Analysis

  • max time kernel
    242s
  • max time network
    281s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2024 22:04

General

  • Target

    thezipper.txt

  • Size

    14B

  • MD5

    ada56df3ed161cadaefb029dd0b1d47c

  • SHA1

    75b9e2fe8a26cd9743d24ccb10bed0accb109e9b

  • SHA256

    bdbabcf091c25e94efec0e4904fb524abdf454c3838e5355c15cbc690e8fda80

  • SHA512

    4ed175117f611a24fd0c70c3867dfbc1ced5f922bc4e141f76c29b31992ac82171a0c87023687ec502d223683678c08b8477478ed7d2849ecd6cbf48b359a7d9

Malware Config

Signatures

  • Detected potential entity reuse from brand MICROSOFT.
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 62 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\thezipper.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:1168
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3116
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8be4acc40,0x7ff8be4acc4c,0x7ff8be4acc58
      2⤵
        PID:1040
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1972,i,15521217980245951779,7076069581427789124,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1968 /prefetch:2
        2⤵
          PID:4456
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1888,i,15521217980245951779,7076069581427789124,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2204 /prefetch:3
          2⤵
            PID:4432
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,15521217980245951779,7076069581427789124,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2556 /prefetch:8
            2⤵
              PID:1764
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,15521217980245951779,7076069581427789124,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:1
              2⤵
                PID:1684
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3216,i,15521217980245951779,7076069581427789124,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3268 /prefetch:1
                2⤵
                  PID:1160
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3748,i,15521217980245951779,7076069581427789124,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4648 /prefetch:1
                  2⤵
                    PID:1452
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4908,i,15521217980245951779,7076069581427789124,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4632 /prefetch:8
                    2⤵
                      PID:3256
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4940,i,15521217980245951779,7076069581427789124,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4632 /prefetch:8
                      2⤵
                        PID:1756
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4860,i,15521217980245951779,7076069581427789124,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5132 /prefetch:1
                        2⤵
                          PID:2488
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4868,i,15521217980245951779,7076069581427789124,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4980 /prefetch:1
                          2⤵
                            PID:1100
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5284,i,15521217980245951779,7076069581427789124,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4736 /prefetch:1
                            2⤵
                              PID:5020
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4728,i,15521217980245951779,7076069581427789124,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4764 /prefetch:1
                              2⤵
                                PID:3872
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4744,i,15521217980245951779,7076069581427789124,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5020 /prefetch:1
                                2⤵
                                  PID:4328
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5228,i,15521217980245951779,7076069581427789124,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3604 /prefetch:1
                                  2⤵
                                    PID:808
                                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                  1⤵
                                    PID:1936
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                    1⤵
                                      PID:392

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                      Filesize

                                      649B

                                      MD5

                                      b02233a464c23e8285d5377e863ce7c3

                                      SHA1

                                      60a323e369970c92d136e549776b0f0a4ad47b7c

                                      SHA256

                                      fb69a0dffc3147ddd9b8ef55dcc09fe1f8e084b421319b434d6c3dbb0e29750b

                                      SHA512

                                      e81cece41f51edce943d828693c31965822034462d2a6a033c446d976723a627f77e0fc24a323259c696b5b2524274af63139c75a485bd86cc978f921232b595

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      1008B

                                      MD5

                                      5cebdd7bbe3d0102fa3fad0d8c524ae6

                                      SHA1

                                      d0642dc842d746cef728cf523e81d7845b9b4e19

                                      SHA256

                                      0ebe205d52fea992af3b6311bcec97d1182eb98dfa76575960aef03471cde2f4

                                      SHA512

                                      b07552637ff1d8ac3090d89922080b1673cea636a8cb676e8a344afc97b5e7d3ab82c0ee87c187fa19477168f46b1ab69926f501ff4f215dc2a3fb0ee0385619

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

                                      Filesize

                                      264KB

                                      MD5

                                      21a96f042942a71577ac4db2c5c3379d

                                      SHA1

                                      05dd67fa31e04920d8b10dd3b958ad721d31c9fc

                                      SHA256

                                      94ef6b3e95cbb04acd05d9dba7a6e5c50e7c79ca33ae99762a82426d4d720c57

                                      SHA512

                                      a413165559d1ba07c2613db348afe49e5f1abedee47e9b9aa528fad59812f8fed0b28d675c35a4108b05ae9a1c7d847ececedf55fb5ecf24c9353f0773de5053

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                      Filesize

                                      5KB

                                      MD5

                                      5f202e931d03bbb339322315ce5d6c62

                                      SHA1

                                      f030f15fa900b9f1ed02b6047958849886cbd5e2

                                      SHA256

                                      d9987d12c7409b6d5298c76fe6573cb4c604793ae655937e566d37b41bd2a25e

                                      SHA512

                                      4b99daa77487f2061be987214b798e01fc3347f94cf1ceb53162df54dd99dae043cb2e17202c045f8f8fb00f427e605e00e3d9e623232f50f34f9632965d8c9d

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                      Filesize

                                      2B

                                      MD5

                                      d751713988987e9331980363e24189ce

                                      SHA1

                                      97d170e1550eee4afc0af065b78cda302a97674c

                                      SHA256

                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                      SHA512

                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      857B

                                      MD5

                                      3c9b3c10f9e577a386097d95ae3d21b8

                                      SHA1

                                      2cb995066c3316f825aaa501bb0d238587607211

                                      SHA256

                                      bc7449a44d462a586873dd8dc9126fb5252607960a470d7598d6ca9546b87d85

                                      SHA512

                                      7d9c86b62df09ccec370ac2d2987e23eb88aeed0fa926da6d46959d76774334e944318783cb3a907470f59e67935b60aabb3756618f5c1c41aa762b51d9d3299

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      2KB

                                      MD5

                                      29fe5a2de6752a3c80ef4f4b26872c97

                                      SHA1

                                      082cacd815ac7d631c137cfe39bf39c63b7b78d4

                                      SHA256

                                      342eea667ba82eae9ad7136657b76aded93f9a4cf33f18edcadfb5b409ec3cf2

                                      SHA512

                                      f1374876088cba5ed6efe6cbff9ed0d2ca120aec5c31dab89470098f72faac93e751f06bf8aa74b7ffa73bae9d419b399c16a321dcc921810e4e7e6475a8a5b8

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      2KB

                                      MD5

                                      02ec38a759ac0d3db53a5aec29022772

                                      SHA1

                                      61b9a56264c654395c7877c80b12a660e3695b29

                                      SHA256

                                      84c7e19fbdb7a3ba686ce23d6d450fcb323de8bc48c020c9ab054c728ed1c8ae

                                      SHA512

                                      cd20e2f974062f9005fd3696eacdbcbd59987ea585566bcbe789607e4b6b5841047f81b9477ed996ccc6e3d2ee6493f7d5cf8e91aa5f685662b4375fd2ba788a

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      9KB

                                      MD5

                                      19b5289dadfc432dc20e2e9f0308d812

                                      SHA1

                                      025712a68913cb17bfc860680ffe8ad21c991622

                                      SHA256

                                      f23902306cd4b33ea0149f5dde977800ca2c9d358af66efd003b46e4f0fd4c28

                                      SHA512

                                      f0f9a67627b6d11e0ddfb959c716343a6ea9466d1a2b5753c4df9f4dca64be1476227db1a3964acc30275e2c2b015816ca07056c8ba13ff967a62ad0dfb3c0c9

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      9KB

                                      MD5

                                      50161b91b40cab8c952e0daabbfc518e

                                      SHA1

                                      97b95554b2a62ace9cbdec852b2d551966c7bf66

                                      SHA256

                                      898d362bbaed3d26540cd24ade95b9a01fef8c6b3c5ad96c76e3bc5bebe192fc

                                      SHA512

                                      3f1f4d0857535f179ce6edc2e84dd335dcd02e9fc5514b99ea29666ede5b74becae99b393b74b229f36e9ef2dbb85ee390e59ff653479aff72555c8a292cfb11

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      10KB

                                      MD5

                                      d854593af7b4b1863e52ed4978c97e60

                                      SHA1

                                      79a8596d61752008cee64ff904d7688cbd1f6324

                                      SHA256

                                      77521fc95cf2999f6db8c54b2693ff3e2af3ee062d4589a4b35cf4eb97c8b355

                                      SHA512

                                      239d17d6d10084337e8ab9b4d53d93728ad6a1bfb989bf38a1e2d5456b48f8ca48e26faf5bc6b6f549353f829f96c42f1a9f020819d52dd7815b4cf4222a6f54

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                      Filesize

                                      15KB

                                      MD5

                                      2e0590ea7336ebd0407a9b49f7acf0ba

                                      SHA1

                                      444e6450badba7e5c230d3e9f38e870cc0604efe

                                      SHA256

                                      d1c0a3b719e3ef5805e518a6658083ee76795be1807d95f5ae2d80a7ee37863d

                                      SHA512

                                      69b816a672ead91e951861d49fdf7fe0574dc3c5584ec2fca0a7e8bdd67fd513311cc57b5d76d9a2c2dbad575a00a3d90cbcb4d4e7b15b213f7e98551bdc128f

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      234KB

                                      MD5

                                      9db04606d9eb731e83349c85031bf451

                                      SHA1

                                      b0b73c08030bb50ad644c950bf0eecacfbf2a0c8

                                      SHA256

                                      662532f6846451d0519cba83243ee518c29cd056590c8d6be16d6c511eb38888

                                      SHA512

                                      470f6edd593cf8d88dfc827b9bd2c48ed8c14048e68d89d0530739db68850f4775395c2080bcfb92260fdb88f668363d8b326c02f641bf40f14bdd8e3b96b716

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      234KB

                                      MD5

                                      af6e69d2e90ae7a9d3d46f41939923db

                                      SHA1

                                      3a0777f4a173b4101c0b83a7222dcf5b08d973bd

                                      SHA256

                                      86af046aee91976afdbf2aba4034d086bf867cc8917dff345549e726513cc2de

                                      SHA512

                                      0104f8d669502c54dafdc0d0c2b47b85213440358ddfb6a310efb864ee4ebaba4830c44e105f938718e20336dcccaae34edff98422034bec54531982ad63ab4b

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      234KB

                                      MD5

                                      c249ded780d5c6cbe62bd713c5a5fb61

                                      SHA1

                                      55cfd584e13bcc25c13bc12ca4ad002ce7671bdd

                                      SHA256

                                      50fa8c221129ea4a6fbbae9d5375b6ecdaf7ce4acc08b1346d9fca6c22df2f56

                                      SHA512

                                      262a6744cd686ac2751aec6f63940de15cb46d6a699ecc5fe4779d8adb508321446087385fcd6dfa81151032165a6b6c386ea82fe5019bd518505208ae26d196

                                    • C:\Users\Admin\Desktop\ApproveGrant.docx

                                      Filesize

                                      17KB

                                      MD5

                                      52d89407412ecc7a812356fa9da5a0ef

                                      SHA1

                                      18f7dc538513315fda23f231e74916c254f93a69

                                      SHA256

                                      32345058a7fd02663b37c36cec64943d1f979c46e84f33f16c2f6b360cec7e0f

                                      SHA512

                                      dfb5caecf64c4c31c41e69e289ae74248bd89388149b5c319ed799a78a0c2c40837470616ededbb5976c2087cda76456456b95a26681c3738cd91f51949c227f

                                    • C:\Users\Admin\Desktop\AssertReceive.mpp

                                      Filesize

                                      540KB

                                      MD5

                                      2c613f97d3b387256e372e5a8deb8c73

                                      SHA1

                                      91feabecbd16b2f93453cc43a1f47c98be0e2fdf

                                      SHA256

                                      213aaaed256210e7276c8c7e6c22dc5bac9637b866299306dcd9895deb32b0c5

                                      SHA512

                                      19b97b94b1c200f9010929ecb29ac9a3eea8a60ea7f0dd506bb12d5364a418365fac2573e0fd281f2b303425821a1ff39d7213d1c534a3b867ed6e844eb33d58

                                    • C:\Users\Admin\Desktop\ClearResolve.docx

                                      Filesize

                                      13KB

                                      MD5

                                      a4b9a34e7dcaee683306bf8f49711c41

                                      SHA1

                                      93e90fc5eba2d47a923bca76c2ba5b12e997b606

                                      SHA256

                                      7115fa46dc2cdfa3a1d92949a205474d1de6b6858d0f79cf68591ef00152eb37

                                      SHA512

                                      eea521bda898ef8b1fc7f0b3a121ba520a682533bc6887d7fa5b2d4280bc45328e1b40245d4fa8138be8eaa1ed9fceee310eaa0b7b15a44547991dcd0e175ed2

                                    • C:\Users\Admin\Desktop\CloseExit.crw

                                      Filesize

                                      952KB

                                      MD5

                                      8df4e70e50cffdefb3bd67fd972794f2

                                      SHA1

                                      701c5eb2d36ea9b074552e66eda32f282ed81ee4

                                      SHA256

                                      2dca6b7409ff0fa509b0ea0da1b7920c296d236cf255efac36a32debd4d963a8

                                      SHA512

                                      54e305d134554317b174d7d116736cd4a2a378415581ba25b0f02e39576b7dbd685a7c17da42a498ab75e0680cc0198a2c93cdb30c4df496cdb374b77cc7ea80

                                    • C:\Users\Admin\Desktop\CloseRemove.ttc

                                      Filesize

                                      772KB

                                      MD5

                                      79194dca3661a0ba0fdea3768f1a697f

                                      SHA1

                                      ffd85a07b72b2a8d1b0850d0567d4c0d8abad37b

                                      SHA256

                                      3cc1723ffcbaf6436795c52d0ee6e0f5d66d3bf5d1fcc497d3045c63e4aad9e5

                                      SHA512

                                      2969bccc9385221650bf9ee8c893e9f4bc646f75ce1c7492129c2865f568299b5d0eccee5e8acebc0ffdad37c1070744565b9cf7acfe870e735088bd479ab611

                                    • C:\Users\Admin\Desktop\CompleteExport.wax

                                      Filesize

                                      618KB

                                      MD5

                                      7629d773c93599d8f760f188505c362e

                                      SHA1

                                      e50ee5ce03754efd8524aef3353746a441e47670

                                      SHA256

                                      2ebfd82cb93e9562e8678bb05fcafab5236c00bda0219171934b8fba881f6f1b

                                      SHA512

                                      0bf532e4735f5bb48ea42053ccf2ee297ade65b645c82f6191d4f0c4078dcc8669198ff795b967ed109bbaaedbe09540b24ffbe7b76c929dd8fcccb126337c55

                                    • C:\Users\Admin\Desktop\ConnectConvertTo.wmf

                                      Filesize

                                      437KB

                                      MD5

                                      1fc674501cbed578a5c57822dc7f51ce

                                      SHA1

                                      cb0bc6babf4c01f65b68c12688148f24b90a03a5

                                      SHA256

                                      6d6d03ca38e6f349aa5b6b54c490746e53baa1d670c110398b018c8250c75d23

                                      SHA512

                                      e32cd3bf9dffcc2e355e89f0b706594f9a419aeb78149a850566f722262b9b34b0cb6227c391c22fed3bf2f69c90cdf89ea09f4403c2a89979946c53bd8f32f8

                                    • C:\Users\Admin\Desktop\ConvertToDeny.mpeg

                                      Filesize

                                      643KB

                                      MD5

                                      fa29e6c3c0e399d33ea745e63daf4dfb

                                      SHA1

                                      2d8aba655ded3fa8fbad695df68f4a9564a44930

                                      SHA256

                                      96a629c9124d54cc6352304d40931a0c73a96fe89bb10ed01a7be798d8ab98f7

                                      SHA512

                                      726b2565d1222c19087473c6b8b723e7a453244e09473b48aacddf441e430fa8a8b16a2f49d6e15568634572ccccaf296e777c81e03c863b7f9193351c4143e0

                                    • C:\Users\Admin\Desktop\DebugApprove.potx

                                      Filesize

                                      566KB

                                      MD5

                                      d5c526c1697541dcc8187957f08b7e37

                                      SHA1

                                      b891c787064b7c95982a039336631483a249aac0

                                      SHA256

                                      8726de1aeb3cf14510f22594c19fa636548f6e99dfa6660906c0828e3df31dcf

                                      SHA512

                                      b8228b50af1cc9f8337014f7e93fdfae2e43cb965242c240e55a65751d51c9ff5d81d66b292a9652b175617fa93aba3f052cf5938645e436cc6bfb77acb940d7

                                    • C:\Users\Admin\Desktop\ExitLimit.xltm

                                      Filesize

                                      592KB

                                      MD5

                                      c09faa3468923a0f2907a8f4a644492e

                                      SHA1

                                      48a30ed7cd1891ca68e42d69167ea6312123cfbf

                                      SHA256

                                      ffbb2a705109a1ed59b04388eebc057afb3b83d01541498f7421f0d164de4231

                                      SHA512

                                      ea5fbdb3cafeba3d714c0d0854701ca0c64d3c2c07b54a4af19646565188cda45bcd6f1230bac62137f27b20b86dbcc03d7d12d48c7e66a0938a65659b80515c

                                    • C:\Users\Admin\Desktop\ExpandMove.csv

                                      Filesize

                                      463KB

                                      MD5

                                      d21d6455cec0aa638ccd408558f2260f

                                      SHA1

                                      0bdf3778f14543888c6dc40938c60a6445944208

                                      SHA256

                                      a03a99e233549a37238e5c29fac7612d0c7a13618bc11ee6b35290a30f68da29

                                      SHA512

                                      b2f24e77614aace8004e5ca67aca13ad8d58984370e85d19aa24353b31db0a02a3b27c5ab1677a77a732c7c5a3522291de188742660f8761577c3a67773a4bec

                                    • C:\Users\Admin\Desktop\FormatExpand.wmx

                                      Filesize

                                      849KB

                                      MD5

                                      97fab27023e7079ecdfdc8902033bf2c

                                      SHA1

                                      a03077e400fcde39ca5d5bc8f793d92281548c85

                                      SHA256

                                      466b3da2ed515350f18b30a0d7dc88afea6f0b2e0e5a4a4fc01523582041f7ec

                                      SHA512

                                      2e99937ffa8f35343802ee45df209486f45a8dda78974921e0aee6028cdca450fc4944d48c9aac6c44363f3c05b86028c4435b988a4e77efc63901521962b4d9

                                    • C:\Users\Admin\Desktop\FormatProtect.wdp

                                      Filesize

                                      489KB

                                      MD5

                                      4edf0d3afee4a26e1a4dfcd8a478ad76

                                      SHA1

                                      554e2f40c41e8a511872d574205f112c5b08061f

                                      SHA256

                                      65289c2937f73f5d17c64e0e6d5a54402d1ad92afe765dbc0897179e41775d38

                                      SHA512

                                      400d44dc4aff9b82f2896f081785a4edb5a78e7a2bd192764c3d2824dcad5a5b6a7d0fad53d901dd6775bc820e03cb9a6709b6c0d9c0780138b9ae994994efd4

                                    • C:\Users\Admin\Desktop\GroupCopy.ico

                                      Filesize

                                      334KB

                                      MD5

                                      7da95a93527f2de7a12dd2cb3506b2c7

                                      SHA1

                                      657a9c4990b6ade8e96bbda2e41093952d61dd4c

                                      SHA256

                                      bbedfe0b73d6174e5279999ce4ddc0ab9f6d6d512358f021138125fc9688248c

                                      SHA512

                                      de8d7d833389af430c78e7447e91e84511129592207475014b3e66160e5e2ee18a82144989d6037a84d6de018da71f180f0de9c47db55cb6b1ed9e2b2966794c

                                    • C:\Users\Admin\Desktop\JoinSet.zip

                                      Filesize

                                      669KB

                                      MD5

                                      793bfe66a0854c8e473381581aa8e0ee

                                      SHA1

                                      a67ea5c0fe3f2a675dbd36931e3984a01627f27f

                                      SHA256

                                      bc4683bb9bc02f0f563f139f1be27082a3f698b22247a71efbb2b89ec26bd293

                                      SHA512

                                      d5565ba7ef232dabc305d946c12483ac1de4576af10d36f7f4313d5feb0e36da76efaa33f757e2ad2bbd6c77751404eb13b8eb5254e4c57c10f14c4976cb11c0

                                    • C:\Users\Admin\Desktop\JoinShow.emf

                                      Filesize

                                      412KB

                                      MD5

                                      3b7615eed6bc61dec93a310c4fa9db37

                                      SHA1

                                      061b340624c3659bd851f6c708f5a25fce05ac77

                                      SHA256

                                      126cc7745dd7222b67a597d4df4653d99d629607f1efb5ab24dc2aa05cfb49a3

                                      SHA512

                                      579f788f399059633bbd316e1ecd4696bdf8470be41de3c10cc8365e28046bc51f9da53fa06612c9920ffb2b12d96e833b776583256982ff0399172d9b5f361b

                                    • C:\Users\Admin\Desktop\MergeUnpublish.wmx

                                      Filesize

                                      360KB

                                      MD5

                                      dd06ef9e6a245d5113ad0d4f5935e64c

                                      SHA1

                                      3fcd1ed6576da6cdbb1f5c0b066486231bc9f0d5

                                      SHA256

                                      a7cad5cea346141295898633a3426fc5d595b13e238e315ee961e0c7a44f23e9

                                      SHA512

                                      262a9a4b56af3b7d5ffdf2c0f94637cc1592e194f5da85ec5772ca752df51219450dad6d8d63d50ea4f9917dff8673a73e0ac5ac29ad707df37dfbdfea954e19

                                    • C:\Users\Admin\Desktop\MergeWrite.3g2

                                      Filesize

                                      515KB

                                      MD5

                                      8274268be2c8e0886a9eb94b651e20ff

                                      SHA1

                                      71f23e5470425d266c2f36fbe699da8c9b71cbee

                                      SHA256

                                      66b3f51f1210fad31100e8f3dfa774ab8b9b0f9ed40d3d2c866686ca67fff4ce

                                      SHA512

                                      0ec62612e47b91226d5ac18a92a874041c9a7d071d4d199a67896d3930c6f8b9460085239164d703f7d36945e87910db82dbbd047369ea7e1b09fccc765a24da

                                    • C:\Users\Admin\Desktop\PingUnregister.aiff

                                      Filesize

                                      927KB

                                      MD5

                                      7fa86fb02550eee916434d8ba03470f7

                                      SHA1

                                      26fcbc9acd7989fd295e94554d3e96a63d5e3ee7

                                      SHA256

                                      e84c43a12ba39a9d539e562459bd341bb82c6773eae64b7628eba4831a5bf186

                                      SHA512

                                      0be0a6b3ec88900a5ed40320376486c230103f4e1e9fef686b8212d03bd1527b307dd867afcdd58080571125d420d3653fa38f1712f1aa61f8d965dbf61f6470

                                    • C:\Users\Admin\Desktop\ReceiveCheckpoint.xlsx

                                      Filesize

                                      11KB

                                      MD5

                                      bb5fcb02716259271058b67ee66de61c

                                      SHA1

                                      2ba5160cdc1e194edf4389ccd61ecf705f91350d

                                      SHA256

                                      4622db325c860ef5708114d942fb34543a2f6a052ae8867fb32415a30befeb49

                                      SHA512

                                      0e478672b6096a93b857f7717a55932841344fd21aa1c466333fa0f5ec11d3425b5c64090bc368d8757bd571ea31ae8ab5534c10fda98d945d68c8e26bcd7253

                                    • C:\Users\Admin\Desktop\RenameOpen.ppsm

                                      Filesize

                                      798KB

                                      MD5

                                      7c0fe4894331e0797bdbf8278552613d

                                      SHA1

                                      2d70fb434fc1a4cc973d824b086799feff4dc88b

                                      SHA256

                                      ec0c9c511bd3467e6e194ec03bb8dfc80b700af680cd14ef35eedf476d3b1bf7

                                      SHA512

                                      de8796fe4ea23ea22f7beb4083ac24fb04e725b67a5c8df81519c09c916a3409550afc89b02e4e4b7bc9e1c89cecf37b4739086a042b128acbc753f76381eb00

                                    • C:\Users\Admin\Desktop\ResumeDismount.doc

                                      Filesize

                                      901KB

                                      MD5

                                      559624e9ff307f4d129afc5cccd15c9f

                                      SHA1

                                      6396af2bee1dc0c5a2f140a52fd5e586f89182b3

                                      SHA256

                                      fb17e879404f2b9159e2bad3ad0bd71d813a584e2da6d4bd54c731cf36877722

                                      SHA512

                                      06bf29b2406029306114d477294651bf0546a4223b0a24cd83bf221a4e54f097bc330b4e04c43af98dc7adfe7a881ed5e992674ac6f6985a408fb1653a3563c1

                                    • C:\Users\Admin\Desktop\RevokeMeasure.M2T

                                      Filesize

                                      1.3MB

                                      MD5

                                      da192615ae6afa2ee5830ca105b860d8

                                      SHA1

                                      e5747976949a25ea356a8742dfc6ca43391ae7b5

                                      SHA256

                                      06fc27e49a26e19a26ae151a0d7571a21bc67990ab589593760c370f3877ff51

                                      SHA512

                                      b02cb217c706267e40fd4691b420a188b0c838c388715ae7c6258e40bd989cbe08a49db1bc69b38819cf08cf8f8210aeb96a4fa3a3291653589a7cc0fd9e105b

                                    • C:\Users\Admin\Desktop\ShowProtect.xlsx

                                      Filesize

                                      10KB

                                      MD5

                                      e429aad8a78e1bdc591f620549913332

                                      SHA1

                                      df97499393ba8df4d56bf40ee5d16c36106d5ab7

                                      SHA256

                                      579f29eca9ad946fd368cc9dff2778e958db340a947752eea7f803df12ea13cc

                                      SHA512

                                      74ad97a47ae0a16fc5017ff74f15a179ed82b9ab285eaa7ac41511d59d740a88261c72d6e7acb3d941a990f7494f438a7e401eef9e3db2fffe3edb6d43ebf86f

                                    • C:\Users\Admin\Desktop\SkipRestore.MTS

                                      Filesize

                                      746KB

                                      MD5

                                      1324372ed1c3b3ca8338a28503559ab3

                                      SHA1

                                      8d6860576d676a5a47bd947aedfff8cfec4bc701

                                      SHA256

                                      e81ad9322aeeeeaa891a3bcbd323687942f3060802b61c41f86ac6ce2faacbc3

                                      SHA512

                                      3768330b47e1aad6173c04ab731ab82d297f28b5d75db753896738d06f59a6f10a5c636bab53f2fe77baaee212f820fa8664e5743be3c86dc5ddaff992b3b7ab

                                    • C:\Users\Admin\Desktop\SyncEnter.reg

                                      Filesize

                                      386KB

                                      MD5

                                      d38f6d6c5beab1fd7390378ffa11a192

                                      SHA1

                                      b0b7467898c09bbd06e4fcd5042869bc557cd3b1

                                      SHA256

                                      cacfec97f1bf5bb69c9337e89d642d8ca82eb77bb542ad6b5d01af27c59aa87d

                                      SHA512

                                      4776337f8c3adaac00d1bdd5f44f22e017b1eb5252f7258433fca43fac02f1844e77031b9e55c5c90ba5c38e367e98c75f182ab3bd0c74642aa4bd1460e22dd9

                                    • C:\Users\Admin\Desktop\TraceUnprotect.wmf

                                      Filesize

                                      824KB

                                      MD5

                                      31fb447f6c779d013528617ba959dbcd

                                      SHA1

                                      8f5a8678f9a98c056d25129eef3a1adf54aa0664

                                      SHA256

                                      e014bbff63501ae86beada9e387ef8461e55f31b975846d158fd2afa72b26226

                                      SHA512

                                      9699bad897ffaa7b4b173a9aab1bd2b8d0646f120f3c143add3074cc973c71f497d114016860e9a5b4fc4cb447ff167add266b461f5834607042acbd2984af93

                                    • C:\Users\Admin\Desktop\UnblockApprove.clr

                                      Filesize

                                      695KB

                                      MD5

                                      b96d4079a0eb6979fd9796d2a43556a2

                                      SHA1

                                      c7152c19c1ca7d088134458db70e4176651e2fae

                                      SHA256

                                      ee3d8381cc844301db437a97d382b5370d4a24a28c70944723a69f63e7eafddc

                                      SHA512

                                      b14e7c2e9d50aa6a6ad23d4710fbba8b71ed0fe882bef6ddc8fd10886930284e05eb911f861c545d23f1b04687467947c734beff523b3aef8a9a88b70142acf5

                                    • C:\Users\Admin\Desktop\UndoBackup.bmp

                                      Filesize

                                      875KB

                                      MD5

                                      bc4f2f3c3050da3c4d5d009cd5601a75

                                      SHA1

                                      01cafb5d6073e90c26f6fab65c28a1a5f960b79b

                                      SHA256

                                      38d06a564dffe102df9079ef2f0eec7cf8c25abd42002d070783182e7dd13dfa

                                      SHA512

                                      3e51fa2d74af8e24f3a7337cdbc4822fcce3defd1fbff374bfaf819e356935623bb86aca072a08fee12e7070109cd9c55ac8b447fe4fe0b83ee6702606e872e7

                                    • C:\Users\Admin\Desktop\UnlockInitialize.au

                                      Filesize

                                      721KB

                                      MD5

                                      a0ae1f773cb8c063fd65abaefa458dab

                                      SHA1

                                      cc0d9c377066c682f4b8d71714c0908ae5537924

                                      SHA256

                                      1c532dc255216a85592e517fdfe1ddd8b7368d1855d0964feb03ac341b050fa1

                                      SHA512

                                      2048f45fafb71f9c1e32302a08e4abfcafe2fe44757e3b75ceb20a9eb99082f3326df209840d5c022231ff67a04cdcc4dddd0551025eaa3d8ca2a85db01c533d

                                    • C:\Users\Admin\Desktop\UnprotectTrace.xlsx

                                      Filesize

                                      11KB

                                      MD5

                                      e013f9881fbe2b5e52e811945c018e36

                                      SHA1

                                      e868c156f74d2792b82f00954aa91e84a9e148ef

                                      SHA256

                                      d2d4e5c408bbc2728b839b492c1fb5e68583a59ebc24db355478dfcc40d4774d

                                      SHA512

                                      0fb6505c0c187ee919f902511b2d863d65d6d1485d81e7740ec0113286b2c3a29f86a6e9ddd1406e048c152624bb3ce0a529d6e3dbcbf34780d16d7e64b9738d

                                    • C:\Users\Admin\Desktop\UnpublishSend.docx

                                      Filesize

                                      20KB

                                      MD5

                                      6ba251ff18dc1b5e606dce19ff11dd7f

                                      SHA1

                                      8afb5d7ce600e4fb2b5d62bd6dfa5c19ef3584ee

                                      SHA256

                                      f4691689d567fff73514aefc015b8cbc766ebaa26ded0eeaa4c827f409ae6a76

                                      SHA512

                                      8ebf01d0a5f4943bdcdac4c2dff9b515c9153a7fef005a56fd6ce5a2b9e65740d5097b7a444600f6737eee47af149a5593623ed67eeb383df68a42c30e0021b6

                                    • C:\Users\Public\Desktop\Acrobat Reader DC.lnk

                                      Filesize

                                      2KB

                                      MD5

                                      889e2f348fa835ccf75ccbf4b6a9c11b

                                      SHA1

                                      4ef8aecc0cef8dcea5c467f3a64e90de4d85571d

                                      SHA256

                                      5ec2d3be91076af618b4c28b3222157492f01695a4a14be79f00b0d638a44305

                                      SHA512

                                      f0a13d829beee93d815305eee6f94119e94d3c305cddc8919eccb5018b0fcdd3b637dc8831583bdfa5704544e068f97a81b05fdfd23353de6c6ee6e991910699

                                    • C:\Users\Public\Desktop\Firefox.lnk

                                      Filesize

                                      1000B

                                      MD5

                                      80292ae4d30f8b561c2a0e7f4a81afe9

                                      SHA1

                                      61d1f7cb010a143c6a974834aeb70cfd8993ad3e

                                      SHA256

                                      72c903c510ff96f662ae0e563338c5348660d7c3401dca5f23ab26cc34f9980a

                                      SHA512

                                      d7e1c5d017534800e1afe1216b67b28e4e970c3360763aee133572fd0d5fdf03a90ff21bc436954e79a8cf76d0452e75c362792e9ba30f54bfab96069faf638f

                                    • C:\Users\Public\Desktop\Google Chrome.lnk

                                      Filesize

                                      2KB

                                      MD5

                                      3cb5a20a132dbaf9524e643c6d6b370d

                                      SHA1

                                      dbfbd9e38fc850d6e8ddfb8ecee3400099122e62

                                      SHA256

                                      0a5ca8b7109b0c81169877662987b3540d28fcc45523a9c7b9a8f0576b3b6380

                                      SHA512

                                      cbafdbd2e68958bf7e9fc022ade60aaa1c78a7c02cab486d6d212128fcbb4f7dfd3e48fbdd31ba2fa590bae43f27fb94379069f5c2166aefb4956aa084728a69

                                    • C:\Users\Public\Desktop\Microsoft Edge.lnk

                                      Filesize

                                      2KB

                                      MD5

                                      eaf9f30b134bf64c6100ad3f317c45f6

                                      SHA1

                                      7ba792f670eea0a66af0af89d9613d8dfc67b2f4

                                      SHA256

                                      49185e4089fcf7f0e542de4a00e1149a5de20b66e6566d1d009e46b4f66a4213

                                      SHA512

                                      fd20f3a86bc6b639349c33cefb1883744963e9a8931198b1728a8a0079442f3d7ce3432b367205c425e9dbcaa763dabd827919c900abc2b2698510f14233c94f

                                    • C:\Users\Public\Desktop\VLC media player.lnk

                                      Filesize

                                      923B

                                      MD5

                                      bd0304616a3d54be488d1e7e5f8a5bb8

                                      SHA1

                                      507a216c2f9d05b07f510d0c566ecbaa3127338f

                                      SHA256

                                      713b296f920da03f06f80fcbfeb140a80a59805482881c04d0a8be7f2ea677d6

                                      SHA512

                                      e472dabdaece4f063390c4aa82df3efe722fdf538de83d539cf80307003c8a6054c0538ce9450a26fad8f08f97e19da3c62076fc36d20571b555c84719e9f3c5