buran | 60b290310f67adb0ae186b4b938ca466a6b55653b2519261fa425127f5500a1f

Resubmissions

12-09-2024 02:23

240912-cvfznswere 10

04-09-2024 00:09

240904-afvheascla 10

03-09-2024 18:57

240903-xl8csavfrb 10

03-09-2024 18:12

240903-ws828asgnm 10

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ransomware/default.exe
Size

211KB
MD5

f42abb7569dbc2ff5faa7e078cb71476
SHA1

04530a6165fc29ab536bab1be16f6b87c46288e6
SHA256

516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd
SHA512

3277534a02435538e144dea3476416e1d9117fcddef3dcb4379b82f33516c3e87767c3b0d2b880e61a3d803b583c96d772a0bdeecbfc109fe66444e9b29216af
SSDEEP

6144:zia1vcaEaA+HPsISAzG44DQFu/U3buRKlemZ9DnGAeWBES+:zHctWvVSAx4DQFu/U3buRKlemZ9DnGAn

Score

10^/10

buran zeppelin defense_evasion discovery execution impact persistence ransomware

Malware Config

Extracted

Path

C:\Program Files\Java\jdk1.7.0_80\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] or [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 993-644-0EB Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
ransomware buran

Detects Zeppelin payload 8 IoCs

Processes:

resource	yara_rule
behavioral15/files/0x000800000001904c-59.dat	family_zeppelin
behavioral15/memory/1712-92-0x0000000000E00000-0x0000000000F40000-memory.dmp	family_zeppelin
behavioral15/memory/1952-107-0x0000000000380000-0x00000000004C0000-memory.dmp	family_zeppelin
behavioral15/memory/2688-5031-0x0000000000380000-0x00000000004C0000-memory.dmp	family_zeppelin
behavioral15/memory/1216-11930-0x0000000000380000-0x00000000004C0000-memory.dmp	family_zeppelin
behavioral15/memory/1216-23686-0x0000000000380000-0x00000000004C0000-memory.dmp	family_zeppelin
behavioral15/memory/1216-30230-0x0000000000380000-0x00000000004C0000-memory.dmp	family_zeppelin
behavioral15/memory/2688-30264-0x0000000000380000-0x00000000004C0000-memory.dmp	family_zeppelin

Zeppelin Ransomware
Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
ransomware zeppelin
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (7388) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

Processes:

notepad.exe

pid	Process
2176	notepad.exe

Executes dropped EXE 3 IoCs

Processes:

TrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exe

pid	Process
2688	TrustedInstaller.exe
1216	TrustedInstaller.exe
1952	TrustedInstaller.exe

Loads dropped DLL 2 IoCs

Processes:

default.exe

pid	Process
1712	default.exe
1712	default.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

default.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\TrustedInstaller.exe\" -start"	default.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

TrustedInstaller.exe

description	ioc	Process
File opened (read-only)	\??\Q:	TrustedInstaller.exe
File opened (read-only)	\??\P:	TrustedInstaller.exe
File opened (read-only)	\??\N:	TrustedInstaller.exe
File opened (read-only)	\??\G:	TrustedInstaller.exe
File opened (read-only)	\??\A:	TrustedInstaller.exe
File opened (read-only)	\??\V:	TrustedInstaller.exe
File opened (read-only)	\??\T:	TrustedInstaller.exe
File opened (read-only)	\??\M:	TrustedInstaller.exe
File opened (read-only)	\??\I:	TrustedInstaller.exe
File opened (read-only)	\??\Z:	TrustedInstaller.exe
File opened (read-only)	\??\R:	TrustedInstaller.exe
File opened (read-only)	\??\K:	TrustedInstaller.exe
File opened (read-only)	\??\H:	TrustedInstaller.exe
File opened (read-only)	\??\E:	TrustedInstaller.exe
File opened (read-only)	\??\Y:	TrustedInstaller.exe
File opened (read-only)	\??\L:	TrustedInstaller.exe
File opened (read-only)	\??\U:	TrustedInstaller.exe
File opened (read-only)	\??\S:	TrustedInstaller.exe
File opened (read-only)	\??\O:	TrustedInstaller.exe
File opened (read-only)	\??\J:	TrustedInstaller.exe
File opened (read-only)	\??\B:	TrustedInstaller.exe
File opened (read-only)	\??\X:	TrustedInstaller.exe
File opened (read-only)	\??\W:	TrustedInstaller.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
17	iplogger.org
19	iplogger.org

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
4	geoiptool.com

Drops file in Program Files directory 64 IoCs

Processes:

TrustedInstaller.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR49F.GIF.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGTEAR.DPV	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BOATINST.WMF.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099196.GIF.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0291984.WMF.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14538_.GIF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21377_.GIF.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107458.WMF.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195248.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0286034.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Paris	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME04.CSS	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FLY98SP.POC.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Address.accft	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR32F.GIF.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107182.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02407_.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Newsprint.xml	TrustedInstaller.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB3B.BDR	TrustedInstaller.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\ct.sym	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01659_.WMF.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR34F.GIF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImageMask.bmp	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewFrame.html.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginMergeFax.Dotx.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105490.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Horizon.xml.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\WidescreenPresentation.potx.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00601_.WMF.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18238_.WMF.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+2	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Efate.993-644-0EB	TrustedInstaller.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALENDAR.DPV.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01772_.WMF.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\WSSFilesToolHomePageBackground.jpg.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_justify.gif.993-644-0EB	TrustedInstaller.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RES98.POC.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287018.WMF.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153091.WMF	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-windows.xml	TrustedInstaller.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Regina	TrustedInstaller.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\HEADINGBB.DPV.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT.993-644-0EB	TrustedInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21319_.GIF	TrustedInstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

TrustedInstaller.execmd.execmd.exevssadmin.exenotepad.execmd.execmd.exedefault.exeWMIC.execmd.exenotepad.execmd.execmd.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TrustedInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	default.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

Processes:

vssadmin.exe

pid	Process
2644	vssadmin.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

default.exeTrustedInstaller.exe

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	default.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	TrustedInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	TrustedInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	default.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	default.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

default.exeTrustedInstaller.exeWMIC.exevssvc.exe

description	pid	Process
Token: SeDebugPrivilege	1712	default.exe
Token: SeDebugPrivilege	1712	default.exe
Token: SeDebugPrivilege	2688	TrustedInstaller.exe
Token: SeIncreaseQuotaPrivilege	1516	WMIC.exe
Token: SeSecurityPrivilege	1516	WMIC.exe
Token: SeTakeOwnershipPrivilege	1516	WMIC.exe
Token: SeLoadDriverPrivilege	1516	WMIC.exe
Token: SeSystemProfilePrivilege	1516	WMIC.exe
Token: SeSystemtimePrivilege	1516	WMIC.exe
Token: SeProfSingleProcessPrivilege	1516	WMIC.exe
Token: SeIncBasePriorityPrivilege	1516	WMIC.exe
Token: SeCreatePagefilePrivilege	1516	WMIC.exe
Token: SeBackupPrivilege	1516	WMIC.exe
Token: SeRestorePrivilege	1516	WMIC.exe
Token: SeShutdownPrivilege	1516	WMIC.exe
Token: SeDebugPrivilege	1516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1516	WMIC.exe
Token: SeRemoteShutdownPrivilege	1516	WMIC.exe
Token: SeUndockPrivilege	1516	WMIC.exe
Token: SeManageVolumePrivilege	1516	WMIC.exe
Token: 33	1516	WMIC.exe
Token: 34	1516	WMIC.exe
Token: 35	1516	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1516	WMIC.exe
Token: SeSecurityPrivilege	1516	WMIC.exe
Token: SeTakeOwnershipPrivilege	1516	WMIC.exe
Token: SeLoadDriverPrivilege	1516	WMIC.exe
Token: SeSystemProfilePrivilege	1516	WMIC.exe
Token: SeSystemtimePrivilege	1516	WMIC.exe
Token: SeProfSingleProcessPrivilege	1516	WMIC.exe
Token: SeIncBasePriorityPrivilege	1516	WMIC.exe
Token: SeCreatePagefilePrivilege	1516	WMIC.exe
Token: SeBackupPrivilege	1516	WMIC.exe
Token: SeRestorePrivilege	1516	WMIC.exe
Token: SeShutdownPrivilege	1516	WMIC.exe
Token: SeDebugPrivilege	1516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1516	WMIC.exe
Token: SeRemoteShutdownPrivilege	1516	WMIC.exe
Token: SeUndockPrivilege	1516	WMIC.exe
Token: SeManageVolumePrivilege	1516	WMIC.exe
Token: 33	1516	WMIC.exe
Token: 34	1516	WMIC.exe
Token: 35	1516	WMIC.exe
Token: SeBackupPrivilege	2008	vssvc.exe
Token: SeRestorePrivilege	2008	vssvc.exe
Token: SeAuditPrivilege	2008	vssvc.exe
Token: SeDebugPrivilege	2688	TrustedInstaller.exe
Token: SeDebugPrivilege	2688	TrustedInstaller.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

default.exeTrustedInstaller.execmd.execmd.exe

description	pid	Process	procid_target
PID 1712 wrote to memory of 2688	1712	default.exe	32
PID 1712 wrote to memory of 2688	1712	default.exe	32
PID 1712 wrote to memory of 2688	1712	default.exe	32
PID 1712 wrote to memory of 2688	1712	default.exe	32
PID 1712 wrote to memory of 2176	1712	default.exe	33
PID 1712 wrote to memory of 2176	1712	default.exe	33
PID 1712 wrote to memory of 2176	1712	default.exe	33
PID 1712 wrote to memory of 2176	1712	default.exe	33
PID 1712 wrote to memory of 2176	1712	default.exe	33
PID 1712 wrote to memory of 2176	1712	default.exe	33
PID 1712 wrote to memory of 2176	1712	default.exe	33
PID 2688 wrote to memory of 1216	2688	TrustedInstaller.exe	34
PID 2688 wrote to memory of 1216	2688	TrustedInstaller.exe	34
PID 2688 wrote to memory of 1216	2688	TrustedInstaller.exe	34
PID 2688 wrote to memory of 1216	2688	TrustedInstaller.exe	34
PID 2688 wrote to memory of 1952	2688	TrustedInstaller.exe	35
PID 2688 wrote to memory of 1952	2688	TrustedInstaller.exe	35
PID 2688 wrote to memory of 1952	2688	TrustedInstaller.exe	35
PID 2688 wrote to memory of 1952	2688	TrustedInstaller.exe	35
PID 2688 wrote to memory of 2972	2688	TrustedInstaller.exe	36
PID 2688 wrote to memory of 2972	2688	TrustedInstaller.exe	36
PID 2688 wrote to memory of 2972	2688	TrustedInstaller.exe	36
PID 2688 wrote to memory of 2972	2688	TrustedInstaller.exe	36
PID 2688 wrote to memory of 3052	2688	TrustedInstaller.exe	38
PID 2688 wrote to memory of 3052	2688	TrustedInstaller.exe	38
PID 2688 wrote to memory of 3052	2688	TrustedInstaller.exe	38
PID 2688 wrote to memory of 3052	2688	TrustedInstaller.exe	38
PID 2688 wrote to memory of 1928	2688	TrustedInstaller.exe	40
PID 2688 wrote to memory of 1928	2688	TrustedInstaller.exe	40
PID 2688 wrote to memory of 1928	2688	TrustedInstaller.exe	40
PID 2688 wrote to memory of 1928	2688	TrustedInstaller.exe	40
PID 2688 wrote to memory of 3004	2688	TrustedInstaller.exe	42
PID 2688 wrote to memory of 3004	2688	TrustedInstaller.exe	42
PID 2688 wrote to memory of 3004	2688	TrustedInstaller.exe	42
PID 2688 wrote to memory of 3004	2688	TrustedInstaller.exe	42
PID 2688 wrote to memory of 1664	2688	TrustedInstaller.exe	44
PID 2688 wrote to memory of 1664	2688	TrustedInstaller.exe	44
PID 2688 wrote to memory of 1664	2688	TrustedInstaller.exe	44
PID 2688 wrote to memory of 1664	2688	TrustedInstaller.exe	44
PID 2688 wrote to memory of 324	2688	TrustedInstaller.exe	46
PID 2688 wrote to memory of 324	2688	TrustedInstaller.exe	46
PID 2688 wrote to memory of 324	2688	TrustedInstaller.exe	46
PID 2688 wrote to memory of 324	2688	TrustedInstaller.exe	46
PID 2688 wrote to memory of 1744	2688	TrustedInstaller.exe	48
PID 2688 wrote to memory of 1744	2688	TrustedInstaller.exe	48
PID 2688 wrote to memory of 1744	2688	TrustedInstaller.exe	48
PID 2688 wrote to memory of 1744	2688	TrustedInstaller.exe	48
PID 1744 wrote to memory of 1516	1744	cmd.exe	50
PID 1744 wrote to memory of 1516	1744	cmd.exe	50
PID 1744 wrote to memory of 1516	1744	cmd.exe	50
PID 1744 wrote to memory of 1516	1744	cmd.exe	50
PID 2688 wrote to memory of 1740	2688	TrustedInstaller.exe	53
PID 2688 wrote to memory of 1740	2688	TrustedInstaller.exe	53
PID 2688 wrote to memory of 1740	2688	TrustedInstaller.exe	53
PID 2688 wrote to memory of 1740	2688	TrustedInstaller.exe	53
PID 1740 wrote to memory of 2644	1740	cmd.exe	55
PID 1740 wrote to memory of 2644	1740	cmd.exe	55
PID 1740 wrote to memory of 2644	1740	cmd.exe	55
PID 1740 wrote to memory of 2644	1740	cmd.exe	55
PID 2688 wrote to memory of 3068	2688	TrustedInstaller.exe	56
PID 2688 wrote to memory of 3068	2688	TrustedInstaller.exe	56
PID 2688 wrote to memory of 3068	2688	TrustedInstaller.exe	56
PID 2688 wrote to memory of 3068	2688	TrustedInstaller.exe	56
PID 2688 wrote to memory of 3068	2688	TrustedInstaller.exe	56

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Ransomware\default.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware\default.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -start
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -agent 0
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:1216
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -agent 1
    3⤵
    - Executes dropped EXE
    PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3052
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1928
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3004
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1664
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
    3⤵
    - System Location Discovery: System Language Discovery
    PID:324
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1516
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      System Location Discovery: System Language Discovery
      Interacts with shadow copies
      PID:2644
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3068
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2176

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.lng

Filesize
23KB

MD5
d3fe8ae043863ad0c0db28495b24aa86

SHA1
3007423bf16c8180b168264faacbeb527ca58445

SHA256
a20052f755256b27a4660fa5c157bb300c5b2bcf77bdcc89e4a9e77ced8fb83a

SHA512
bc80ed1f613209101ff6b44a14663a57db1603ccfb67e83179d47c0faa2a5e1983d8d55333ebd30cf7762fd747ebab531e3eaaca959a26477da6e885921cb4f9

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt

Filesize
29KB

MD5
bf42f6c903526c7dc2dd32f7d046db8a

SHA1
c7efd8b615e695815ac7e5eaea76192ea5615135

SHA256
8f816dc349d0bf81fd83cb9fa7bcfed5865682e3924bffabe1c73a4cc083ed05

SHA512
f0cefa1b8d21019b4b271c235ccca551b732ebe8b321880130030124502e33be20739c70a7a2b1a436b3fe4186eed81eb775703b7c077152464042b0145a26c2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME39.CSS

Filesize
122KB

MD5
48a18e5cb20b20eb4496f09efb8fa3a5

SHA1
d21afe57e8e2443001d202ee81b4acba7ea18ab4

SHA256
5d6fbd823c6c64cf05b6cad6054aa40dc5bb5e33c95149a39ac47356bb5cc248

SHA512
94350aa49727dd1d73c0adf754079ebed0da3acddfe1944eb748736d42f388a2375915ae0e6ff4c971a18f46c557b66d2da329342971b4be3d31c3ff63ea1816

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME54.CSS

Filesize
125KB

MD5
e17695b92430aa16ff418a252def3233

SHA1
c525102a0cf7e9ba03b8d1070d290a0daa1e24d3

SHA256
2a67870b0989cd7c1696a111d93ddd2c8696987b39e07308fdaacaf0ad1af09e

SHA512
278cffb3163c148b3cc415bc84cba024d62de4f48d422b24c4a16a090de744373ea2e09a9e8ea3148984006ec8a9b5091d1d70e23037bf32e356b06a9c2d8da5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\ISO690.XSL

Filesize
258KB

MD5
7448fb545309ed1bd6783407bb66a27a

SHA1
537e56c168938c20127a6dac88b1241153f74170

SHA256
81253a8f2f1de9558a608fde621014326a49fa9be282d27b4d5e6ef3637b0074

SHA512
29e228e44bec2f9c1f80216d65da09a09e6b3ef71ae50830adc90041f09964b61b1be41aefb4cd7af51499549fae8e8314a7292216a83ab5bd8c4eef4552ed94

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DataViewIconImages.jpg

Filesize
7KB

MD5
23108dbed77ec88e2d4ce455ce27516a

SHA1
22e256aeded2fc080a068f55512eb557c94af133

SHA256
f72f980032a2a2134da4fd5085bf601caff3b943ca88f0b95edf13cf8913f528

SHA512
cf5aff80b3f74421ab26cd6035869c9ef4d3d7343a0d949f694badeab8b7607758bc95866954e6bcbf04335a90cce55ac63eb484ce832168e55aee351281ef79

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_OffMask.bmp

Filesize
8KB

MD5
7903ce8c338e55a3e1134d703b25cade

SHA1
bccd79b82a7bdb0243383b363aba828603bce54a

SHA256
d9c8de2170b13eeddb157093c0a2fd8fead0593cc1b80252e6dc09b140cb70fa

SHA512
b70f9163510e36889a6396e15eec577cf09b5dbb58bbed792c191013067d0b039fdc9b06275ec53f7f6739a069f211c1ba599fd2dfefbe2d39a59265f107055b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\Microsoft.Office.InfoPath.xml

Filesize
249KB

MD5
0c11013cbdeeb8dc1641495000fdbaab

SHA1
2f1bebc89497ec38e02bd4aa5880870b67e04b78

SHA256
da395f35962a8c1ecfe5efc148ba336a67ae56bc02900450fc6e0eaad53ee0be

SHA512
27592b8c2cc1f12c748a36fd59e2e50500d27f73c83b1e77847bcf5b12b5a07db90f3ebdda81f8ec69512205bb6f95db98c3b85dabc92159fd7e76dbf3e323fc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OLKIRMV.XML

Filesize
78KB

MD5
26f20144dd1dd5f685a5f15c52ffcd97

SHA1
0920988aae47e92319ac90ae6480518492193c2b

SHA256
da3df4285e5b1539782fb311c6d483ed3356f75b690bc0a125f32548585ecf3d

SHA512
a637a629960631e271186cae208f03c6170e3f7b830a1295bb3cd6df10419b79b87c211d7c0668ffd59a7d3e5f94d87ee951b7bdc40ffceaa4f4effc5840ab7b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\WORDIRMV.XML

Filesize
78KB

MD5
f4b46638be702ba153286841cc08cd45

SHA1
d4b9a594ab09f221c8cb2f0c302e25e69f9feebc

SHA256
5caf9bed2a611a3f8abde5d56e5f5508d519bfce628f7e8612cc8f9e27c75113

SHA512
060519a647855cac77d4cc5ca8f7a659de21ff88a337d830f089e0c7898e6af244d5231dc151a2520fd69728acdfa44acea87defd12fcff7b086c22a5fa78413

Download Submit
C:\Program Files\Java\jdk1.7.0_80\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Filesize
985B

MD5
7a6dfe568c06a0556f83c50df4109496

SHA1
e2d4636344703704e0ae5a72ad91e28e60326331

SHA256
cf5a8bdb1d5ecd4b92b5c3d81d1a0c6aac2fdbc862f390e4104b057c2a7bf6a7

SHA512
6947a12ab425219ea922e13266271378b7e05f34f083bc266a790819bf482a2f9c0414082abfb6b8a102e0b55618ad3057eda71d4b36a8bbe8322c598491f396

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html

Filesize
10KB

MD5
bc3f433b55c255744b3c4efa58858d55

SHA1
78e461e9232f3fba24ed8f4cc00b0d457227ca58

SHA256
3eeffaefe75c51395a340ad8e68f0848cbddf7ac7b4370d01373e329c97f5642

SHA512
949c8e36b00d92d6c2b2758a025c8914ac0407d46e24a6d649480ce97c52a2522c4326d1e32186f940e3a9b054caba501d58cf63d66c54522f524dc2027cfd3b

Download Submit
C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo

Filesize
609KB

MD5
0324010a1ec20513143c59f1f7bc3952

SHA1
2f0befa92424ac953fdc874f53075a7569e95904

SHA256
b9375279083fff899f9ae8a1ce4bcf75e6df4640466c5403f2f2df0307ebcd84

SHA512
713a5f492087bbc4ea066c69570aaf3e19da64dbaa98273ba849734e01f2bf583d4c24be7a0319acca117fa92181f17e1044443275c12051c7c4a601f697ec06

Download Submit
C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo

Filesize
615KB

MD5
f792babbb75fb9332474f7ffc800c409

SHA1
850dd877d306242b6bbadc43479285c07f072755

SHA256
072a00c92607c081a1532d19991a9e297d49ad6f4d27bd194ff4acd99798c141

SHA512
9359b67f403c5392e938f1efe71782acbf4e151dba6f7d5bfca30363f40e0fd69a1678f1a745719d4cadd12c333442c62681b8095e9a41aa52f554141fc6f6bb

Download Submit
C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo

Filesize
612KB

MD5
eb3bb490d3d472072b0f7c8734d40227

SHA1
e530bd9c1dd641416f99b587c55514763eed4b1e

SHA256
e53cc4bf7ae13950192dc1534cbb7c661a32ad6d5665c1a0a08f9133ef71b65d

SHA512
ba8a7c59af5e5d7d9c9fc9e9688f8ebd05a3528284c88d7c365e0452a2ab2efe0e8c1654746e4dc97bdac56d50ddef987b11332407f6c4d5a78a914b0a9cbda8

Download Submit
C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo

Filesize
613KB

MD5
3d948ea49817b639feca2fe88346a3d7

SHA1
ad2c42739678089b7199a7683701f13b7e9f2f92

SHA256
8f950b6fe4bb59b3ad0f06a5f36a21ec95f1e6e38621289a5fa2decd1e25dddc

SHA512
5c92dd38ea7424eca74fdf719e942048e0c6ffe70d0301f4d4d390c430d2bcc0e5efff0b279e74135135b96599420cd99508b2b18bf1ed57e3c0479d59829f40

Download Submit
C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo

Filesize
579KB

MD5
cb5acb496d998ecc769ba6c406246a06

SHA1
c97d753d7bbcbc7537363e8864bf17d63b12e3b2

SHA256
f96d517b3774f96efcdccf62f9b44bad5c1d57a21c40ab6fffc7c13cde3680d3

SHA512
7bec463e97733da63fbf6dc7a64b683c899d4909217f1553f5e35b42698ab313df453c51fe3be5c459f58d13cc8ad273ae8b948729ab7df63defdb12c7056e4c

Download Submit
C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo

Filesize
615KB

MD5
eec6eee529bc7bf42ca4291962ca6bbd

SHA1
b8eafbef4e2c17e258b961b0279bc529b6425e01

SHA256
30a919ea1ffc51e9e1c0ce74439b38ff130191a0c886526e745c2f1eb5bf954c

SHA512
e9796a59793504adc5e08c212bbad465be33b93229bffe2f7b787e44ad7012f0631d6f090f1524e95330c4630b50798f10993a91e160e1d9bac2d5b5798c2bf9

Download Submit
C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo

Filesize
552KB

MD5
fd0346f289bba966399d882f9c896936

SHA1
2d1720a675bf7003e467284be27278888b24f1c6

SHA256
4bbcafbc43fafc5032d1761c54be0036fef9b14872f92b59dc47d09cd9df879d

SHA512
21fb760943416160a1edd10eb6a021f379f9c796f8b2fbb90e6c5bd8bd4eeaf394becd541bea0c17171f8c256b76e81e35f8a208214a8df8edf1e56a4207693d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB

Filesize
2KB

MD5
e496751cd2219f672baccfe069c05607

SHA1
d43326345986e0c3a25bcfef2febf570a1794915

SHA256
272f89d727d01fec581fffb1a38e02ce025eb523663aa3e102f77ae9aa9e0f1b

SHA512
e84c7c29f3aa5b2184bd6590f3660ec3c67b5814e226f4f7c4ae9bfb11080ab0eb2fe43697710bd64beef869e368fa1ddd85495f7f92b0ff6a61a9c59264b5b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78

Filesize
472B

MD5
d554992d4494a99ee1cb814b6a475ac0

SHA1
28f5679ab12b98f1e1cb1db81cc45d2e81bd7eae

SHA256
2305f09094b346b7d121fdf848cd807e31fd3d788e1dd12bab77963dd792c0cf

SHA512
00da55828c7237ce5086b21b0bbeaa73c45ce13b974fc5881e4390d78118721abe690879b21c7b638bbfba7c001d06ddec2db51bd287dd8d8c129f69ee7b2e76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
d8e9a72a6c3f0f85aa9c1191fd7f475b

SHA1
6ca59986f7442dd4cc86f8d9ccbbe60bf0bb5521

SHA256
7be0516557405ce6902e0029557412f8c439745532018adc581770b4177edaa3

SHA512
186de583be2ab6928a31ca38fd6419437a26a3c7c75c854818ccf48ec6d79fa76902cb1ed0168772d4aaf817a26263b8f0a2d9dc338d86d5fa2433920fc16bd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB

Filesize
484B

MD5
6083acef90a172e66ac552463d0af143

SHA1
03c4ea82a4d9ad43133c5cf90c170c7ad35a73cc

SHA256
4b8a2484ecbd82250b62392b38c8c98ab0da321705cae9c24147f480ca9e65f5

SHA512
9d807cfcca66b388a06c077a51af6966856e0e48e76e198638adf62f4424f5d424dd32ad228aed538106b066e9c31e60d95a66abc121b804805d757e32a06f1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78

Filesize
488B

MD5
8cc748bc27822fa840314c0e75165996

SHA1
d93ac5a70dec1087c9d33f9fe9295b91da48a5c0

SHA256
13495714c85a1dc5bf25b12aafad8db42a3182139e21578efe42907e940eed29

SHA512
60d16289b44c2f20fcc20030f0df722bb1f0ee3460bee927bc72aa18506d9caf066bcc5b83d5ccb473296addc6dd88540743726ecfdda31a37ba5860f60caaae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed63db033b8f29d1bfc8a6580b37ed19

SHA1
19c98b0949b97ff4218758da01e9c9c8616b5c22

SHA256
97f8a224fb378e18b503eadbbc49615655f1145f08935307b465f47ef0400cfe

SHA512
210b139f371d8cbb9663c5d41b25fd8fd7263c17d9938502ec1b9b790a550720bdb192c6dcd3814e8944adbd0beb26e0fbe6ee54e884ea597ad4d9cc43e5c18d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
9e2464b891f77c1dbe3acb5de867d71c

SHA1
851980c35b0f32966277b907e16cb2532ca4b8f6

SHA256
11c5285b79d864258a6cde6e93f1f593029b26b85e1ae53a4d0b5530bba88a6b

SHA512
ec4a746ff9a42b3108418204ebc24b77794b5b87ef81fc58bf08a78259be1ec958111b80c79beeb2a5b85b2ec5974022f59924f69ee056688fd1d2af3b332f6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\633SXO0D\3TAK8DAA.htm

Filesize
190B

MD5
6ebbeb8c70d5f8ffc3fb501950468594

SHA1
c06e60a316e48f5c35d39bcf7ed7e6254957ac9e

SHA256
a563426e24d132cd87b70d9cb5cd3d57c2e1428873a3f3eb94649cf42e37b6a1

SHA512
75cfab1c9f5a05c892cf3b564aed06d351c6dc40048faea03ae163154ff7635252817d66b72a6ef51c4f895eebf7728f302df51148acce2a0c285502bf13652c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PLSLTMYI\ODTZHOSO.htm

Filesize
18KB

MD5
3c9fb9fbbdd372a9ab7f4e11cde5e657

SHA1
06f7b35568d81ca65e30ac213ff1031220ac090f

SHA256
f363ad44f70cd532e08a53e7ea0323f68d2b58b448349034ccc3dc3b0a96296f

SHA512
dd585b080863512a9a933e39d7542b13b3501f43ddfbd153e266964c37846e4d7ebd798512f705457c2be74a80a1d0aaf98c11ba5e6c2ca3f07f29eee1f68fcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCC27.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCC49.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Desktop\AddEnter.clr.993-644-0EB

Filesize
458KB

MD5
6df630d495cc04e63671c30e82d9e196

SHA1
80d793886c51ff45e330ef6089461c363b853a1d

SHA256
93f4208919e9b6961f0c2ad485f609eb37933ec448ce4b06562067ccf7169b37

SHA512
01ebeeab0dde5a09254733c76c810b9257fe81713799dc46338a365cad565fddc4df2a8a720050925077be61529864f3041f50c3cf69a638307147a367d3f611

Download Submit
C:\Users\Admin\Desktop\ClearTest.3gp2.993-644-0EB

Filesize
1.1MB

MD5
01e9dc1cee15980196939c464a87bf1c

SHA1
fbeb6cf9ccf35537ebfb8fc55067e9af4d0ea10d

SHA256
2e60017574d70ced5d379bbbd682ecd62a7747fd09c74feda70381d533c7af66

SHA512
bbff5e475d59f23235ad88cafb037a02d18d1a8563917e472730a48515a36dea994e4a1a88396aeccb442878e77d784ca9f3e4285a32efb2d74e45b9df25ed59

Download Submit
C:\Users\Admin\Desktop\CopyReset.xlsx.993-644-0EB

Filesize
14KB

MD5
41e0bdb409bda21edc2791ee5adac6b8

SHA1
a08fe494b5f75d8b916bc51b8a92099e901657b6

SHA256
a7af343890eb4ed3f40eb095352471389c17b28047a81e7e8c0c247b52035aeb

SHA512
29cc536071a63f476787b8cc9a1df4ed655b56bc09d5f0a9e514923010ff7eee13a52ed80938dc163a9b030a2008b10097c5f2a85c513db19eb624284efe4713

Download Submit
C:\Users\Admin\Desktop\DebugRevoke.zip.993-644-0EB

Filesize
534KB

MD5
11a317a505c71532cac7648d7d3f4f6e

SHA1
f511be5ba7d95579b8d2186e5d9baef2b8b2d0a9

SHA256
49a8cdccdd712f90df4a82f8a5656f0058be8c1d0621e7b5acaf4f114bb72630

SHA512
299489f747bfd128f2399554838b6f912a56ff0fa8ab6c39ca7f78af6cc2e1526305cecd9c399e7f51bb03fe0557c87d5019bd6d6a272b0d1b941affc8ff3f56

Download Submit
C:\Users\Admin\Desktop\EditDeny.xltm.993-644-0EB

Filesize
801KB

MD5
14b10d523aa6189ba953ef30a48040d9

SHA1
a5134bf69b7c94d487e0a584790ef3f35be92902

SHA256
c61e51468cd0501359ceceb01063cf9220f784ee0bb375a1386aea3f34336d50

SHA512
6f473c9b83900242b1ead6bf9b3982f7e69b5f8eacdf0b2b8508a1a82a5af59d394bb79b45e520c045aee09e7cd0ff2a41549d412772815e61ddad9590749ba9

Download Submit
C:\Users\Admin\Desktop\EnableMeasure.mp2.993-644-0EB

Filesize
1.2MB

MD5
2bf303724f57348954135a6c0dd0d4de

SHA1
a43173aff02ce618d1a2781712be206844aad61c

SHA256
a3938e4b63f601a4aa820a60f94cce2b59d45a48a64a8247db7398a49b88c352

SHA512
e386ac8e5fcc8f1099e80d5d2995a3f84188df052c94b8bd5efddcb590adf5684617e142c3366ad643667c50917a78a3eb102f297dc19f7c04590e3cf07426e7

Download Submit
C:\Users\Admin\Desktop\EnterUnprotect.midi.993-644-0EB

Filesize
877KB

MD5
964d3a013913ced44db539f3e4ab0ddb

SHA1
e7d7d26d3a91c0bde4cfe6d5d92b3de6cb7d93ad

SHA256
3c2a79bcd7c40576232627837dac3cafc4e41b657a88f0c088b90a4b48c1d2b7

SHA512
b521ec73bad9c9c44430fbb46194d43e9a6987d11d70ca959ee34fa8245f1426849fa856a8c7535d96fee16a53a996e83b59f1cdd47760a69291d9173a732663

Download Submit
C:\Users\Admin\Desktop\EnterWrite.mp4v.993-644-0EB

Filesize
915KB

MD5
dfb3a96cc5ebcfa61a854c2a24616282

SHA1
baaa4cbea6bbd7aec4d55942a64a68d64520fa43

SHA256
0a3bfa3d5256d5bb205dfbfb536b25c177fe2c8411d1449354b2717062de82e3

SHA512
66fd529ba10f88a2f838131b54de053d23e1fe772a69bec78af64c6c5fd039819df5ea493a6c35ecd27519bf50c78998cadc6d5cd551a5ac98ae7bfa60159655

Download Submit
C:\Users\Admin\Desktop\GetSkip.crw.993-644-0EB

Filesize
496KB

MD5
763e8911669c250b86e8095bdc500c6c

SHA1
f241d4ff8c6be48165585ac876e4adfde462f7d4

SHA256
5f21961618632fa9bfacff5ab1de9e163279d220c8e5206891cb9f5cb90ee080

SHA512
cda378afcfa9061b9bebb7634601e20c9dee75a7395dd25b86e70021238773ce273dfa58376af63232fb212d07a5cb0ebf5fde3ed8f98467644b406d7d04991f

Download Submit
C:\Users\Admin\Desktop\MeasureFormat.aifc.993-644-0EB

Filesize
687KB

MD5
2f5297ef8ac1df44e812846d95250990

SHA1
ffc23335855f4fdb9cc1dedff8b91597706f3c34

SHA256
cae226a9fb414be09e8568fb5ce4d3e4f2e065f5c938bdfc6193c46f9a06cc99

SHA512
6fffc8dc15e5c6a694c9de301fe76abb75105776964d4582fc6245ee9396007651cba8117b1aaf11e16744ca813e3b2bb226c7faed85873f4467e6bad36ff640

Download Submit
C:\Users\Admin\Desktop\PingUnlock.wav.993-644-0EB

Filesize
991KB

MD5
e65013ff8f647cbdecf114ff13b73da3

SHA1
62583975a5f7c6132391a29fdee3f5b77902d089

SHA256
9caa56a39f41fe473dc0268b3eb9e3c13d8a3885c036a49b6b38818be8e16185

SHA512
6d15342e454d42291ece00fe96b4050051ef07bd98964ab98008553210d185541262d7b2e892e671ec66cc68e03a9ff245c6ccb49c4b4f40ee9d94b2e7bb64cf

Download Submit
C:\Users\Admin\Desktop\RedoConfirm.html.993-644-0EB

Filesize
1.0MB

MD5
2a214a7da68e7ed58df31cd137060353

SHA1
63e0f3c386001116df77da27e4a25d5752d7faaf

SHA256
e634f807e3ec1ddb3f98d5049af46a813626f5daa2b6202c6dee194c80179ac8

SHA512
058def148b3719acadffff5658c642132a0a6a5c0e4a87792f9ed891d3e4cc2abcce7616e4f39ba384557da26038a6543ab64f13bc18adcf743a2106638607ff

Download Submit
C:\Users\Admin\Desktop\RepairRegister.ps1xml.993-644-0EB

Filesize
649KB

MD5
e8809b12779b12c1619c88b965644256

SHA1
e98b8bb11e4e69d7d1c81fd31f99db07eceb11df

SHA256
98d1a7db3a17a63564c41edf97b69b2811d7212a128009e8d1c54a912ff00d7a

SHA512
88c9fbcbce7c2d2ae6b732501ab154558a0784c6122464eb46cd477884117d6d550eb9a55851bc1b3b558a0898139e9d467ecc0305ea75ae3bfa03128aba5174

Download Submit
C:\Users\Admin\Desktop\ResetUnregister.ex_.993-644-0EB

Filesize
1.0MB

MD5
d39806ed80403a2345f48b41ec6e0457

SHA1
ab2526fd0ee9ad6d4564bb46605bb81ab26127e3

SHA256
06a345836ab919e9cf8c5ad2e14b9d8694a4b54f1d48595289d57257ea19fca5

SHA512
1378b32f57abe77c7154f2c9b44e97e25c89bdc8c904de6f1d0e0e7fa33be2827b9957b374402fe3045e55ef1d7f130e9f82e59ee33f79274b9a4535bd7f9896

Download Submit
C:\Users\Admin\Desktop\ResumePublish.potx.993-644-0EB

Filesize
420KB

MD5
fc47606ae31fad43006111b1589888e0

SHA1
e066a5389a06ad6dbb602ad6a276b139d844dd18

SHA256
0e6c1a69282b0d58b24671c00e1dd326bdc63748331f1afa01c2e0e2351edb26

SHA512
379245528334af5ea79d59ce801d630d8419c25ddb9a31feaa423e00f72ba2c950e616cbe2b65d522ba850a65d8c68f436575b8b4a591913efa92bfe6615f97a

Download Submit
C:\Users\Admin\Desktop\ResumeWatch.ico.993-644-0EB

Filesize
610KB

MD5
115e9e0a6387e7611a5bd1957887b3ea

SHA1
8b6558049dff4a994c88c6375858afa0c56fadc8

SHA256
876a3f4ca7b614c73a032c72f195f7a10140c8c50b133f1e30fc3e0ebc861932

SHA512
ff254d0a93db090393f454068464fa938409d548d54d0e9a50e53bd25a53b65c08d7e5360583d545b135a6061ee7f5a45199244d54c8da488372cd94dad30b17

Download Submit
C:\Users\Admin\Desktop\SetUnregister.wdp.993-644-0EB

Filesize
1.6MB

MD5
98ab8d48314a9b6d43496dfbf8b8e021

SHA1
ae0adc4bb789883201b86ecd8c7d76701ec5cfd2

SHA256
e1cced73e3043db6cd7ab0934994a575bda85c820dcc71ba0f92c9092a5be255

SHA512
01ca870ddff57054fc39554addc76dfdbd64d3e1e90e209eecc771c602b69d3290fac633f90441253270ff789f1f9feac76f5555ab1761b5f898d144013e3c18

Download Submit
C:\Users\Admin\Desktop\StartUnprotect.001.993-644-0EB

Filesize
1.1MB

MD5
327672dd968c94b0ec60f38907c45be4

SHA1
4202b6a70a1ba584a39651ff5deab27710049561

SHA256
d73c07a5b54e38006009fa8bb32b8e98679a876e6463ad6da19194f0e6e94238

SHA512
64a5825e3e0222385ba042783505956ecd2d601fa75296a8d79ca2f8ff125fdff05caa22b1b3580904b13aa6e5e225160443b68a99f49154e02a82beb39b468c

Download Submit
C:\Users\Admin\Desktop\StepInstall.avi.993-644-0EB

Filesize
572KB

MD5
116244c042cdaebba41eba3337a79b7e

SHA1
2c749be6a3531d3d15019d77544daf075d20c8d4

SHA256
7e3570ce4b3b9923007473f03cf298988d3ee35b53b5e61aad5b7b03dd4fd9cd

SHA512
dcda1a4ee9da545f2c37be7c83c7f26303c5bf4db92d16d5e090d716a07070808f564967c31d9e6e81649edc4c19c60cfd2a9cf194dabec1c6a1bfc093d2234e

Download Submit
C:\Users\Admin\Desktop\SubmitInstall.xlsx.993-644-0EB

Filesize
14KB

MD5
da6b10a5afce12ecaa01deaf76cf52c0

SHA1
fed1c93655001b9fad898772b97ed03a8404f216

SHA256
1d1e058b05012e92a22c1807a0b1dcea3d5e2ede4ea0eb2240d0d802c01d68c6

SHA512
125de4ec70fea65f686601240617973d80c72d97be2c0d657f080790a696cfb0ba8163d746c635b8b80c7942ca1c1541382cf171bb355342ef2b4e7a52aa97e3

Download Submit
C:\Users\Admin\Desktop\SubmitRestart.docx.993-644-0EB

Filesize
18KB

MD5
524b98a627e3cf6ec4cc5d2572ac7cfd

SHA1
e6cadff4ac3576b7f2a84cc6c2d92f080bb531c0

SHA256
ead217f5bc1b29e42c38c75e55afb29c63a58d310fd4126d97d9e7a916be401f

SHA512
87f7174726ab872bbf4505921caf448ad369b94316a8bbd5a1fe35be41e34db42f728ed471cbb117a0f3c50b2067abe130364475e6ad3f6d2f12e877b01800cf

Download Submit
C:\Users\Admin\Desktop\SyncSelect.avi.993-644-0EB

Filesize
763KB

MD5
6c39704671434ee6ffb92a9ae52a0826

SHA1
02d9a5c3c3584a36b4702d28c3f82956d2aebcac

SHA256
4fa6644996f957cebc0a44993f0751d7232fb8dc6ad04ac5076af5aff8ebccf6

SHA512
bc5590ad1f8c9dc878453552b72fd18e94f4b1a4879e1686deeb51d727c371d43bc12d2f2630d4ff5b38e406d3e23a8d500e09910eba54e38297349b01ec23cd

Download Submit
C:\Users\Admin\Desktop\UnpublishDebug.xps.993-644-0EB

Filesize
839KB

MD5
bfcfcd9aff35eef23c2cb5257dbd3849

SHA1
cb9bdf31bb7d32d1b6c2e3b50eb09c665a311422

SHA256
b8f7817d2d63ca8cf6af2872592fd8b204a560575a320cfbbdd1a6ac332b90fb

SHA512
d2f49597db02dbf62d0af73ad5c24dc7be161aa226a2d2e38dac7844646172175d7b91c71a9ff95719f5841a8403f497e1c902c685a65528dc7eacc9b27104a2

Download Submit
C:\Users\Admin\Desktop\UnregisterConvertTo.docx.993-644-0EB

Filesize
15KB

MD5
7cb69d97dade24a14882171f52661323

SHA1
04b7056559085a2c9162ec9e6c0d5004ac246afa

SHA256
435c798a699fc257785fcae59740b2ef791273cd477aeadbc37def1ec48f1e9e

SHA512
a3ea48f42f4b4bad897655e492b8fc0b027d433286460da06bfedb36cd003072570edc77ce928b9624877848cf82cfc64ce51a2e9e85e742b05b6b9d58eca736

Download Submit
C:\Users\Admin\Desktop\UseEnable.3g2.993-644-0EB

Filesize
725KB

MD5
d29e0f63afdbba49e0cbc15cdf4e6a8a

SHA1
dd1c78309f5fb8e0d456dbee606231849d96297f

SHA256
a5c3dc6561717d446c730ae22a58de2ec84dd793e650d00919e92fea148d0158

SHA512
e3c4214fc9734bfea7bd0d508128fc094441def9e38cbedf049baf223d0860d53fa32aa1014810fb9b341ec84d57a74c164b8bfff401d341c8d53bec46ef1f46

Download Submit
C:\Users\Admin\Desktop\WatchSwitch.M2V.993-644-0EB

Filesize
953KB

MD5
7fa00797d55edecfa1c473618318053a

SHA1
ce4837f0c4ab8ba422fcca4e6e3284b4a484b855

SHA256
0a82cd6de5b2d4b167a042bfb1515e8cb89e9e5e83b7a2607879d541ed409154

SHA512
e0532c14d0cbcc01a837f8f6839a60b1ea7b84dc679a9f5d9b1084a1b9f8a1c34a56ab14d086d3bbdc9fd509e573a488006c531576691050fc1fd6bac350425b

Download Submit
C:\vcredist2010_x86.log.html

Filesize
82KB

MD5
137c2b269d9746defd107cb02975b108

SHA1
0394bdc504aaa1a5166bbfb57bad23f6223e8d52

SHA256
31b4aed581b38428b6ff51408e7aa124cb75ccf282b2386defcc81eb3d6e5ec6

SHA512
266f722bf03ee12aaff1e7c23e7c14e7fd573875e5a4797fefafc07095d3c4977db7e0fa9897faeab67d61df0a592cff3ebfe83fa8255ab70aee25cdd24269e2

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe

Filesize
211KB

MD5
f42abb7569dbc2ff5faa7e078cb71476

SHA1
04530a6165fc29ab536bab1be16f6b87c46288e6

SHA256
516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd

SHA512
3277534a02435538e144dea3476416e1d9117fcddef3dcb4379b82f33516c3e87767c3b0d2b880e61a3d803b583c96d772a0bdeecbfc109fe66444e9b29216af

Download Submit
memory/1216-11930-0x0000000000380000-0x00000000004C0000-memory.dmp

Filesize
1.2MB

Download
memory/1216-23686-0x0000000000380000-0x00000000004C0000-memory.dmp

Filesize
1.2MB

Download
memory/1216-30230-0x0000000000380000-0x00000000004C0000-memory.dmp

Filesize
1.2MB

Download
memory/1712-92-0x0000000000E00000-0x0000000000F40000-memory.dmp

Filesize
1.2MB

Download
memory/1952-107-0x0000000000380000-0x00000000004C0000-memory.dmp

Filesize
1.2MB

Download
memory/2176-66-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2176-72-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2688-5031-0x0000000000380000-0x00000000004C0000-memory.dmp

Filesize
1.2MB

Download
memory/2688-30264-0x0000000000380000-0x00000000004C0000-memory.dmp

Filesize
1.2MB

Download
memory/3068-30263-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download