pandastealer | 978dfe8f0fbb57398366e2302055b58fa641258f53db6909fca2b5a1e87ff3c5

Resubmissions

15-10-2024 12:09

241015-pbyrlatbna 8

15-10-2024 12:06

241015-n98tsatapf 3

15-10-2024 11:58

241015-n5mqrasgnb 10

Analysis

max time kernel
369s
max time network
351s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TLauncher.exe
Size

8.9MB
MD5

505731086d2f448e68c025a7003efe00
SHA1

e8358cf87df55712a7b6998d1816e94b57f3b7c1
SHA256

978dfe8f0fbb57398366e2302055b58fa641258f53db6909fca2b5a1e87ff3c5
SHA512

856ad2f0caa72c15b20831c7e1d8917329907381e1e95ce470ff3592755804cc17cd507c105d49fdecbc418a2c3f2b01e1be2ce15dc981aeb7f39ce2889cb4d4
SSDEEP

196608:vRAQAHQHWFm5kAiFWnuf6J/+Ift24xJN+vwvasDU6sU0s:LUn6nDJ/+v4xJprUB4

Score

10^/10

pandastealer discovery stealer

Malware Config

Signatures

Panda Stealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/2900-4633-0x0000000010000000-0x00000000108D0000-memory.dmp	family_pandastealer
behavioral1/memory/2540-4657-0x0000000010000000-0x00000000108D0000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Loads dropped DLL 2 IoCs

pid	Process
3036	setup.exe
3036	setup.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.swf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\sentinel	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\WebKit.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Thawte Root Certificate.cer	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\setup.swf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe Root Certificate.cer	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\digest.s	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\NPSWF32.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.msi	msiexec.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\f7d6c3d.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f7d6c3d.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6D15.tmp	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adobe AIR Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adobe air updater.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Adobe AIR Updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Adobe AIR Updater.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	adobe air updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	adobe air updater.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Mouse\DoubleClickSpeed = "340"	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b131900000000020000000000106600000001000020000000a6089aa61a0f712bb3900cb02aae1cd404be537e7cfce1b770e93b93716c36e9000000000e8000000002000020000000f3e2abbbb42c0749d17c09a589e85408d7dfb7574cc31222f4987fce0f8a1e8a900000001a3c22218d30a4fcf1c018baa7bd1f03bfe370d7b647234ecfc2a6247fa5ac75d05432a4ba2c26db5f56675e66684fa90fc06fc0780092be03484efcb286b10e0662cfb815a5be80f44cb0ae6e573ffbc2f3086ed0628efa255755ceadf6d131992febfc46855afea5867dd46af3502b4037fa6864d9ceb2761f344c3cf966e006fc5ef6707a642c4fe669720ffbcc19400000007dba03b5ab95ee5e8b1c9604e435ae2ffb0f49deeb533db4e1801c477003d3d44c4fbc724e21ebef3900948247d8566416408c38b5d3ed3cbde18d8fde3e31bc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b131900000000020000000000106600000001000020000000ef0f1a54b8491b970e820feae928b2c6eb30f848cda0df48deaa4ac05a8a151a000000000e8000000002000020000000cb7e40e0bc5edc6ab01a6be3f2dda4a56a795cb8146c899654451436d1095f912000000047eafb449396d503d95b2d126361794c4b7b152db26f1115ba7d54655a66bb58400000009c58c131aed40ae361f9d0868a1d07d547258b1d6aa0a5ed320c17a6c27aa66d1d343d2a247ca849b22aa509635770fbd6eee877f69c0259befeb2f73403e77c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435155468"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0082B131-8AED-11EF-A7E1-668826FBEB66} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603f84d7f91edb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8663020007180A44EB446B23AFD487F0\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8663020007180A44EB446B23AFD487F0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AIR.InstallerPackage\shell\open\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AIR.InstallerPackage\DefaultIcon	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AIR.InstallerPackage	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8663020007180A44EB446B23AFD487F0\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8663020007180A44EB446B23AFD487F0\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8663020007180A44EB446B23AFD487F0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5D029AD8C14C0E24FB1378AB9489E44E	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AIR.InstallerPackage\shell\open	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AIR.InstallerPackage\shell	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.air\OpenWithProgids	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.air	msiexec.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2956	regedit.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2488	ehshell.exe
3668	msiexec.exe
3668	msiexec.exe
3668	msiexec.exe
3668	msiexec.exe
3668	msiexec.exe
3668	msiexec.exe
3668	msiexec.exe
3668	msiexec.exe
3668	msiexec.exe
3668	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	2476	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2476	AUDIODG.EXE
Token: 33	2476	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2476	AUDIODG.EXE
Token: SeDebugPrivilege	2488	ehshell.exe
Token: SeShutdownPrivilege	2900	adobe air updater.exe
Token: SeIncreaseQuotaPrivilege	2900	adobe air updater.exe
Token: SeRestorePrivilege	3668	msiexec.exe
Token: SeTakeOwnershipPrivilege	3668	msiexec.exe
Token: SeSecurityPrivilege	3668	msiexec.exe
Token: SeCreateTokenPrivilege	2900	adobe air updater.exe
Token: SeAssignPrimaryTokenPrivilege	2900	adobe air updater.exe
Token: SeLockMemoryPrivilege	2900	adobe air updater.exe
Token: SeIncreaseQuotaPrivilege	2900	adobe air updater.exe
Token: SeMachineAccountPrivilege	2900	adobe air updater.exe
Token: SeTcbPrivilege	2900	adobe air updater.exe
Token: SeSecurityPrivilege	2900	adobe air updater.exe
Token: SeTakeOwnershipPrivilege	2900	adobe air updater.exe
Token: SeLoadDriverPrivilege	2900	adobe air updater.exe
Token: SeSystemProfilePrivilege	2900	adobe air updater.exe
Token: SeSystemtimePrivilege	2900	adobe air updater.exe
Token: SeProfSingleProcessPrivilege	2900	adobe air updater.exe
Token: SeIncBasePriorityPrivilege	2900	adobe air updater.exe
Token: SeCreatePagefilePrivilege	2900	adobe air updater.exe
Token: SeCreatePermanentPrivilege	2900	adobe air updater.exe
Token: SeBackupPrivilege	2900	adobe air updater.exe
Token: SeRestorePrivilege	2900	adobe air updater.exe
Token: SeShutdownPrivilege	2900	adobe air updater.exe
Token: SeDebugPrivilege	2900	adobe air updater.exe
Token: SeAuditPrivilege	2900	adobe air updater.exe
Token: SeSystemEnvironmentPrivilege	2900	adobe air updater.exe
Token: SeChangeNotifyPrivilege	2900	adobe air updater.exe
Token: SeRemoteShutdownPrivilege	2900	adobe air updater.exe
Token: SeUndockPrivilege	2900	adobe air updater.exe
Token: SeSyncAgentPrivilege	2900	adobe air updater.exe
Token: SeEnableDelegationPrivilege	2900	adobe air updater.exe
Token: SeManageVolumePrivilege	2900	adobe air updater.exe
Token: SeImpersonatePrivilege	2900	adobe air updater.exe
Token: SeCreateGlobalPrivilege	2900	adobe air updater.exe
Token: SeRestorePrivilege	3668	msiexec.exe
Token: SeTakeOwnershipPrivilege	3668	msiexec.exe
Token: SeRestorePrivilege	3668	msiexec.exe
Token: SeTakeOwnershipPrivilege	3668	msiexec.exe
Token: SeRestorePrivilege	3668	msiexec.exe
Token: SeTakeOwnershipPrivilege	3668	msiexec.exe
Token: SeRestorePrivilege	3668	msiexec.exe
Token: SeTakeOwnershipPrivilege	3668	msiexec.exe
Token: SeRestorePrivilege	3668	msiexec.exe
Token: SeTakeOwnershipPrivilege	3668	msiexec.exe
Token: SeRestorePrivilege	3668	msiexec.exe
Token: SeTakeOwnershipPrivilege	3668	msiexec.exe
Token: SeRestorePrivilege	3668	msiexec.exe
Token: SeTakeOwnershipPrivilege	3668	msiexec.exe
Token: SeRestorePrivilege	3668	msiexec.exe
Token: SeTakeOwnershipPrivilege	3668	msiexec.exe
Token: SeRestorePrivilege	3668	msiexec.exe
Token: SeTakeOwnershipPrivilege	3668	msiexec.exe
Token: SeRestorePrivilege	3668	msiexec.exe
Token: SeTakeOwnershipPrivilege	3668	msiexec.exe
Token: SeRestorePrivilege	3668	msiexec.exe
Token: SeTakeOwnershipPrivilege	3668	msiexec.exe
Token: SeRestorePrivilege	3668	msiexec.exe
Token: SeTakeOwnershipPrivilege	3668	msiexec.exe
Token: SeRestorePrivilege	3668	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2804	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2804	iexplore.exe
2804	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2804	2380	TLauncher.exe	29
PID 2380 wrote to memory of 2804	2380	TLauncher.exe	29
PID 2380 wrote to memory of 2804	2380	TLauncher.exe	29
PID 2380 wrote to memory of 2804	2380	TLauncher.exe	29
PID 2804 wrote to memory of 2984	2804	iexplore.exe	30
PID 2804 wrote to memory of 2984	2804	iexplore.exe	30
PID 2804 wrote to memory of 2984	2804	iexplore.exe	30
PID 2804 wrote to memory of 2984	2804	iexplore.exe	30
PID 2804 wrote to memory of 2984	2804	iexplore.exe	30
PID 2804 wrote to memory of 2984	2804	iexplore.exe	30
PID 2804 wrote to memory of 2984	2804	iexplore.exe	30
PID 3040 wrote to memory of 3036	3040	DllHost.exe	51
PID 3040 wrote to memory of 3036	3040	DllHost.exe	51
PID 3040 wrote to memory of 3036	3040	DllHost.exe	51
PID 3040 wrote to memory of 3036	3040	DllHost.exe	51
PID 3040 wrote to memory of 3036	3040	DllHost.exe	51
PID 3040 wrote to memory of 3036	3040	DllHost.exe	51
PID 3040 wrote to memory of 3036	3040	DllHost.exe	51
PID 3040 wrote to memory of 2540	3040	DllHost.exe	53
PID 3040 wrote to memory of 2540	3040	DllHost.exe	53
PID 3040 wrote to memory of 2540	3040	DllHost.exe	53
PID 3040 wrote to memory of 2540	3040	DllHost.exe	53
PID 3040 wrote to memory of 2540	3040	DllHost.exe	53
PID 3040 wrote to memory of 2540	3040	DllHost.exe	53
PID 3040 wrote to memory of 2540	3040	DllHost.exe	53
PID 2540 wrote to memory of 2900	2540	Adobe AIR Updater.exe	54
PID 2540 wrote to memory of 2900	2540	Adobe AIR Updater.exe	54
PID 2540 wrote to memory of 2900	2540	Adobe AIR Updater.exe	54
PID 2540 wrote to memory of 2900	2540	Adobe AIR Updater.exe	54
PID 2540 wrote to memory of 2900	2540	Adobe AIR Updater.exe	54
PID 2540 wrote to memory of 2900	2540	Adobe AIR Updater.exe	54
PID 2540 wrote to memory of 2900	2540	Adobe AIR Updater.exe	54

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\TLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://java-for-minecraft.com/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2984

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:456

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x520
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2388

C:\Windows\system32\DeviceDisplayObjectProvider.exe
C:\Windows\system32\DeviceDisplayObjectProvider.exe -Embedding
1⤵
PID:2428

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1736

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\main.cpl
1⤵
- Modifies Control Panel
PID:2976

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.DefaultPrograms
1⤵
PID:2960

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:3044

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\Desktop\GetTest.reg"
1⤵
- Runs .reg file with regedit
PID:2956

C:\Windows\eHome\ehshell.exe
"C:\Windows\eHome\ehshell.exe" /prefetch:1003 "C:\Users\Admin\Desktop\FormatGroup.DVR"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2156

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2072

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{FCC74B77-EC3E-4DD8-A80B-008A702075A9}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3036
- C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe
  "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe" -arp:uninstall
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\program files (x86)\common files\adobe air\versions\1.0\adobe air updater.exe
    "C:\program files (x86)\common files\adobe air\versions\1.0\adobe air updater.exe" -stdio \\.\pipe\AIR_2540_0 -uninstall
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:2900

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 968676BB49A01517566385C0855EDB46
  2⤵
  PID:4500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4144

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000039C" "00000000000005D8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7d6c3e.rbs

Filesize
14KB

MD5
e08a2fc9810c465269b0c557fc60e358

SHA1
6ae9ec4c2f4466465c2f710790f5de930c12da64

SHA256
ace9e642c0fb61dcc4eff54e5819c07a72a27752ecf8189b8824d328b7e6c506

SHA512
cbbf7e21ff990dad9a4eb2150541e898e9dfe62c08af5595c4d3643ad6df75be7192fd9f63d7e4207a1ab05fa47268e6a63b05eeba87d842936ff2acbc0c9beb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1bd7a05997a22038e020a126966c1b7

SHA1
0c77e37beb8f4658d6417f4297ce3acf492b1e61

SHA256
297718b7a81ba6082f7e076cf0b015548f8c0d06b40b7f0e0db3479377a0d32a

SHA512
b08da2e026814f533cdad02e5f729d6bfa8e72ee88d260973821b9f082f2d4cc39549e9e0b758c21b3e0c46859b510c046f22ae210be41f30bdeb1d31f655e2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7313442bd807bb7b0dafe86512a4eaec

SHA1
342d41a212fab23a83b73652f91b7e9856ecc49a

SHA256
eb98dc552521568b4800acb5148d77efd3c120231b4624514c7d89d95923e6c7

SHA512
85d8518893910a2d046e24d7b8b4aa34492c6aa34445dae9cc225c2a92b4c6d38b766ef6159fb5cc7201aff724b7d37a379ea799fcdbf3b026d944c2095cfb51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72fc444c7cb1d4e51714157abe3f0838

SHA1
81194a7af90814963d986ae22f69645c960718b3

SHA256
f0d9b011aa8f3b38f9ad692b70db0cf987009c434057b6a9cb86162ad162e3c7

SHA512
2d25e5bcd97994e4e6e99f75c6b84c55f4bae9225c60ee5ddf450ed9089bb4718f541c20b24e42a90f223691e4da3e2417d4f1a8f2a6e684183baee6336e30e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0d713d2dbe591f011d71e92d3c7063a

SHA1
8668f463d12cad7ad59c1f8493b38cde9589c2c7

SHA256
24962ee5df0ae453d110d0a90708ba6e5b498400244924ce98efe7e0de5f94ab

SHA512
27d1ce48477252c082000462d17a36a0cfd6c1e12b3ccb8e26b625fd74b420a00a148a99312593df38ca571bd84b14558721935c7b8b8ae512febe90c4dd85d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b972e99710a45442c794c1174ee2c1a5

SHA1
e2ebff1108f7e7738fa9cbb23a9f9696cdbcf326

SHA256
f4b0607cc09b76bdccde77a6c6d627cf38cbb32b19c8c97283625a19ff01eb50

SHA512
7f28e94e9ca166a84cefa52ef68b08b25bb7fb90eb2b8109a6bce3ee1f0071144f583e03ba5e8b26d889dde0e525c02f534ffc6a855691c6af2c1a1df138a379

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ff4e6850b1a07f2680e814c54abef48

SHA1
c3d14510cbfed715af8fc6baac00704e26806c60

SHA256
175545f428b0f622596343356bbb45809baa868ee48191e8067c96b3d55dc7b3

SHA512
20844981ffec940863d1cbe0dcca6051a77710eea85ae0d9f8e4bd2852a66b4b7c4ebb1f760d07246c499ace2d0702362af91a6c56e9d3278d175abea7960e81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
252b01d8a7c3a1fd762f0154c5c44c5c

SHA1
d7ea44493d51dc8357094c74c7dfac828a1df4ea

SHA256
d7b1454fde63699b32a705032882e6ab8f5a52c78b217e167eaa9d7c2b45c710

SHA512
8b1f271e88ab2ef002ee6120259151656ba66bd741196fbe966a90511b25d6b6d1fdfdfa6c1b16faa6ec2f0b8f7004d76911bdda78d66c215a07d3e699b0de0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d8434dace10b92bbb8ca61c630032b9

SHA1
4670ccacdbf77f9ac35b890dbf7fc5add0d8a6a3

SHA256
27810faf8956581c8ee6728f99c91078578a4730057a7adfbb88b3f112051658

SHA512
dd028a75a36c6f82ebf83d47a933955187cd22a0b4dd709094a6605a39dcb9f27ffd055854c2bc361209c200b8da96434709957debe353bd0ad81444a2eec942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baa5a3c0d8a75e16dea301d3e015a9a6

SHA1
c03520533703804c60a32f3ff050ccb861e25a6b

SHA256
e756e8740a4280244fbf092a16b6e719c0b9d0ee697b65e1bc8ca85e8d0bb7d1

SHA512
c097859ff34d95423ead34e6134eed7d8e086f7cb6cee5caa3e272f591c42d4df32a7eb154ac9fa5e8101471252a69c39bca8271abc5e778a202d909366fdc75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
853c63cca359b18e54734662c8041fa2

SHA1
9b58706feba419d91f71a236cd17186dfae47f3d

SHA256
3ca92010f12c1d796ef674add7b30f73f068e49642f933b297d8711b47af07a1

SHA512
d957f28e98f2ffdd3f20a379d57d0a59484dd58af603d7bf94c0f1894bcd2f35ba1b987a81da0fa8e039e2bcabb956feabd855aad6444d525b8dbb4c53d41b44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f5a3489971b1dd2a4d8ec8c3217a39d

SHA1
80a59647e7e2f2203f3b8e88cf5e4f482f59f2b1

SHA256
8ae7a1bf91c6c3625a02e45205a9afcfcad67f672d7aba8e9d3641bc14486382

SHA512
7615ee8f45f270d35fc8839290f64f2b9f85baf40d5d45c48fabff629411796985d584566ef69dc0083449a18cdfffca145e4efd98a0ab4215051bf2543382a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7ece486a36205dc00a8064989f9624b

SHA1
da1e9d291c7d1f13d538b3cb137385171a3fbead

SHA256
dd11438c577bcebf347ad31736a6d357f098ccdbb49108724adbcf261e2326ab

SHA512
2f0674d31bfb576acfb2c89ad57b32f0e8cbae67c4de759394845b3b36ef1c51b65ab2bc35e793cc537cf50ea8d1cf0d28d6239b8617bd147e1101e43ebdad81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82f20907f992afa08442ee1f5e59c1fd

SHA1
c798cf00e34a5a2ef985e11be46352dd95325d2d

SHA256
a8d40a823fb52a6b97ffe1fd1d4a1036e62ec1832be4066b8525232a40439bf6

SHA512
983254101ca26f9648848923bf1b083d21b440b82a2ea0106342365bb9ca11f8b0c99660db6e69c9fdb2e6e7303212d0085700ae40007e0734b518f6de9d2ffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d037e9cf0a99f097da4908fa45a55b1

SHA1
228dbd0e905d3078bb9b0b1d0269769b495df544

SHA256
81f0f204e724d5edb4f9c12ddd6c1a7cf9c01c44b5bca79162dd7395e9eb7bab

SHA512
44c3b653fa6d7579bc41c6e73e583a446bc6307d491abd9ae40517b1a2a89146cdc8b9220884060a1a5411000fa20e41664060efae74e701061ef860495cff3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94582ad8088694d540e2ed1e8d6af426

SHA1
348177a02b77757f9a3ee2164cac8758938b7273

SHA256
4f8dc9bd34dd87cfa2d4460b535db428ecff5b753c180fdea7a37548d9e49ebf

SHA512
2fe92fd644fba42366f6e2df42676383e6b54acdaebba52741117ec111ef0ce2b329b415a8ef52dd57374e14889fe781db8ae723c13622a400f8b80ebee9c4ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
924382b206d0a0ac60b65eb7977c0a99

SHA1
7edbb41d2d6a8944e9e307b334f442254afa9b1e

SHA256
a7af1a1a34a6eca15e3210b71b5149e32ab7e4fae2f4921727153fd159e02e8e

SHA512
7e676c67d4412bc4a6908f5fabcc094b9d7977f529a75c1133a2f39731a697fb9335afe84abc50136a6598e05bfcd6730843ec880b13c1080d7384e7b07d9a65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aed04ba91056ee1eac71fd934ccfcc50

SHA1
7a624dcde5cbcad7d767fef9510a75a38dfa43bf

SHA256
01b190c1a66e61dc42c83a7245a0d887b38783940a79c3db095dd72b8e8330ff

SHA512
5b31150271f0bd9c10fc8690536af0784c16aa82711bd80e3022f74eb9c1f53d5e92e8af09a4655004221792d149ef040adf05407e1df85a24e801201c528d5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9bdc9b432b4c9fbe6dc88d09cba9173

SHA1
9a203efb5610c71dc2d504c052c15de239444773

SHA256
ce0a5cf3f31fb3487de3a685accf2ddd5ce66be982d6e1c187c8a4dac114fa49

SHA512
42466ef5ed4409899d84d5517b23769cfe1b835cc4149da4d36d01846c9e55da07499046df4b36151ea22b0e998b03d445ff868f048f946a989daf9efaba9c55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06a2dfb1d7cdccde396289e249a03ca7

SHA1
a7256e7501dc2eb27f1dff95ce986fcaf5ac64fe

SHA256
15064ce2d674f241f4bd796a89bac0bfacc0493170392defa6514642cc30a285

SHA512
d8c75f1cb904622162e19f374966544c8687bd35fb3066bd904a9e95c15148acfd26da90c6975e5f2e0e743112b55b9b256081c0837241442afe5a010db24802

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a69ea192cf39b4a771c445d45d2122d

SHA1
3e26673161c05c7866ee45f52eac46917fd3a895

SHA256
4f1b1dc5ad250dc392b61a76a3c5ef56446944c39093e19b8caa319cb16ce8c6

SHA512
b74e270c6efdfbe5ba7176e2ddcdec968ff1556dceafcd07827fb9d81be9c28bb766371fca998fedb4c210c0dd9e9dc1013c6ff0f9ac778a49632ffe84e647c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd117d34dc15feaa8fb454bd7a408013

SHA1
2dc606c10beca2bb2a9309b105770c1bf3424b09

SHA256
59530ceb94268a09124f8bb62177ee19770bccf2e8fbb277ddf3f6aa6e1d9ae6

SHA512
2faf8acf7bfc6a2b3b467f449272ed305956a50949d087f6e4b921eaf3ee5f11f8cc7c9aeb417095ce606db918b3281ef039f8c2b03a0c3c0fb90db01d01758c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9D1C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9D1E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Desktop\AddShow.dib

Filesize
975KB

MD5
98072c4620a475228ce74c64935ec450

SHA1
9ea18d664016644a0ec1fc8bda351597e54253a2

SHA256
2cf19ec6f6dbe42f8df64b6e0e2ead4a736063694d9a213754cd10f6f03b5ce2

SHA512
86c3255e61fdef86b7637e75ba70f9779c6ed60a422599ed9c03f3e0acaa9b867a79d065f3643634f09874104fe9cc8728e2f48aebb397934f8308b193b5369f

Download Submit
C:\Users\Admin\Desktop\AssertImport.mpeg

Filesize
542KB

MD5
ad32c4e0e2eb3837a16a8fa8ee20d8ff

SHA1
b922f0bec527bcf82873b20b5eefc9b750a97401

SHA256
aa3bb03adcc70a554afafa13339c7c77ee0775c90a2cc2d78c26a5062dcef941

SHA512
a7e26fd66b9501e67664c8cfa0b2896c835d08b443ed6a4d9a50767d9e2207425c248f965581c7025f15dabadc535403ee28879c2fddb6788814a13483c27c17

Download Submit
C:\Users\Admin\Desktop\BlockProtect.ex_

Filesize
511KB

MD5
8cb219a7167da512e3f42de660833f5b

SHA1
9325ba93d2c5d1c507aaf96af03d1499d38ecbea

SHA256
74542f264c54203da784a24963e320980569d197d180b7e1563589b60e12e05f

SHA512
7c339dd0304d05818e36c1fb12b9fefc87942757043f06296b77c0026210d260f942113568996f02fb1b48817f4090b50a82cbb632c126a1b502c325c92dbd35

Download Submit
C:\Users\Admin\Desktop\CloseCheckpoint.mpg

Filesize
820KB

MD5
935e47ee43031ef7c736647dfbb0da08

SHA1
5b6bb75c9c14a0f83e1e5cff12716b44df9d19a4

SHA256
ab917290093b674d8510348863a0afe3451310562144304fe7bb3c05ccda3ab6

SHA512
79504ff4149e9c3e9209ba446be7dadc1dbba4fc0283cf5369eb6886ed2df3afab8984733ba2068389656c21ccfe2f80a863f3e89b1e32515fe0dbd9ebe4d4db

Download Submit
C:\Users\Admin\Desktop\CompressRevoke.hta

Filesize
851KB

MD5
e1562407e2a315370dc593909eceb8d6

SHA1
ce5e0c88b1d7ef86df95ba73f3b366dd11261fe4

SHA256
136328dbb751ae32a57cc0da1103f4f6ec87b773e4c2188e9274c4191056ca81

SHA512
c7ea59f36e9642f8be96b3545f395c2ca60ec26aaccadd8581aa98901903735e506556cd25f756de7fd2bdc26788ae910bacbb0264c20df94ad5f043c5c46ed6

Download Submit
C:\Users\Admin\Desktop\ConvertToPush.xlsx

Filesize
13KB

MD5
22ad5a662c0e4e050741369296c1d688

SHA1
3a0e2c207f4475a5be3d8a0fbdd301b515a6d4ab

SHA256
273d19b7c51feac97c30ccdc7453870c1896e3c0ab9b2785f6b2ab899c47ffea

SHA512
69dc87ebcabe9207a87bda20955b47ac2a2a4c9e6ae0bb1fdbb79c67ff8bfcd6a2f125336337f7d9a06e6b40f16d5dec5fd07895f7be643fc561c3b791765754

Download Submit
C:\Users\Admin\Desktop\ConvertToStop.MOD

Filesize
913KB

MD5
9e3edb2c542563a673c861d6f5ee0200

SHA1
a2e481b431dd6b6dbfe2883f5d7cf39eff2c0181

SHA256
4062adc6a6969fa41deb4d297d58857af7a99f2d9c1541d602b996a73d089463

SHA512
0c724d991a0241182e51888668c2fe7ac8781c4a2390fd18f9b6ccc6d1f63454427d5689955ab3ea2b2fae34387e94156e66817b9b78873c7026897c05d04312

Download Submit
C:\Users\Admin\Desktop\EnableAssert.wmf

Filesize
882KB

MD5
d840868d8ea2cae40746c3cbd52e77b1

SHA1
c1d6d68efa89a28074650ec18e893472e8f0c250

SHA256
a16abd2e857e7ce72ae224448ecde1b8541e04a392b43a95537d7b0b8b249b1b

SHA512
84b4d8293d907ef79c5c870f1879b844c50e3ef659f93adce64ac856d30406e1d6d0b0946d8d04b0e7862db0ff9df23228b0f9165d16e17b38d3ae61d74e7c46

Download Submit
C:\Users\Admin\Desktop\FormatGroup.DVR

Filesize
665KB

MD5
63a1965f4db58f605b236d18cbfd20a1

SHA1
93f907141ff787703b78a5f554a65eb6715a0d6a

SHA256
1bbd3dab6e1435894db002468d6352fe09bc546d804b391fe8e5883f09c83755

SHA512
f3abb2dd8c993d7c368f64378f186d920b629797b2b774526812880c75ac7f0193617907b44f4b22950900169c1c2a7f17456ad1dc24193bc7c7fd558a4d6e55

Download Submit
C:\Users\Admin\Desktop\GetTest.reg

Filesize
480KB

MD5
23a3d22accad9128fbe641829494ef47

SHA1
5551e2635ff759d2cc4195040938aeb6e726125c

SHA256
ee7c64f26811a03b384b7e5aee93e17dbb4587fe731e2b544a23dfe22aeb9a52

SHA512
61ac885721e60fc75b823d4403d0c98ea2bacaa8a78dd8559b20b546ab877febc317663b5e868eced892db77efcd8cadc4c692ef4b6158db5d221794c6f7998f

Download Submit
C:\Users\Admin\Desktop\GrantPush.xlsx

Filesize
11KB

MD5
c97736f28f687a3d6a307a569fbfd036

SHA1
e4f40ab1db9fd73e416979ce6cb507438f0c3319

SHA256
bbb52c5c3760a1a3d950dc7e6e96f464a81f51832d198b50a2e95d9d1d2b715a

SHA512
1e384b3d2a43ba3b0c587c49c76f2886b3b3472a2bfb31ece6f84b6da853d3dd5c9a178d685f3993a4df1e1964c48a562902960da88f72cc63b171b4e553cf2a

Download Submit
C:\Users\Admin\Desktop\GroupUnprotect.mpg

Filesize
572KB

MD5
71c7761506e81b7020f221d430179064

SHA1
0cee76f786c10e1fb284b4153b38bfdeaa50ad5e

SHA256
4aa79ea0aa8994dd9bb3cf99a8d5c9c3cc231bbf79935bbad246b3ad6b2d1755

SHA512
d260534aa6a435d59b0d6c475aeecc30eb12b35ee85dbb707a9296b53cf54982af9af308c2b4c0e19835ac35aa726077b8fde6a4c6c25a7d089d35090779e2fa

Download Submit
C:\Users\Admin\Desktop\ImportConnect.cab

Filesize
634KB

MD5
3d0e26df8dd35c4d37aaa1c38ca3afed

SHA1
00e8b68bf2de77a6e411355526806fc6cdd52392

SHA256
72e76ff7b07e680d4b6bc3fc22911c0c29473af29161dd757aafcc201c6edf23

SHA512
5a8ce2113a408e14d6c0af9983efc3982b55470f86d01ac54213242e173cb7233508c3b33d7ccd591ff2f54daa909d818f86eff57b0348989940db054cbd7db1

Download Submit
C:\Users\Admin\Desktop\MoveMerge.pot

Filesize
789KB

MD5
b0baf5c83b4a58c5fb3f2e74fe7e0618

SHA1
b0f6f5957c2f0b3de08c33469c933aa78604b1b1

SHA256
8891495b6607ca2ea3e3b7655157ecb0b9d8cd459a700bb24fcad0473e471870

SHA512
78b64833091c3b409cecebc8028307da9d2bb9f214fb300ab27b494d26cd48a6621d37de3382227369e0e4e987b1019b198a6b8c8b175b7603e19f6ffa2efacd

Download Submit
C:\Users\Admin\Desktop\PopReset.docx

Filesize
18KB

MD5
d8308b3f90b0daa640c53c73bb226e1d

SHA1
ca849786582d3f324c98d69fb7ec8d601550ac4e

SHA256
d824e8cf4db67ca8bbfba0e02d462fc439731f3dacaa1a3dd42df5e6771b6d59

SHA512
d1f1085c591044f7355ebf2470df0356c5ab6a53857e91a71f19447fdc8e749ff6d726f541c3907ecc2bb21c79f5ea6e1115b3f12d32189561f421465e05b1b2

Download Submit
C:\Users\Admin\Desktop\PublishRestore.aifc

Filesize
387KB

MD5
6a9e388ffc1dd4e6e0fbe837cbd73a70

SHA1
10b852562188345a56db02683d512abed6895162

SHA256
ad42100921adb39086a7a0da084f64f22498359aaf9be2c28847970e5832f62b

SHA512
0e3721fb88f725d708b9cf064af27b885bc91592607c62d1e4938b78b720932c78574bfb2093e9ab94ae7a2b3481ef7cf41188e5cff0cb894d63d59c120cdf41

Download Submit
C:\Users\Admin\Desktop\ReadLock.jpg

Filesize
1.4MB

MD5
4a885e9a7bf1764c90aaf4558efed49e

SHA1
fa139c2a50869d5acb4e8082190ea32dd8a8c755

SHA256
953f4ad7fb65de2df84b131dc9b5b9b010e0a436a52e513e709ea862cb4c924f

SHA512
209ed14f4338be0f882e6271ba91a1e6ef2649b083fb62ad99e46beb05d69ed79bb4a7749396fd73efd9232acb70e421df9cc5de069229662dd4ef56cd9b645b

Download Submit
C:\Users\Admin\Desktop\ReadWrite.docx

Filesize
21KB

MD5
3e92759a9656ddf0e6e1377b4f60896c

SHA1
261e8def1330198eba89347e22fb8c43822e71cc

SHA256
8b9beb2ccc05bae7a5ae66439d78133fb2c131ae8b992501ffbaf5be112ee49d

SHA512
70b6b6acecd8fdb0833eb0aa1b0fcd0f8a63d184cf730f73c223849e3740479638909ee2671e15da9cb2f57ad48ee810aad7522b251f1aeee5ea2fc16de15c23

Download Submit
C:\Users\Admin\Desktop\RegisterConnect.gif

Filesize
449KB

MD5
2cc7a4fd5301b07b3ec9d0803f616b00

SHA1
dc1d1d3e962b8e2c060beb510c066d6c6bf5678e

SHA256
da2a32253556507b1927a500480bcc0064db5b652bae977f7850bcc0b2ce4545

SHA512
50cf98ed7329ccbbfbad978cd82faea844535b69e782cdbc6d210ed6a75e8830db6a7eeb43dbf002e8bf40eaf1c0af8ea975d6f6b17cac6d8aca1cc3707cc725

Download Submit
C:\Users\Admin\Desktop\RestoreProtect.xla

Filesize
603KB

MD5
648d0e23f6de7d545258610fdfeff1dc

SHA1
f5b8f5c73c59c1309daae04f0b79427b8fd6412f

SHA256
ffe8367efb3da03e81cb941c73b79e77705faa280ef2d668fef427f4cb3ac005

SHA512
68ed5ecc36ff23cfa48ea15ca078ec1549045dea712c2c23714da3731be1d69c97cc93d645fb7bed82778be10d4dd5ebf8d28ca28789feeaa5cd0192e647f8d9

Download Submit
C:\Users\Admin\Desktop\RestoreSave.wav

Filesize
727KB

MD5
cba9a5f69f315d33ba01d69cb5b0c264

SHA1
a93364df0cb02e6e2666c95ab5e3a3d5ca63978d

SHA256
fa97099581290917b37fa677aee4d3522cb22d312a8485bb861f3478740ebd4e

SHA512
d710fca2ba346af3c8eca23d65e79216847400030b51cc5d505af62cd9e7d45902f9e8b7fe0f928bdaa201e308276d0b52d1a72de28a8ecdd884ece551a82f17

Download Submit
C:\Users\Admin\Desktop\RevokeSearch.docx

Filesize
19KB

MD5
58696a8eab908ae3c33129f73421f365

SHA1
737d101f757a63e3b9d2a9ac322fd88d4aeea07a

SHA256
d79c10a5bcc6af32f971d6d83048c2b37e70c59da8827fe3e0ebb8acfdd017ea

SHA512
9f1a70dc85b4d21458c4842dcb40a5b03c69656c7121cbc3471905cb2d952f56d653d80f82a3f1b7cccb45afb22ecf568b0f580536013ba87613a697b290f56d

Download Submit
C:\Users\Admin\Desktop\ShowSelect.cab

Filesize
696KB

MD5
c8f65225585d844a27723656a78b5087

SHA1
6932974105ef464b955e046baa9866ea6c9d9d78

SHA256
c5872c795be24db824c409bb77d3ba4e8bc6b2279409cf36bcfa562e3f79c3d6

SHA512
76d51c66d87050a163ccc74b8b8400e3feb9a18fcbcfc4ce98f80642da6b3eb9d9ea2f85baf9c6fb9aa50a60e4855d5d27e8196611fead6a1f77ce6b9d69fe23

Download Submit
C:\Users\Admin\Desktop\StopUndo.xlsx

Filesize
10KB

MD5
a129bbc320b065f7348177c900755ccb

SHA1
538b8d702ccfe44d7d6d8c003c0fed48f2c3b1e7

SHA256
8577d4fdd020dd9f00d308cb51e6744b75e9042bc259c85e918d4240a68994d7

SHA512
9e6f99a6c7616aa1af10e1008336725a38d3e09bc39556347e0471e12159e8d34b2ed44b71973b462bfbe93c3f6caa44f8ade288521c7d40a0ae3b34db3f006b

Download Submit
C:\Users\Admin\Desktop\TraceEnable.xlsx

Filesize
10KB

MD5
5f0554bd9f91a4acf9dd47ec0501c299

SHA1
67894e03d7e6d98b561f4df353f207ffd9c46159

SHA256
308e1c24c4a9305f51cf8d81cfb4a698c19eab6b64f9d5c18d67b033f4812d09

SHA512
e36ac621b7900da1f878f23d0f2eb2bf1c88506d2d87853d5c5d33f0aa103d2991da1d8765404835ccb52025a65607e2d2486cc8d6f64c87d1b2f48a60439b03

Download Submit
C:\Users\Admin\Desktop\UndoExit.3gpp

Filesize
944KB

MD5
2c4c91adceae5ff297b1a5c670d7d7d7

SHA1
8c9a7d0c4a183e07b2e0cfc492f717198ac9e526

SHA256
b253beaab6158292e9c176cc77512b2a92c15ad69f8b0862d557dbdbb8f915b8

SHA512
49e5f88ced641f41af92f337de3d0f87ecd7fa6196434e6080eae461abbf72d16d87bd6cd409c54bdc2176ff35c3759aab6d6b676e116a0024d66e7f3ed9357b

Download Submit
C:\Users\Admin\Desktop\UnlockResume.xps

Filesize
418KB

MD5
7e941b9111383e8fbc42ab7a04e3d4b0

SHA1
3c79d88cb5e792e72d3a23cddaf11aa1bb250fcb

SHA256
61afaaaf0016c5359de7a1d698b56552b8605c05a5a907b56d9ca91d3155192b

SHA512
3608c842bce566b9b35b230a94a76ec4d59f796ec2e8711810184d0fd10f00927f0e4d49555427b7aeb6214639d8f37995aafe97207e2daa3c560a9e9ab4463a

Download Submit
C:\Users\Admin\Desktop\UnregisterPush.mpeg2

Filesize
356KB

MD5
4725782d98c7b9231e73d27f744ef449

SHA1
52eabfdb4cec19ef3691108481fef89f03d94717

SHA256
da76942c4738e0e37d09584e7a9735138e2952e2fd52785f21008a9ee435e185

SHA512
2e72f9235d9d831747334bda84228b0832c00eb5fd598ba5cf62987398954607068eac371368cd6bd791ce20409c42c7da06dcca586c009cae5d64554bf04e0e

Download Submit
C:\Users\Admin\Desktop\WriteImport.tif

Filesize
758KB

MD5
994fd31787fda18db691e05c42856ab5

SHA1
a018b33fb4394be45755c86569ec49627ab0c1ed

SHA256
2eceb53748bf63ea86999d6477ba533ee1f37676872f5c58b28a2612dc351350

SHA512
9a7cdf4fd27ba79ca0b2ee15cab52e1b381b57df33d0e37672a7b5add7bad6125deb8ea302f08e331dea8b5c5c60fe91fc3a6ef00bddf74fe32b9269255cdfe8

Download Submit
C:\Users\Admin\Desktop\WriteSync.M2V

Filesize
1006KB

MD5
a835762e81dccc3b700febc6f75ceff5

SHA1
7b5241c71c42a1d1427f9423becb2aa5b5684d40

SHA256
e3468f742495130a23fb3c710cef457c642ba6d77cb12126253453f4d26174c6

SHA512
59b1bfd77796af70b8683f9ee9d70bd56299d63a3e29186de69ed2687439bc04769234df794999cf29244a1901dd362c8fbd24ed013843b0a0ded3f74f3e0195

Download Submit
C:\Users\Public\Desktop\Adobe Reader 9.lnk

Filesize
1KB

MD5
28eda8e40e247598945dfcef01373ad6

SHA1
06b86e43d50f597b0a53b247ae7ac0d965f93848

SHA256
3bc63576f0f82b1e2f5be2ac3f2c02f67efd903ebb850897d27602b63e0953fb

SHA512
18229f33b5c1191f2597b41d34e56384393fcdf45dedc4f3d917cdd04260167a70511cf29b7d8646585925d92d5ae8f70590c5421511d790ab8961425be8c424

Download Submit
C:\Users\Public\Desktop\Firefox.lnk

Filesize
975B

MD5
cee7d9be72e735c410327fb8c4102104

SHA1
16ab3a8ec52c913ae0cf94a76ccf94f72cec225e

SHA256
0a7ecfd21df19f2d615fe973333f6436329af25828056a64ac1e93b166cbf08f

SHA512
ab5f95f574a3c2992318ca677a1d527fe90ebcf1c7c63231fab86e8c11a1f670ff928e3e91b49b57e324c7f2c1a2e6a85a708ad7aa48ad4fd245b746084ee422

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
81cb5d669dbc630480e82abca995984d

SHA1
45ff87f4bf2d87a9d31ac062ee7b38edfe763d7f

SHA256
d1bfd3f7e48d746821f7bab3584688818e026992bf1f25054d4a1491a615dd89

SHA512
7a5319202b4fa539ec5576867e4c665ee2e76c36ae0ff4c5d9cfac1abb09a77e2badd9dce2c8f880d45570746027f9ad72141aab0f707f661d99ecf8b91ace5e

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
922B

MD5
c9a5a1d345f07334af00a2877b18e85a

SHA1
1cfdee89f36dbee23beca1df3d598e6006eddf66

SHA256
c860510cc3c2717c6a187a53c71cc65b05db3c075391d56550950fd460d0f4bd

SHA512
7db0ac3253ac77cedff2eaf2013fc822ee1aa0c2e42f2bde1a7a805d14d391fba264c5360faa897980ee3c9706020345b1c3239ffc702d135d2057d7b7f1a8ed

Download Submit
C:\Windows\Installer\MSIE89D.tmp

Filesize
112KB

MD5
8f680e0f517d35bb14f984a7f197e35c

SHA1
1ad84f7120c2712a32ef5aa82edde5b704eeb27f

SHA256
030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805

SHA512
dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a

Download Submit
C:\Windows\Installer\MSIE979.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
\Users\Admin\AppData\Local\Temp\Setup00000bdc\OSETUP.DLL

Filesize
5.5MB

MD5
fcc38158c5d62a39e1ba79a29d532240

SHA1
eca2d1e91c634bc8a4381239eb05f30803636c24

SHA256
e51a5292a06674cdbbcea240084b65186aa1dd2bc3316f61ff433d9d9f542a74

SHA512
0d224474a9358863e4bb8dacc48b219376d9cc89cea13f8d0c6f7b093dd420ceb185eb4d649e5bd5246758419d0531922b4f351df8ad580b3baa0fab88d89ec7

Download Submit
\Users\Admin\AppData\Local\Temp\Setup00000bdc\OSETUPUI.DLL

Filesize
187KB

MD5
196a884e700b7eb09b2cd0a48eccbc3a

SHA1
a400c341adaf960022fe4f97ab477e0ab1e02a96

SHA256
12babd301ab2f5a0cd35226d4939e1e200d5fcf90694a25690df7ad0ea28b55a

SHA512
b9f0229e3ed822b79ab2ffa41b67343215bde419a44c638422734f75191f2359bcfeb3553189e17a89b5edfa25016484ec78df48eb05049c72b1d393dd3f4041

Download Submit
memory/2380-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2428-935-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download
memory/2488-945-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/2488-939-0x000000001DD20000-0x000000001E328000-memory.dmp

Filesize
6.0MB

Download
memory/2488-940-0x000000001E330000-0x000000001E4B4000-memory.dmp

Filesize
1.5MB

Download
memory/2488-941-0x000000001EB00000-0x000000001EB9E000-memory.dmp

Filesize
632KB

Download
memory/2488-942-0x000000001EDD0000-0x000000001EE88000-memory.dmp

Filesize
736KB

Download
memory/2488-944-0x000000001EC80000-0x000000001ECB7000-memory.dmp

Filesize
220KB

Download
memory/2488-946-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/2540-4657-0x0000000010000000-0x00000000108D0000-memory.dmp

Filesize
8.8MB

Download
memory/2900-4632-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2900-4633-0x0000000010000000-0x00000000108D0000-memory.dmp

Filesize
8.8MB

Download