a97c7a22acfdce8a68ecffbd0f

    • C:\Users\Admin\Downloads\MountSave.xlsb

      Filesize

      516KB

      MD5

      fc658c09561516e5d68a1d686c998b20

      SHA1

      5471d843b201d87bf5f440178ec1c026ff4dbeb0

      SHA256

      1514b0e73c0a2222dc1dd2d8f946c7908f9698e55dc66edce4b2c9815880d75b

      SHA512

      b490718ce7b03a741bc4451202223b1fd95c9d5d536e15e1890e272c061ba22966fe07719cc08ed06a4be26df3b4989cc0545b37961194730828f3656fc00dc4

    • C:\Users\Admin\Downloads\NewDismount.ppt

      Filesize

      397KB

      MD5

      c71c6346552e2340faacec7d68802157

      SHA1

      02300df311ae409fac771d4853288a17e340b2e5

      SHA256

      a1cb6c023c21c4fb1bf58f65369626e88452b2bd24d33c11f4d8f6e3f977050a

      SHA512

      5a2ac06bda923d5a112b378122ff3495de67b3e0377be07fc1f30a00fafcd2caa275725d7e21822a45c7a0c060caf8553fbcce3c13f066254901943335f947f9

    • C:\Users\Admin\Downloads\NewReceive.ps1

      Filesize

      476KB

      MD5

      6bc94e337b462531b019a28b2edec3f2

      SHA1

      9d2b503c9c2f6e4cbe13b90877926554c99db614

      SHA256

      3091404c74aabc600fd3d130dc400665bf4f0532921c7419f927c6d04cface08

      SHA512

      9869ba1b1ba977dee244c4f8a5d7983db0daebf261f3a91250fb4e46b6c519e35326b5f0c4d40a2ed2b5addf2ebaca05aea81015aa89de40a673d214e70c4382

    • C:\Users\Admin\Downloads\OptimizeFind.dwg

      Filesize

      208KB

      MD5

      0f5eb48805b307fb059ad619b110e16b

      SHA1

      b8b7b9f584abf56ca9b46b3abafeaf5fa3185e0c

      SHA256

      30aee2397e797dfed4dbffb7f4b34a3585eff6048817f415f79536208c3ef5d8

      SHA512

      9349a89e509d5367c03e60c93bc52d965787e98e38161c8d11f26e62fc33c083c4871dc3db8269fd53e148fe543e6072f2f913348bdcfac972b14ec8d2f5ca56

    • C:\Users\Admin\Downloads\PopSkip.xls

      Filesize

      337KB

      MD5

      d1413c80be36b94225f53730da553721

      SHA1

      80b5912ce1ae137e72204a866cd3a70a8a7e3f5b

      SHA256

      84a5edfd541f0310903d9b1c60207bf318bc692cfe4b905fe6fcc385d09c5e7d

      SHA512

      56ca48c27befcf7455bd80ade0de7cda57e5bacc1eccca670de043e808813f233815b9ddfe009188a45ff32c8e5939bf2e5785ecba8485151115e7560ef343ba

    • C:\Users\Admin\Downloads\PushSet.bat

      Filesize

      426KB

      MD5

      6646b21e449ea172b6d43bbbfcd47d40

      SHA1

      43bfb0db851a346ef46ba68a96acbe087dbb03bd

      SHA256

      c0c9a3f5dd16997305d1a895b8cbd096df0e69f5a2970209a4d1ddbf0262e2ea

      SHA512

      9888524e13d9a1326147226db3ccb5d2e94a28853b6992a02f190c8df72e97d14dc2f899c5246695640bb7da46d5e29e57163aa9c928d6eac17121c922478df9

    • C:\Users\Admin\Downloads\ReceiveSelect.ods

      Filesize

      357KB

      MD5

      3b52d9235a70d141162c9492e0768323

      SHA1

      c4a4a6951701d2843f547b8a9ac22c3eb5fc56ae

      SHA256

      ad438efe68ab73db28647948ce03cd8393369b2037a401d47629330553a54d12

      SHA512

      0d27c643748319e8cfa4c8557b054cb8a4e0e8c8f928a1fdb63d543851806f444db2e69687274407d6458eab2db56d565118784af1e6382499540077b33b77e7

    • C:\Users\Admin\Downloads\RenameDisconnect.dotm

      Filesize

      546KB

      MD5

      cfa9e8343fc36a6c97181ab18de2f363

      SHA1

      3389cb5e0af4057172dc264ef5cc0c28fdb5e7a3

      SHA256

      239896001d615f79fb273050b767fb7bebb02fdd1faaf9fced073573e1ce38d5

      SHA512

      28c3fdd3431753d2d2e1d23d6e0b43656de71dd7812c83ea730dabc9d5ac3d185b5f88e5a09d8852d115cc12c5685bc460d3496e0e71e420548a500a733620fe

    • C:\Users\Admin\Downloads\ResizeUnregister.xsl

      Filesize

      317KB

      MD5

      34a53109c79a0b598be834a9fb3a704c

      SHA1

      b447c637df944403845d082aafbbf636ddf7b351

      SHA256

      00fc0ec45c2f06a33209033a3f79ac28b13950fc25d18f53f4f6f5cfa94e6388

      SHA512

      e349e471092ef567dd2f9107d80b1b9ff11f841cc02cbb5690369f6bac2b1de433e59cd5879e4fe8d050009b37d2e362efea161e52afbfc2b783df6262a47dbe

    • C:\Users\Admin\Downloads\ResolveRegister.ini

      Filesize

      228KB

      MD5

      4b77694aa702fdf0f2897f90c99a98e4

      SHA1

      3d16b11ff3efada0f296006323b806ef76e435c6

      SHA256

      0bb1a5c38757a059a00a19cadb2eb301567391cba5fc42cc13583695148349cd

      SHA512

      2327a57caf38c96a106603d093ddebd82d06a3a4b68f6be9a9ee051b6be6fd5a7a2825ec8a13b851e0baf8563c39655c506763a836780d2d693f4f3197176315

    • C:\Users\Admin\Downloads\SetGrant.kix

      Filesize

      456KB

      MD5

      a3ef9c85226af641910115b6ec7f78d0

      SHA1

      529d53ee48d7f50ee2df15d1afaf108c1d0118bb

      SHA256

      2e3cea3a6669f1d223fd4385b381d4966f6c5546de0e8d8e76fec0cfa3cd0c44

      SHA512

      09c27c0b92788c636cef643c56ea8d8b433938e130c0948c462937e28a0b5aab89e3e029854e8718971afd128b2f714e9dde00c1a8659f3e5895d103fb3eb5e0

    • C:\Users\Admin\Downloads\StopSkip.WTV

      Filesize

      198KB

      MD5

      bd7b95aee6d2063f475a215fa26dde4c

      SHA1

      8f4a4710d055e759fa43e8389d5653f9c84b8977

      SHA256

      7ff65b047bd57d1eb858df68c95b8d6ea8a01ee8de41b3003f174c05bfc380f1

      SHA512

      e4803d8ab6a6a41f22664f09fb9cdbab05621e3c3b4d55745131aa415febc13e83b39cabdde6057fd022247f6f146da0ddaf070e06c93c899481c59b95add6a5

    • C:\Users\Admin\Downloads\SubmitCompress.zip

      Filesize

      466KB

      MD5

      bbb78a631ff88acdcc829feec80746bf

      SHA1

      b03ed6fdc16c69ab988b8affd2d58b47d98a63b6

      SHA256

      d76d410c546cbfd981699a63a01983a608800ddc1217d61ff02c1a33db87fe46

      SHA512

      a931c77da48c507e6027cb5254bf85ff4718008017115eaa67ab6903ec1a1bd74bd51c3cbc17286447352e124d9f99c4a6aa27276ec1e3fc567e9c0672f7c39f

    • C:\Users\Admin\Downloads\SubmitConfirm.mp4v

      Filesize

      258KB

      MD5

      f6ef4311a896696ea81862179ef1cc89

      SHA1

      da1ba95a8731b716d05ed96344d79003058eb99e

      SHA256

      9cfb1656831c31d31230533275eee1d90906f24b379cd419f0bb2f138a807b94

      SHA512

      1fefe2791b93d803f4d4c5d7915603080f729aa91855943926658738b85de1a51d9557201727701cc46061189ef7de08aac26c776d8a5ca839a5f8503a3cbafd

    • C:\Users\Admin\Downloads\SubmitDebug.cmd

      Filesize

      377KB

      MD5

      838ac019c6a2c8abc2b43a46113b37ee

      SHA1

      7baa1b3422fd93923469e702c9bc2afd38c9b6cf

      SHA256

      afd8131b42de1c774d78f44aa05954258d0a80db86a832ec0a798921717443e6

      SHA512

      4310855aa0f1c552cd3961042154c5b0565a94bdabb0d922d35582fdddbcd4e92658e8dd6df3e756722e3274fb3e0fd07bf8588c46319780de3799f0d6f4d9d1

    • C:\Users\Admin\Downloads\SubmitPublish.cmd

      Filesize

      277KB

      MD5

      25f72a6f9a08cfbe47d66e4874596fbf

      SHA1

      43e053e5f86c0001fecbd221fe55e280bafe4b5b

      SHA256

      2e9e01a09a7cce1698966eb345cdb05296e2aa00d172a5c51ab2af80d0b73f14

      SHA512

      aa29f26a409a74f515fbdca15e25971a7a6415ca2496c7bfe0dcdab58f51916f8488c2d2f94e7a3f0a381bc94854c76502bb4ab650fd73cdae13589c5a0b92f5

    • C:\Users\Admin\Downloads\SubmitSuspend.au3

      Filesize

      486KB

      MD5

      e94981e740ed6e4dd7487603f031b167

      SHA1

      45a2bcb92ccbecd8ba172f72c182d2e8673cc4cb

      SHA256

      14ad1554c552049dd8c9ea48290e84f079d228a63705c998600ea5f2da06e49a

      SHA512

      95e355fb766a2e71180521a45d45c23c515de1ad86b26a0412e9382608c33802ba89da3b464cfb215eea5c007402169c2a00ad3f833de0b6cafef775b00b4f38

    • C:\Users\Admin\Downloads\SuspendClose.xlsx

      Filesize

      218KB

      MD5

      8f716ef3a495216b139e04064807ac02

      SHA1

      088971822414c3b474379e17e6104c4167de5bbc

      SHA256

      f6a6095215da6ebc454426fa1171955b39fb48355ea5fdff83f2438adf23585a

      SHA512

      47bb4240bc86eddbc72aad153f2a978f533f4b864d41427fb3261ead7315f04a44efc0108228f132d0dc6a0cad95fd8d9751cadb347782959ac03fc135a4cdae

    • C:\Users\Admin\Downloads\SuspendOpen.ppsm

      Filesize

      436KB

      MD5

      d910bd1dc6b6fe97cd32eaed73a85bfe

      SHA1

      bbd9a8805b343c3ebc9622f335e5de8147756b8d

      SHA256

      f8458d4779e5901eb588c47f492d7f083bbe202c20a6f9b0211959340f1160dc

      SHA512

      aa50a0a945518d6d4717902cebbcb519f01a459cbaadd42069fddf3a077e900fd5f15ed0a5d30c71017b9779e5d1dba3fd9c61fba3cf7760427df8a9221e4333

    • C:\Users\Admin\Downloads\TestReset.M2TS

      Filesize

      188KB

      MD5

      f5ff167720f7fc44d77261dd89991839

      SHA1

      eeeac15f64900b2b3e1cdcdf091e7576383e2210

      SHA256

      10c75977d603d06e651f02cc9b6ced31e81de18819e10137c304362f7521e388

      SHA512

      38badd495b0cdb7296b537377162e2443c8ac390cb84f97a9b2c7f5491aef2042e83b3ab6971dbfc4091604db7699979a1139f1c7be0f700337fe9ab5722ec3f

    • C:\Users\Admin\Downloads\UpdateMount.dotx

      Filesize

      238KB

      MD5

      ccab7843e4df3ffba316146943f290c9

      SHA1

      e52f57f7b8d0281e03af4ee10e42b314f1e6adc7

      SHA256

      49e0ee0c68d8efc9e55debb2148c6452849cfeafb834df8bf4e1b1949af73e44

      SHA512

      d4cbd8ed4058549a294c7015647498723bd8f720f68e6cb6396d3a918995401f181e79a5148a77bd5c127df7c1d244fca8499c6344979ccbb16ac2608c5f49cf

    • C:\Users\Admin\Downloads\WriteCheckpoint.ppsm

      Filesize

      347KB

      MD5

      9f242e8019c8026c2bc8dce6ef08b309

      SHA1

      098cc9237f42c85f13952edfb3f665475ca664fb

      SHA256

      e9c16077993da68b42d7060fb0cdc80d9332cf795a1a087cf714bf3a4b35fa3c

      SHA512

      c251545cb27b2f8b9a76d8e1053c1f6ba195dd348cca874f5bf9a2f4ddd5933d09d9a796984419e09ed5caf19f2b240a7a4774ac068fbd053978805843a0f4a5

    • C:\Users\Admin\Downloads\WriteMount.wmv

      Filesize

      407KB

      MD5

      6100bcc9e4538d985c3ad49d31a36704

      SHA1

      88d3658623e453a9aa3162f4cbda770bb8e22716

      SHA256

      319f3b06944d1083ffa963896b735a9928e11b9e64e1533ffa66cdcabd342814

      SHA512

      49b00cf79fcd3bdb68005fcfe0b52fbb594353a042f83f57d73e31093be83a959e414119514187fbd402e9739836f95c305fd5be1b885010f3f38a84dcecdc87

    • C:\Users\Public\Desktop\Acrobat Reader DC.lnk

      Filesize

      2KB

      MD5

      ada1acc25e30565d5f61e31812d5f589

      SHA1

      4110e0f7e17d749d2b246beccc56bfac8842796c

      SHA256

      d7160f8583e1f7fe4ce42b950f11a226f53de4f421548996988bd9eafd07c1be

      SHA512

      57f2d4c1c9960910cbbabd096283bd69d3180fb7ec4a21e0046155c8d2ec5bf4dc60a59f4aa59ec854db7d967057db3c1712e1ce7cccbd4737b3e160b3d4d076

    • C:\Users\Public\Desktop\Firefox.lnk

      Filesize

      1000B

      MD5

      4a146f881b23fd4eee8b6e15b09f0468

      SHA1

      44a13d9157b98ec876d3fb2a5184a873b47db7a1

      SHA256

      352a5771e6745548556358872648fc97ac9a522b0f586607b91af0feec0c1699

      SHA512

      dc3e50df5a526359675d15b123135d52f1a7095128fbf1ade9e44d79063da52cc952daa3420488981b3b0565b85ffd258170e6dae53c8ee3087af1def3d6dca1

    • C:\Users\Public\Desktop\Google Chrome.lnk

      Filesize

      2KB

      MD5

      bad90b0910986e4ae79e6b9bfdfa5201

      SHA1

      8871a2c156420b7b392179e108f523946e51cace

      SHA256

      ba1f258c958a240ca480aa42e440ae7db84ac63c2618cbb532a1c53e5ae86c91

      SHA512

      9b70a72d5ea07f187976ee1715de43b42eaad9383fcbd0aec0cca5ee65e3d78dd5dd12e290bb0174b261422a5f30586c7968ae7174050a43f05b5ac3b524a04a

    • C:\Users\Public\Desktop\VLC media player.lnk

      Filesize

      923B

      MD5

      f8f0cb60760623cf281cfc7d209f425e

      SHA1

      fa81f183f49cf98ea262d03ed84dc2b6f4fe4682

      SHA256

      b70a52fcc759ee321d9cf7eea6b0795e04635260c8988aae5712a79076507f0b

      SHA512

      e3e4acaa3762d88ecfd01bb34789fa87f7cce27f262ef9e1e6b851d14e825b6c33b1a1f1990189daf181c3066cdbbe342a88da917b0010400e4367d70b85348d

    • memory/1764-20-0x00007FFDEC050000-0x00007FFDECB12000-memory.dmp

      Filesize

      10.8MB

    • memory/1764-0-0x00007FFDEC053000-0x00007FFDEC055000-memory.dmp

      Filesize

      8KB

    • memory/1764-16-0x0000022CF9EA0000-0x0000022CF9ED2000-memory.dmp

      Filesize

      200KB

    • memory/1764-15-0x0000022CF9E50000-0x0000022CF9E9A000-memory.dmp

      Filesize

      296KB

    • memory/1764-14-0x00007FFDEC050000-0x00007FFDECB12000-memory.dmp

      Filesize

      10.8MB

    • memory/1764-13-0x00007FFDEC050000-0x00007FFDECB12000-memory.dmp

      Filesize

      10.8MB

    • memory/1764-12-0x00007FFDEC050000-0x00007FFDECB12000-memory.dmp

      Filesize

      10.8MB

    • memory/1764-7-0x00007FFDEC050000-0x00007FFDECB12000-memory.dmp

      Filesize

      10.8MB

    • memory/1764-11-0x0000022CF9810000-0x0000022CF9832000-memory.dmp

      Filesize

      136KB

    • memory/1764-1-0x00007FFDEC050000-0x00007FFDECB12000-memory.dmp

      Filesize

      10.8MB