bdaejec | 6a73ef0f22202d51172c83eab70240735848ad37689661faf13a56a2bd72f8d0

Resubmissions

20-11-2024 03:43

241120-d9xreazmgs 10

Analysis

max time kernel
296s
max time network
293s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
Size

868KB
MD5

3f64df9616321b718366e70eab655e0c
SHA1

9cb754e4471a26957f5aad0e37a3c705358fbde2
SHA256

c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e
SHA512

cf092a45b0182df00781bed1912215c5555ac8c877abf24a5277126cb6838c0b8c9325af45993ff9471c73c589f141f9a7e447fa07badb925e26510837d2c678
SSDEEP

24576:MNjTaxN/1+N7zOQr3mYCFY7Mk2xT+2n/S225E2Y22222Gxqz8uRHYbJ2d2hgZgFU:Hx2N7qM3mvnZe

Score

10^/10

bdaejec neshta ramnit aspackv2 backdoor banker discovery persistence spyware stealer trojan upx worm

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec
Bdaejec family
bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

Processes:

resource	yara_rule
behavioral2/memory/2808-133-0x0000000000D50000-0x0000000000D59000-memory.dmp	family_bdaejec_backdoor

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
behavioral2/files/0x0007000000023ca3-16.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exeOMmJKXpD.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	OMmJKXpD.exe

Executes dropped EXE 4 IoCs

Processes:

c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exeOMmJKXpD.exec1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18eSrv.exeDesktopLayer.exe

pid	Process
4896	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
2808	OMmJKXpD.exe
984	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18eSrv.exe
660	DesktopLayer.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/files/0x0008000000023c9d-22.dat	upx
behavioral2/memory/984-23-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/984-27-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/660-34-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

OMmJKXpD.exec1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	OMmJKXpD.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	OMmJKXpD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe	OMmJKXpD.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	OMmJKXpD.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe	OMmJKXpD.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	OMmJKXpD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	OMmJKXpD.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	OMmJKXpD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	OMmJKXpD.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	OMmJKXpD.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	OMmJKXpD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	OMmJKXpD.exe

Drops file in Windows directory 1 IoCs

Processes:

c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exeOMmJKXpD.exec1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18eSrv.exeDesktopLayer.exeIEXPLORE.EXEcmd.exec1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OMmJKXpD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18eSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exec1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "129"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\AskUser = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "22"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "2005"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.bing.com\ = "2065"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\bing.com\Total = "2825"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9AD03961-A6F1-11EF-BDBF-4A034D48373C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31144702"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "2112"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\TypedURLs	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\bing.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.bing.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31144702"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.bing.com\ = "2112"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31144702"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\bing.com\Total = "22"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.bing.com\ = "2825"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\helpdeskgeek.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\bing.com\Total = "129"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1872647780"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1870616593"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\bing.com\Total = "2005"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "2065"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\bing.com\Total = "2112"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.bing.com\ = "129"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1872647780"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\DOMStorage\bing.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.bing.com\ = "2005"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\bing.com\Total = "16437"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000013dbeb74f69550459d232b3693c378ca00000000020000000000106600000001000020000000135445003a635a23a4b7bcdea775ed5836de2b5cfab854f3832946e1b51d8208000000000e80000000020000200000008215f555ddc489c8c62a1455ecbf8c0d74ffc0460a39a7af0cbb0715555d234d20000000095e3f6acca71829163c6b88b093c245b8f07af4fc8666bb9c788134cb4c2edc400000000808aa9c25114b764c273e6b0ea2b292a92d3a0f8e84d6e0ee3bd305f4618e28ef46721d6bd542ed795754fa788477b6d09edbd3819512b21ee92b77f17c06d2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1870616593"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.bing.com\ = "22"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "16437"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.bing.com\ = "16437"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Modifies registry class 5 IoCs

Processes:

iexplore.exec1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exec1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

Processes:

NOTEPAD.EXENOTEPAD.EXENOTEPAD.EXE

pid	Process
2052	NOTEPAD.EXE
684	NOTEPAD.EXE
4848	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

DesktopLayer.exe

pid	Process
660	DesktopLayer.exe
660	DesktopLayer.exe
660	DesktopLayer.exe
660	DesktopLayer.exe
660	DesktopLayer.exe
660	DesktopLayer.exe
660	DesktopLayer.exe
660	DesktopLayer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe

pid	Process
4896	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.exe

description	pid	Process
Token: SeTcbPrivilege	2852	svchost.exe
Token: SeRestorePrivilege	2852	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
1644	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exeiexplore.exeIEXPLORE.EXE

pid	Process
4896	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
4896	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
1644	iexplore.exe
1644	iexplore.exe
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
1644	iexplore.exe
1644	iexplore.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exec1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exec1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18eSrv.exeDesktopLayer.exeiexplore.exeOMmJKXpD.exesvchost.exe

description	pid	Process	procid_target
PID 4672 wrote to memory of 4896	4672	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe	84
PID 4672 wrote to memory of 4896	4672	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe	84
PID 4672 wrote to memory of 4896	4672	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe	84
PID 4896 wrote to memory of 2808	4896	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe	85
PID 4896 wrote to memory of 2808	4896	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe	85
PID 4896 wrote to memory of 2808	4896	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe	85
PID 4896 wrote to memory of 984	4896	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe	86
PID 4896 wrote to memory of 984	4896	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe	86
PID 4896 wrote to memory of 984	4896	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe	86
PID 984 wrote to memory of 660	984	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18eSrv.exe	87
PID 984 wrote to memory of 660	984	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18eSrv.exe	87
PID 984 wrote to memory of 660	984	c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18eSrv.exe	87
PID 660 wrote to memory of 1644	660	DesktopLayer.exe	88
PID 660 wrote to memory of 1644	660	DesktopLayer.exe	88
PID 1644 wrote to memory of 2164	1644	iexplore.exe	89
PID 1644 wrote to memory of 2164	1644	iexplore.exe	89
PID 1644 wrote to memory of 2164	1644	iexplore.exe	89
PID 2808 wrote to memory of 2720	2808	OMmJKXpD.exe	113
PID 2808 wrote to memory of 2720	2808	OMmJKXpD.exe	113
PID 2808 wrote to memory of 2720	2808	OMmJKXpD.exe	113
PID 2852 wrote to memory of 2584	2852	svchost.exe	127
PID 2852 wrote to memory of 2584	2852	svchost.exe	127

C:\Users\Admin\AppData\Local\Temp\c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
"C:\Users\Admin\AppData\Local\Temp\c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Users\Admin\AppData\Local\Temp\3582-490\c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Users\Admin\AppData\Local\Temp\OMmJKXpD.exe
    C:\Users\Admin\AppData\Local\Temp\OMmJKXpD.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\72671893.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2720
- - C:\Users\Admin\AppData\Local\Temp\3582-490\c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18eSrv.exe
    C:\Users\Admin\AppData\Local\Temp\3582-490\c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18eSrv.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:660
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1644
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1644 CREDAT:17410 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2164

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2480

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_desktop.ini.zip\desktop.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:2052

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\3D Objects\update.txt
1⤵
PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\system32\dashost.exe
  dashost.exe {14e6e3ab-63bd-4897-97fa47affb3d3678}
  2⤵
  PID:2584

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Pictures\update.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:684

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_desktop.ini.zip\desktop.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

Filesize
2.4MB

MD5
d9e8a1fa55faebd36ed2342fedefbedd

SHA1
c25cc7f0035488de9c5df0121a09b5100e1c28e9

SHA256
bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a

SHA512
134644c68bd04536e9ea0a5da6e334d36b1ce8012a061fa6dabd31f85c16a1ac9eee8c40fee3d55f25c4d4edf0672de8ce204e344c800361cbcff092c09d7a33

Download Submit
C:\Users\Admin\3D Objects\desktop.ini.zip

Filesize
306B

MD5
25b4b9887b7abaa6acbc28fc003dc323

SHA1
254f65af3c4e181b02ae909c56558297ca46a9e2

SHA256
023d4e41468bd9ebe9394f9e8a5ea9eda574e8748e16ae3acd31f53d161920fa

SHA512
ee19748a00cf9d86b2d946601d96bdae177c6a16224101b8fb9afb38048a3f77696523e62a432dbf7c16463754bb165c790157459bb5ea8fba7e442265e6776e

Download Submit
C:\Users\Admin\3D Objects\update.txt

Filesize
47B

MD5
8a7f4f1a98e0e99c926552e87db0d51b

SHA1
9eb7160ab0599a8e3679ab3ab3dec11c21d4b9e8

SHA256
b60b1af31ce0a7af63587a7ce20bc983f454f8f5a76902fe6ff680842862090d

SHA512
0d691e081bf9917e983cae529116e065e9b6a68d97db7187d90fc8d316ccf03e200c03fe38886980702970ab274830855d0fe1486ff27b2fe688aa616e680e38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
11d14077869dba67110eb7f6cae1b120

SHA1
f05e6bb7204a6e0efff37eedf3447eedc5de7b84

SHA256
d59818a872b22bd33909691c19daaf807ac7042fc6897dea5ba296d02530f39e

SHA512
9b62bb5f3e777e67ce440ca88f81e5e215443ad2c679b076d10a0534e816853340589d8d8e5e36fc53d60efe4dd5c0537e0fdf011064d1f8ff2c2dbffc2c992d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
471B

MD5
8908169e4b2be46060c4a18b449fece4

SHA1
ff1bc8a3ca9f4d36bfe3eb8bdf84117e994f1bcb

SHA256
2ca2edab397eb5686ae9da441bd3eec2b0781abda62ba902062c3c9b7a6d8723

SHA512
60b8c5da024672c8dabff134443ca83528885cfa41bd1e0141f766c7fa2837f7b3c31ca14e88221b2cb24cc2e823c347fc79f88d1a5b2d39161258f93e896b3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
250a6955ee5be46ade09eb811a1a1943

SHA1
503b11367bae0e5d4659bf3adc0c4d0af6a2b66a

SHA256
ec946f7098685e19fc38bc5a1b2d24b5c5f296ad3192f561a5a7d60048f536a1

SHA512
285436bc396f9995ecf3a707aec74f4267be32fc7c54b1529a011212771707bcca362d3d1b261b8589525081be8996f8596b3689c072c9fdf628e21cb0b626e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
950300e7d4bfe949edfcaaa5c8d5bc8b

SHA1
80dbdfcb96422d09735a80bf27a73937d5113700

SHA256
07f4febb5e6b0052bf5388d28803530068d0e0f361d49cd4d65414df313aed1b

SHA512
6af821b8ee069a6c34118b407add7552e41e9fd3fc68fe5f6fb6796769b25872016633b4cfdf8a8addf4df16fa5327adc4f1d1b73086d914037c7e39256fb3b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\RVGGKF29\www.bing[1].xml

Filesize
3KB

MD5
b5229aff6c782cd1b9f0c41b23635c9a

SHA1
31ae23f080e382b269062a50775427ad5e893f02

SHA256
26ded49507f468626b41d58bb850b233be56205bd56adbecd996f08320e6900a

SHA512
506f926c1a255f14c38704571eeb9c9b2cf69e19cc274f6016dfdf1e7d6eb869005e6a17bb042da9e72624c5207225a284c2f937f9a45f40d532727ac62a8550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\RVGGKF29\www.bing[1].xml

Filesize
18KB

MD5
4a4c512369becea4872d5a3cd4a6a5ad

SHA1
bc0c0a3ceaba12e70b551a7fabf2dd180c909ef2

SHA256
3a8380999d3fc461606c38508948a4d14dba4491226f2acb69dafe401937dfe2

SHA512
dfa4c2f78e0db769af747c125214f652f57abb893b052ec0676fa496d48bc63a881ae12934a59ea0254fcd2f2795d2bc8cbb052ed385b76e2967190b2c738fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\RVGGKF29\www.bing[1].xml

Filesize
325B

MD5
8914c1bd5af7c6a6957b15c0728fb2f9

SHA1
97a9b7b57c43f2957d6e45eb20b710fcff43b900

SHA256
163a5b79d7468279d82d9da01202e3ffcdaeec0fa31c31833fc47f2ea56637c3

SHA512
704f74cd031381e998177ad934ddd74b9ccbc0927e6166f3aba3a646928e8e17dacdf4950977527795a2c05a4aa092dd79a08958b4328bfe98514fca64cb9277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver312D.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2dn1irh\imagestore.dat

Filesize
8KB

MD5
0749a5c380300a796422c2dfdd929132

SHA1
321c741e03249c3cbae4dd67520365729e65560f

SHA256
8b2923d4a688ccbe970e6d2cafbbef304373cd7c40c79446f87bc41d95d933ca

SHA512
53d06ba9d91e112c4b6b0e801c8c5fa41f3e354cbf40d488bd89c12f9728651d229c87c672080200cd0223c3ec34d4cb18b1e1bb7fa3abe2014975e2baf1adf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2dn1irh\imagestore.dat

Filesize
9KB

MD5
2a514c01cf5e771a3cf61abef60df4a3

SHA1
126461f44e6acd53c0b0c76efbb9182765ff6211

SHA256
4a0896ef8a429e307985998968d2f0dd51c8a22ea6710e67010e33b33189412a

SHA512
91ce2909973205163c65c861a27e3a82d5785a064ea9ea8989c5b09f5c227c1853582b6be4a3151cc8cb772db78fa27fec65dcd56cc0b10be073e2929d37f852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YUS9Q6F\favicon[2].ico

Filesize
1KB

MD5
27ca80b26e1e7decb383756dfed0ca7a

SHA1
f2a534ac97bdbdb060657089d4598e8f9d448724

SHA256
b85dd830387b6543b2f7d6cb5e2737d2f391934816e34351b5f16b4803bcdbf3

SHA512
ceb175d572db52a6204052179a04b95618d1581c402cbb4eb86055156e2956405ca23e8a4d5fb162ebf3e9e2f3c77fdcb82852d5b0bed4b360b3e51e7df5d4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YUS9Q6F\qsml[1].xml

Filesize
238B

MD5
af622294bdc7c3cf0ef656c8157c39c7

SHA1
611d25f6136faf2ce4f103addbef3e914608ac9b

SHA256
444fa0686a07c2d6972b6bb9156ba5150698eb3e7ea1d2cb938e408c10f745e0

SHA512
da920200682f4f4bce2a140ecef481b75ee0c4db8ef88b3508d52b02172da56074ab1f00475811a0e45a5ecc229b2c0159d2dc83b675ff3019fdafda312c8d22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJLDY7V\k2[1].rar

Filesize
4B

MD5
d3b07384d113edec49eaa6238ad5ff00

SHA1
f1d2d2f924e986ac86fdf7b36c94bcdf32beec15

SHA256
b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c

SHA512
0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJLDY7V\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H4VCA4X1\8YOrObXXqqkJ0w1TVk3MqJln0gg.gz[1].css

Filesize
47KB

MD5
bab284a2bf481c337272898bfb289ab7

SHA1
2931455151fd53e400ac6d351ec4e2a7aff40e8a

SHA256
1640b17e59949fd1ac10b882f27b5d23645d991dc0a9f1029170b4c6b964621b

SHA512
f761d8db1cc0b2dcede94d4bff207d2a3b15d2dc3fcfb76abce2dfde20d7fed1067880c74d39bdcec484cb972ab5032787ff923180c4895832fe2e62198453bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W9QJOIKH\favicon-trans-bg-blue-mg[1].ico

Filesize
4KB

MD5
30967b1b52cb6df18a8af8fcc04f83c9

SHA1
aaf67cd84fcd64fb2d8974d7135d6f1e4fc03588

SHA256
439b6089e45ef1e0c37ef88764d5c99a3b2752609c4e2af3376480d7ffcfaf2e

SHA512
7cb3c09a81fbd301741e7cf5296c406baf1c76685d354c54457c87f6471867390a1aeed9f95701eb9361d7dfacce31afd1d240841037fc1de4a120c66c1b088c

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e.exe

Filesize
828KB

MD5
05d4c9a45a77e6862739fc5f29aab804

SHA1
957ce7ecbe85f7f97bfe5666a54da16b65fdb195

SHA256
85eaed0badd9c8ce2dde8ef3427c942f01b9fbd014e86e911bdcdfe62ea09370

SHA512
aee6213e95bbe62536e615153602bb4025235cd82e3c386392d2a094682aa15c32705a9ea1b142c20c665f6a7bb2fab47499e0dddd24a60f6275b7e6c6d8e77f

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18eSrv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\72671893.bat

Filesize
191B

MD5
207ba19c6c6a64180465e47526cf198c

SHA1
8aa77309d385253ae121f05a9742f4450c16d75f

SHA256
d526413628e83f7f9a3930171a356049ba1fff0d16d764b1dc1b959e8c2b8b18

SHA512
4604494693d8ffa6c3c203aa39a62940bce1b0bb56a5f8bc278631dd4c40011bf5142b35c57b1992abf9fbbf8b0707de0bd5caee986150c17bc147479190b26e

Download Submit
C:\Users\Admin\AppData\Local\Temp\799B3B5E.exe

Filesize
4B

MD5
20879c987e2f9a916e578386d499f629

SHA1
c7b33ddcc42361fdb847036fc07e880b81935d5d

SHA256
9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

SHA512
bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

Download Submit
C:\Users\Admin\AppData\Local\Temp\OMmJKXpD.exe

Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Users\Admin\Pictures\ApproveRedo.gif

Filesize
356KB

MD5
da5f93dcb1dfd70beca4ee7fc6f6b945

SHA1
b3b6d610e030f4467352a4df3f6d49aa6dbca63f

SHA256
0ecb3581d5672825bf1d34de7bb90b9365d6a3c2c153c9bb94d60b0f7ed92d97

SHA512
4beee390eb8505c6fe66bc8e656b23d54c67627139922ffa34282de187eff0cdf83cbec6c10318af1db66c40f7b3d59945ff2623a40f55915aec6f0c2181bb43

Download Submit
C:\Users\Admin\Pictures\BackupBlock.png

Filesize
246KB

MD5
1ec509fb753b5bbbb4fda672845ba2d3

SHA1
2d9862e833f06ea3854920b7442573d4971933cd

SHA256
5fd5f0afb4d250da18fc7b868f013aa34e7ffb2245055c38d5a3274dcda03289

SHA512
09013b3f7ac9f4b2f249516ba384aab2bb920dbb502f69726ba61b05d27944aac78c7884784a3671a135713d80cdc375230c0b370e3f30c6522913b0d63d0074

Download Submit
C:\Users\Admin\Pictures\ClearEnter.raw

Filesize
219KB

MD5
77d5eaacb1c34a4645eccfd82f696b26

SHA1
4daa193052d44adadbecba5724e41133ec1827bb

SHA256
4ac8afd3fa852e2e5b2d95bae260f28f7754feb0f411fc695fdce149aaa44a49

SHA512
a5cfa850c7d586466c75f5162ac388b9504e39df91e810f902414792699f029e62366c01fed8c4986dc638aa6f6aae91f9f2a508691c3516f6008d7cb6aeae9d

Download Submit
C:\Users\Admin\Pictures\ConnectConvertTo.emz

Filesize
210KB

MD5
542fc1aa3c64946bc4db9322ca94cfaf

SHA1
1fe3f82de3d003a8252fdecd73fa9f566274419b

SHA256
ae9d83993bf58bfac148249c5bcb7b3bbce41d563f2ec5030e578c61df204a2c

SHA512
0569232456df291f15ae5cbaeddcd0b704761d756538c858b63f8be08cd51bb374d2878481b590148973308e10341b5e4b4b9925b312e3c4a395eb031b957b2c

Download Submit
C:\Users\Admin\Pictures\DismountUnblock.ico

Filesize
329KB

MD5
8ca580e6e7110113734875bbc0fc6e9e

SHA1
2bd5627c76e35f8669eb55141748c17b39925139

SHA256
badb998e27eb66ea9053f91738c8cece1225d3ff06b779126bf70cbcfa4d528f

SHA512
e17c4d3d44b96e8f5bc57d39cda53a7fcec906a8bd70466daaeaca5b2b185beff75ecab277797732bf98759c568ae6f8616f0ba0fabc01b4421d146695a78697

Download Submit
C:\Users\Admin\Pictures\EditCompress.dwg

Filesize
283KB

MD5
f2be208a4746bca774db473cd9ffdf7e

SHA1
2338b40f0924af5ab4287a406103dc6253b875b0

SHA256
d3be2f6b1901b18a1f6d15ce687bbcc2265ccf7d06c300603c2f962bdceb63a1

SHA512
243a143fc2c41fd5d73ea32a1d4cdd788c11bd78fbbd95a594166600e39bf5f6375df9bfc94f1f79d424ee3dc1c151e6a46a628b2f3a90827b126deea4fa6d7a

Download Submit
C:\Users\Admin\Pictures\EnableUninstall.jpeg

Filesize
255KB

MD5
210882499f659525a3ba894b74e13d67

SHA1
7ec5511678ad07b412d7afe9f83b59decc64ec98

SHA256
881586e09e2b77bdca7dcbd3eb4b6dc71dcf15b2db2dc5fc892ec2b46da663ff

SHA512
f322a861c449fae5eee32b6a6a09a30c166918a630f04edfd027a49fbd8ba237263cce4445f222fd1dcb2287cc4d7d9a17581ce2f2c13959590d838e64735e60

Download Submit
C:\Users\Admin\Pictures\ExportUnblock.emz

Filesize
237KB

MD5
7095548a200e1745305a59682768acf3

SHA1
945eb46758ca93f5b75e79ade56a6b20a7e1a090

SHA256
d6fa97c30e91b8a8ed5a9f76077240319f3ae83dedc8f2efc808705207c03220

SHA512
f69f2bf1b8264a079d1679c4a3011c0822d48a836b0178191537b8761f7d10c71d4208e19e0cd8b0ce8105d71f4aadb4168a6900411dbee15c18e5f328ad846f

Download Submit
C:\Users\Admin\Pictures\FindCompress.ico

Filesize
201KB

MD5
926109a65c8b5c290ca987ec381f8524

SHA1
9031fd0c7b27776fdbcc34174cc6c7d7a26fe25e

SHA256
68c552cc8f89ad5897253d36313851c7272fb42baccec5c357647e632de7e3d1

SHA512
8eb35615d44ef98954fc684eaea755773048f875e2e2ded42a46a597a7735aff78cfe84a049dc897446299bda6caa2dfa0c3a2a46e207f312ddfa8f22a272a47

Download Submit
C:\Users\Admin\Pictures\GetClear.dib

Filesize
155KB

MD5
4c19ff792c7855d4b581f5e680c996b2

SHA1
4fee90b1a42f47af5f58a78f8ee2e51e5dafb55a

SHA256
dc0572f9d7627519856ce08ec134e62fff7184fc43eb9c2d7adc6dbca516e939

SHA512
4bd20877d7094a19db2be5f8cecd0591596bcc9c433ca29ecd1b15107985d5f8f11f458662f2033655b0674f0ae8f2d7c9af79a667dc296df00d650393894682

Download Submit
C:\Users\Admin\Pictures\GetDismount.tiff

Filesize
164KB

MD5
22605e9fec7c93169575f6881db21ac9

SHA1
ef4a7e93963aceaa974c8d6654d45e7f81388a4b

SHA256
9837529e16cb940e32a1ec90cc55a2434ebecb3c548394f375da58ada934cf6c

SHA512
c5617bdad69f15c18024a4dbf589d1d9997ebce08b2415fd6c777bf7846c4d1f02c641ea46e0fbda25c377d4acdcfcd2aee7b2d0e6256bb521be4bd2420c654d

Download Submit
C:\Users\Admin\Pictures\GrantOut.wmf

Filesize
228KB

MD5
edba5d0afeb36a743ac15dc86086cf17

SHA1
7acc78ebd6922b38afdeefe37b015b005ba0cf33

SHA256
306c22eacf7c76b645a5f5b6603bd8d2ec8167808b0fb49d95633a81e08175e8

SHA512
934db604a097c96ae34cfbd2e91fada59e8aa1f128f401597489e5ddd93a88f2821c5833e1a198fb569f4dd4c4b3dc029f1159a89c385046617a8ee043745e27

Download Submit
C:\Users\Admin\Pictures\GrantSwitch.dxf

Filesize
319KB

MD5
a5c0ef0eaf1b972c7db85f424f16d1e6

SHA1
6a3bd5ae12b160426f2d200b9e0cbcd029b6bf58

SHA256
4c1c5d1ad7cce99cfec8192a56ca9e7b08fec438da4d6d40cae2bc9d850f5463

SHA512
e79a0024112a7552357601a08d33ea4c1188e92c3df3f32afc3ff24a271105e0d04c2ae93de1727b51cbc1f0d39a0498467f62c137c8f70d6b48092dd278636a

Download Submit
C:\Users\Admin\Pictures\ImportSearch.svgz

Filesize
265KB

MD5
0a90600296daf3cf859d874d7c1f0b55

SHA1
5789d57c3be5dbcf69d5b480c14dec8ae3190016

SHA256
70c2aec535d4ca37cb129108b7baa0a5da13f0be14a54400f2e6a913165101d2

SHA512
59373d367fa8b2ead6c0962e2048519c03793f445c3c550466b09e0c4ab9c6af2caa53dce442577023095da8e7bdc5216d7df2d7d13eac3b52490e8276427439

Download Submit
C:\Users\Admin\Pictures\InstallSubmit.dwg

Filesize
182KB

MD5
c2c3f50fa723317bdc12c1cf38c45c0c

SHA1
d86a93b7f4df957f7354f5c72cc484efdda5760c

SHA256
adc81b42585b8dff98fc16e597c472c1558dd618507be6a12c450b8f2caca6fc

SHA512
adc5bbe8a869ae3f4e9f14776df7dbe63135795a5f5d466b174d7822dbf00d1f04fa5132e291722d5e0bd1bc76659b968e18da49e8ed3907ffe3f4df6a28dfd6

Download Submit
C:\Users\Admin\Pictures\MoveConnect.crw

Filesize
503KB

MD5
c3ec11ce388549235cf8b60bce18f6ba

SHA1
efdbf31fb4bb34210c21cf301d583475e53f188c

SHA256
d2bef2659b46dbf48b60d6e390ce81debddfdf6b4d90f71c9f25b6e4bf1527c3

SHA512
2b5a5440397b87e67929045d77833339e8ef51489cb9cf67819733155467beb906fb44be087f2de08047f57871523287a857b99d92d0606fc587c76943bf9695

Download Submit
C:\Users\Admin\Pictures\MoveDeny.tif

Filesize
292KB

MD5
a95a84420abfb328561ddb092cefde2a

SHA1
9b2189736b9c79e1e7a24a6572d83468db65bb3a

SHA256
807521d42abf274a3fea49e1ad07fd2200cb1c17e861fc7fc96183b8988bfd9b

SHA512
2ca5910be6de908e47a9188e257e1dfed537aff799cdca18c77737b34824a8b97cc2c2dff932b277e2cf6c4e2a9bbda843713a884f53326928f758897cc5aaca

Download Submit
C:\Users\Admin\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\Pictures\PopUninstall.emz

Filesize
274KB

MD5
79013efbd247857dc1b334fb0c2d6515

SHA1
057602290bbe3a939f72e7a9e343cc527dbc6abb

SHA256
901838795cb99678994055e4b49b7a64972e5bf9d1e1071a9583d591205931c5

SHA512
ff732c7b63afefadc1d6a822ee0534171305388eef6d98738bf74446153495f6d91a259d25165b66c208a727893862dde07d12f79ee12e8ae14c0590b2560f92

Download Submit
C:\Users\Admin\Pictures\ProtectWrite.ico

Filesize
127KB

MD5
e05371549de068ab6299979035390aa8

SHA1
fe8f735320b49d7282e8f57ad7c44449cca0d2ad

SHA256
63f3bb4f09e51a1cd521291ba9ad5a6e798c72e261f6215b5c8fa61c456a3223

SHA512
364972469ab1b76f5d6436cf566ad99226fb6d9a0808cf996f465a344ec6a4a403270adb679671672df4db1da02c9cdcc9c827948f56cf951244a7c9970621ab

Download Submit
C:\Users\Admin\Pictures\PushClose.ico

Filesize
310KB

MD5
7cf80d56e8da9a70b2652203374739d2

SHA1
f368689c40a51e8dc701ed817f26d701c0f40ac0

SHA256
ea568820bc454fd96ef63a6edc094970970cf323557534d3071efeabae0fce7b

SHA512
433bad17691129396018ceeb8bbf502aa2c28b3e6d34e1bb236436c20e4cd9c28789b7963d67268216a9515f5a077c9fdee47d15ea50013e8ea51fd89b393bf8

Download Submit
C:\Users\Admin\Pictures\RedoPing.tif

Filesize
338KB

MD5
c0e25929261ae5e81e6101c93c45b7a2

SHA1
058b3daf99086e5ca3638a6669a320f7b9db2288

SHA256
3f51fdaaf94927f9d528f205b1d73fc38ec3739e6693aab181b41ad4eddc0e1d

SHA512
2114f40bd128ab143c774e5c38ec32368807ea48702537a0ea8165112baea736afa4d61db9250059c544fb51a859c1e3f3720d6fb7af091aa9b50c0a10263370

Download Submit
C:\Users\Admin\Pictures\RegisterTrace.dwg

Filesize
347KB

MD5
705fc5c9132cf4ad4e02c3dde9f9cf2d

SHA1
bcd7ca47e731ef52981ad295fff55a991e57763d

SHA256
8435b150271537336d1922ef2e59f48fc9783302d781a6c69d577f8e759304a5

SHA512
5594d66f4ff96ca248c7c5f4a2fc1116fec41efbfe4022a8dbcef4d9a2b63ca320ae10c41da5a7aa9f71aead11b21541934e1e569759f2b5f31a337e17519f11

Download Submit
C:\Users\Admin\Pictures\Saved Pictures

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\Pictures\SelectCheckpoint.jpeg

Filesize
173KB

MD5
677c5c31b71e24a4cfa6143dd4d355af

SHA1
bb351027450cda3005a0c7f43ed568ccc167f70b

SHA256
5f8e5a00fd720b88c08c4d80b8a28034aa31ba33e5f6f42513e6676a2316d074

SHA512
59449d54451077356a2b0cb55dd90ac94de4ff4b8bcc64482ac513360e6c9e8b7658314e09dc5fa88d16aede2f1a09c213060fecaa3f4bb03db28a69dc87c807

Download Submit
C:\Users\Admin\Pictures\SetCompare.svg

Filesize
137KB

MD5
ceb964d284df12f8f9f879a8e2e55caf

SHA1
c3d5e6c9b5795c67ca4a9fac4cb6bced3d0aa15f

SHA256
cc56faa618636391546ba7d4c75cdd40d909eac846fc93ede28b394ddf4c2c63

SHA512
4b43ae8f06f3bcc940cbbb3248d8502d6986b176b4c6ee509f626d24b69ee19d1afd4b4c5eafabf061bcdf04fa908967c2acb9f1b234614c3fa5b84da6a7850a

Download Submit
C:\Users\Admin\Pictures\StepShow.svgz

Filesize
301KB

MD5
9fd7932b973ba36a1f63f4f7aeb51960

SHA1
74949804d6c52b460bbfeda773d9bb6f84154e1f

SHA256
91f7e911ec4f713d8f50f77a35060b0829a46bdd6037062852d76b32daa45aaf

SHA512
5d9a6fe5e00d96882ae50abe95df4f57641f8447de99c10fe18b111511aaf5e5ed1c9d14de640c1c51dfe5279fcf9fe352656461e7fea97a76a6c0ca10fe8a79

Download Submit
C:\Users\Admin\Pictures\TraceUpdate.jpeg

Filesize
146KB

MD5
d26b4f8235b17c5fb3fc3adec1d71f8a

SHA1
33ee0ca705cf6082a6fa466d23c7e449c5487ee4

SHA256
cad53ee4a416da2df0dd086ef614740158bba8f4fe1eda3205c5c10ccda8d44a

SHA512
75cb5326ade6219758a124a068198428f8a9fa35ce3ffdad30293a5400313aee1e3f1150d25141cafbdadad0f16814a71a8e48f6857d5234f68265445ebec90d

Download Submit
C:\Users\Admin\Pictures\UndoReceive.gif

Filesize
191KB

MD5
a17cdb779f7e824828a7be3d47e0a864

SHA1
8a982bb20cd7d0381a228d280ead030f845ced9e

SHA256
3f4fd8eae6d5fba1f57b2bce937df011114f3d19031a3e8f199e00993c58993b

SHA512
67dea6bb53f063331f40edd37babb066cdb5bb22dc430ea0256ef437c6c9b5a5f13ccc15f4c15e3b18040701e94c059f518ba5ecde680961c4ee6a4c7e71d1d1

Download Submit
C:\Users\Admin\Pictures\UndoResize.pcx

Filesize
365KB

MD5
14afd71fb9dd0a97fee0eb49233ec841

SHA1
ec4fdfba4873f8ae6a65a71a83fc03ff6a4e7c5e

SHA256
da3c3e923d50f3edc3acca916808a627c660cbda139cb09b5a1606bbb019c0a1

SHA512
5947af1e7f601be762cfd9f5c21457d23e317e4ace6b593b2f15e3f1f760221066c3180552a8eb9714ffc93238ff109f96874e45559316b6add2717ea6986d41

Download Submit
C:\Users\Admin\Pictures\update.txt

Filesize
47B

MD5
f3698db3045e9c6c213fa50819f11963

SHA1
be48a14e2966617dc320eccabc00a02466e5ae21

SHA256
7f833c14bb7aaeaf67d06f437187c3c6bf714e3e567dc966b52166e5e364e072

SHA512
f353da68257d0d5a71d4ebf63b607b2a7cba173e2e61dcb89ceb20b515aeef23707036f25b2469c1116c4b4982a0764986178c7b5bb7390b29c9d494ae78fd16

Download Submit
memory/660-32-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/660-34-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/984-26-0x0000000000550000-0x000000000055F000-memory.dmp

Filesize
60KB

Download
memory/984-27-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/984-23-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2808-133-0x0000000000D50000-0x0000000000D59000-memory.dmp

Filesize
36KB

Download
memory/2808-18-0x0000000000D50000-0x0000000000D59000-memory.dmp

Filesize
36KB

Download
memory/4672-176-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4672-134-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4672-132-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4672-193-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4672-191-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4896-235-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/4896-12-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download