ddebb4fc3c9145bba2714f090e6c550e2133d3b9ec89be1a85922f86860b30b1

Analysis

max time kernel
186s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Roblox-Song-Sheet-text.txt
Size

259B
MD5

963aea559e0d8a538a582af14f3497f3
SHA1

90c26e4e18571ce45cb63bfe919859502b9d6730
SHA256

ddebb4fc3c9145bba2714f090e6c550e2133d3b9ec89be1a85922f86860b30b1
SHA512

626798f15e8e9e3dcf8c29cf9fb83c67bfad506035a5e4af7889539c1b1fffb2bb1f6e9adab45d42fa401270a702fb3fe2c9eac6760b9340f772157c650a9409

Score

8^/10

adware persistence privilege_escalation stealer

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 20 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

integrator.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	integrator.exe

Manipulates Digital Signatures 1 TTPs 13 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

Processes:

integrator.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{9FA65764-C36F-4319-9737-658A34585BB7}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLCREATEINDIRECTDATA\{9FA65764-C36F-4319-9737-658A34585BB7}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLVERIFYINDIRECTDATA\{9FA65764-C36F-4319-9737-658A34585BB7}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLREMOVESIGNEDDATAMSG\{9FA65764-C36F-4319-9737-658A34585BB7}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\MESSAGE\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\DIAGNOSTICPOLICY\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CLEANUP\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\INITIALIZATION\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CERTCHECK\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETSIGNEDDATAMSG\{9FA65764-C36F-4319-9737-658A34585BB7}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\SIGNATURE\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CERTIFICATE\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\FINALPOLICY\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Executes dropped EXE 1 IoCs

Processes:

Un_A.exe

pid process

2072 Un_A.exe
Loads dropped DLL 5 IoCs

Processes:

Un_A.exeMsiExec.exeMsiExec.exe

pid process

2072 Un_A.exe
5700 MsiExec.exe
5700 MsiExec.exe
5804 MsiExec.exe
5700 MsiExec.exe

pid	process
2072	Un_A.exe

pid	process
2072	Un_A.exe
5700	MsiExec.exe
5700	MsiExec.exe
5804	MsiExec.exe
5700	MsiExec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Processes:

integrator.exe

description ioc process

Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} integrator.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	integrator.exe

Drops file in System32 directory 3 IoCs

Processes:

integrator.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-wal	integrator.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-shm	integrator.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db	integrator.exe

Drops file in Program Files directory 54 IoCs

Processes:

msiexec.exeUn_A.exeintegrator.exemaintenanceservice.exe

description	ioc	process
File opened for modification	\??\c:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\adodb.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.moz-delete	Un_A.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\VFS\Common AppData\Microsoft Help\nslist.hxl	integrator.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-uninstall.log.moz-delete	Un_A.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Microsoft.mshtml.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\msdatasrc.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\ActionsPane3.xsd	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\VSTOFiles.cat	msiexec.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log.moz-delete	Un_A.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\	Un_A.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe.moz-delete	Un_A.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\stdole.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-uninstall.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini.moz-delete	Un_A.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\extensibility.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Microsoft.stdformat.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\	Un_A.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store	msiexec.exe

Drops file in Windows directory 7 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID45E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDA6A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF69E.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICD87.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

OfficeClickToRun.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

OfficeClickToRun.exechrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exeintegrator.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8D13E03F-8289-4c15-A84F-7A8F655C830A}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}	integrator.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8D13E03F-8289-4c15-A84F-7A8F655C830A}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}	integrator.exe

Modifies data under HKEY_USERS 26 IoCs

Processes:

integrator.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe\ULSMonitor	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	integrator.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers\DevModes2	integrator.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133642654809608121"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe\ULSMonitor\ULSTagIds0 = "18679566,5804129,7202269,23978014,39965824,7692557,5850525,34198423,41484365,17962391,17962392"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	integrator.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe\ULSMonitor	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	integrator.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeintegrator.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9C5B7379-CE75-4980-8E9B-D0E957AF4A41}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlsb\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{7AC3193A-D19C-3FC5-8FC4-85D98E7A2F8F}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{E36B9FC1-A17C-3072-8B64-A1618BE070A0}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{4F6505F6-D566-3762-ADC4-13F4B9C7BD3D}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{506E6BD9-3A8F-3FE1-8548-C6F2B9DDC68F}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1ECC88B3-6D2B-4EDD-8DD5-BB11E5D34C09}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{28F0103E-1D08-431E-8CDD-5554D008BBC3}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1D81C8D5-149B-481d-B4AF-7605E0942FAF}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{8DBAA8CB-E1D0-3531-AD9E-9E8F08E651CA}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/msonenote	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82B02374-B5BC-11CF-810F-00A0C9030074}\InprocServer32\11.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{000209F0-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9F0CA17D-346C-3D99-AC23-2EFE66AD4809}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D569CCEA-6168-3997-BD18-51FA2E56D16F}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB13B3C3-AF9B-43DB-9DF8-B2F65AA5E21B}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vsdx\ShellEx	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{000209F2-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDEADE9E-C265-11D0-BCED-00A0C90AB50F}\Programmable	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.potm\ShellEx\PropertyHandler	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.12\XML Handler	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{61D328E9-E23E-3D50-9618-6CE4D3BFFFB5}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pptm\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F3CD-98B5-11CF-BB82-00AA00BDCE0B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{E9E3CB7C-052B-3808-A4A1-1DDB096DE50C}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{458A41D6-E330-3C6D-BD4F-42AFFDE4CB91}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F37B6599-0312-44BF-984E-1136C06CDAB2}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{32FB36EF-2E57-345C-98BA-051FB07F8F6C}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{28BA4FB8-CF00-3D36-93CC-D8CC41DDC817}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9C37F9D0-FDE5-11CE-9560-00AA004B9DFA}\11.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{FB2904FB-ACC0-36C0-8D06-AEE924D88A08}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{760A1DA4-732F-3807-9348-F1523975D7CB}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.pptm	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020819-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{8821D638-E5AA-3B23-9960-E43858D7D96A}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A1EF1706-9D13-3891-B1F4-2809F5D11FE5}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1AE9019C-7BF8-444B-9453-06275F07C7B0}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002E119-0000-0000-C000-000000000046}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CDEC13B2-0B3C-400E-B909-E27EE89C6799}\Control	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B2EDC2A3-924D-3C82-B34C-DE7E8F03BD0E}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{589E54F8-90C3-3C76-910B-4E6CBF21068D}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F4FE-98B5-11CF-BB82-00AA00BDCE0B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{30E041AD-9765-3CC1-BA81-262471691C8C}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{8E3D8175-9840-4F3D-9558-ADBCF2339E94}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{76D9466C-84C2-4355-81FE-CB1B9CB03C19}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18987285-971B-4C88-AEA9-2A5600861BA5}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.docx	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A394DCA9-3727-11D4-BD85-00C04F6B93A4}\VersionIndependentProgID	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\Programmable	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{0B580D11-A02E-380B-A0F3-38F026E0A0F1}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{4CD00FDD-731C-3E59-B790-FA2595E529D9}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{946DB172-20CF-313F-961C-76112797145C}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{C9C18CC3-9DA7-3869-9B10-283F57937F60}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9DC1649C-F668-3726-9E64-CCE6C17F52C4}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{000209F0-0000-0000-C000-000000000046}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{DA77B198-31E3-312B-83EB-A0CFD52B0085}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vss	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B9164592-D558-4EE7-8B41-F1C9F66D683A}\1.0	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{000209F5-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SharePoint.StssyncHandler	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3FD37ABB-F90A-4DE5-AA38-179629E64C2F}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6360D70A-55C7-3A5E-9F6C-8F2EE3761274}	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid process

1760 explorer.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

1108 chrome.exe
1108 chrome.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

1760 explorer.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

chrome.exe

pid process

1108 chrome.exe
1108 chrome.exe
1108 chrome.exe
1108 chrome.exe
1108 chrome.exe
1108 chrome.exe
1108 chrome.exe
1108 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exechrome.exeintegrator.exemsiexec.exe

description	pid	process
Token: SeTcbPrivilege	4680	svchost.exe
Token: SeRestorePrivilege	4680	svchost.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	2036	integrator.exe
Token: SeIncreaseQuotaPrivilege	2036	integrator.exe
Token: SeSecurityPrivilege	5592	msiexec.exe
Token: SeCreateTokenPrivilege	2036	integrator.exe
Token: SeAssignPrimaryTokenPrivilege	2036	integrator.exe
Token: SeLockMemoryPrivilege	2036	integrator.exe
Token: SeIncreaseQuotaPrivilege	2036	integrator.exe
Token: SeMachineAccountPrivilege	2036	integrator.exe
Token: SeTcbPrivilege	2036	integrator.exe
Token: SeSecurityPrivilege	2036	integrator.exe
Token: SeTakeOwnershipPrivilege	2036	integrator.exe
Token: SeLoadDriverPrivilege	2036	integrator.exe
Token: SeSystemProfilePrivilege	2036	integrator.exe
Token: SeSystemtimePrivilege	2036	integrator.exe
Token: SeProfSingleProcessPrivilege	2036	integrator.exe
Token: SeIncBasePriorityPrivilege	2036	integrator.exe
Token: SeCreatePagefilePrivilege	2036	integrator.exe
Token: SeCreatePermanentPrivilege	2036	integrator.exe
Token: SeBackupPrivilege	2036	integrator.exe
Token: SeRestorePrivilege	2036	integrator.exe
Token: SeShutdownPrivilege	2036	integrator.exe
Token: SeDebugPrivilege	2036	integrator.exe
Token: SeAuditPrivilege	2036	integrator.exe
Token: SeSystemEnvironmentPrivilege	2036	integrator.exe
Token: SeChangeNotifyPrivilege	2036	integrator.exe
Token: SeRemoteShutdownPrivilege	2036	integrator.exe
Token: SeUndockPrivilege	2036	integrator.exe
Token: SeSyncAgentPrivilege	2036	integrator.exe
Token: SeEnableDelegationPrivilege	2036	integrator.exe
Token: SeManageVolumePrivilege	2036	integrator.exe
Token: SeImpersonatePrivilege	2036	integrator.exe
Token: SeCreateGlobalPrivilege	2036	integrator.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeRestorePrivilege	5592	msiexec.exe
Token: SeTakeOwnershipPrivilege	5592	msiexec.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeRestorePrivilege	5592	msiexec.exe
Token: SeTakeOwnershipPrivilege	5592	msiexec.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeRestorePrivilege	5592	msiexec.exe
Token: SeTakeOwnershipPrivilege	5592	msiexec.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe

Suspicious use of FindShellTrayWindow 54 IoCs

Processes:

explorer.exechrome.exe

pid	process
1760	explorer.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

chrome.exe

pid	process
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

uninstall.exeUn_A.exemaintenanceservice.exeOfficeClickToRun.exeintegrator.exe

pid process

3708 uninstall.exe
2072 Un_A.exe
2356 maintenanceservice.exe
3736 OfficeClickToRun.exe
3736 OfficeClickToRun.exe
2036 integrator.exe

pid	process
3708	uninstall.exe
2072	Un_A.exe
2356	maintenanceservice.exe
3736	OfficeClickToRun.exe
3736	OfficeClickToRun.exe
2036	integrator.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

svchost.exeuninstall.exeUn_A.exechrome.exe

description	pid	process	target process
PID 4680 wrote to memory of 3284	4680	svchost.exe	dashost.exe
PID 4680 wrote to memory of 3284	4680	svchost.exe	dashost.exe
PID 3708 wrote to memory of 2072	3708	uninstall.exe	Un_A.exe
PID 3708 wrote to memory of 2072	3708	uninstall.exe	Un_A.exe
PID 3708 wrote to memory of 2072	3708	uninstall.exe	Un_A.exe
PID 2072 wrote to memory of 2356	2072	Un_A.exe	maintenanceservice.exe
PID 2072 wrote to memory of 2356	2072	Un_A.exe	maintenanceservice.exe
PID 1108 wrote to memory of 4416	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 4416	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2068	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 1292	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 1292	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe
PID 1108 wrote to memory of 2892	1108	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Roblox-Song-Sheet-text.txt
1⤵
PID:3776

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680

C:\Windows\system32\dashost.exe
dashost.exe {d6be149e-7b39-4e2c-ba5491cad5c6cd87}
2⤵
PID:3284

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:100

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1760

C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Program Files (x86)\Mozilla Maintenance Service\
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" uninstall
3⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2356

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" scenario=install scenariosubtype=ARP sourcetype=None productstoremove=ProPlusRetail.16_en-us_x-none culture=en-us version.16=16.0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:3736

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe"
1⤵
PID:2568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffef8d7ab58,0x7ffef8d7ab68,0x7ffef8d7ab78
2⤵
PID:4416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1996,i,6675983240592711068,4893579128230685827,131072 /prefetch:2
2⤵
PID:2068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1996,i,6675983240592711068,4893579128230685827,131072 /prefetch:8
2⤵
PID:1292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1996,i,6675983240592711068,4893579128230685827,131072 /prefetch:8
2⤵
PID:2892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1996,i,6675983240592711068,4893579128230685827,131072 /prefetch:1
2⤵
PID:4760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1996,i,6675983240592711068,4893579128230685827,131072 /prefetch:1
2⤵
PID:2224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4372 --field-trial-handle=1996,i,6675983240592711068,4893579128230685827,131072 /prefetch:1
2⤵
PID:4604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4588 --field-trial-handle=1996,i,6675983240592711068,4893579128230685827,131072 /prefetch:8
2⤵
PID:5260

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1996,i,6675983240592711068,4893579128230685827,131072 /prefetch:8
2⤵
PID:5572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4924 --field-trial-handle=1996,i,6675983240592711068,4893579128230685827,131072 /prefetch:1
2⤵
PID:5880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5020 --field-trial-handle=1996,i,6675983240592711068,4893579128230685827,131072 /prefetch:1
2⤵
PID:5980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5060 --field-trial-handle=1996,i,6675983240592711068,4893579128230685827,131072 /prefetch:1
2⤵
PID:6008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3264 --field-trial-handle=1996,i,6675983240592711068,4893579128230685827,131072 /prefetch:1
2⤵
PID:5160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5104 --field-trial-handle=1996,i,6675983240592711068,4893579128230685827,131072 /prefetch:1
2⤵
PID:5332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:3244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef8d7ab58,0x7ffef8d7ab68,0x7ffef8d7ab78
2⤵
PID:3208

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2036

C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
integrator.exe /U /Extension /Msi /License PRIDName=ProPlusRetail.16 PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Manipulates Digital Signatures
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates"
2⤵
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates Logon"
2⤵
PID:5148

C:\Windows\system32\schtasks.exe
schtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentLogOn2016"
2⤵
PID:5204

C:\Windows\system32\schtasks.exe
schtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentFallBack2016"
2⤵
PID:5276

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5592

\??\c:\Windows\syswow64\MsiExec.exe
c:\Windows\syswow64\MsiExec.exe -Embedding 1E2A24605DC728C547EF2562E21BA471 E Global\MSI0000
2⤵
- Loads dropped DLL
PID:5700

\??\c:\Windows\System32\MsiExec.exe
c:\Windows\System32\MsiExec.exe -Embedding 3008FA884B01BA34E71190D5C75F3BB6 E Global\MSI0000
2⤵
- Loads dropped DLL
PID:5804

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxl
Filesize
816B

MD5
05ea4d7d3fcfc5ed4b76b0c3e1c7cda0

SHA1
bb2dafd5cf78979a83e31cfe85055104dff5e01a

SHA256
2a2c3bfac69ed00267b3bf1f78752b0207a11fb721634ef209b387dc01495cbc

SHA512
a5c159ff09f5f2f426eff2981802ad860c918cae21630f9b946391e5baf9e8ec8c806e5dca85f41ebf7d8a36cb405803903f8222f88893d5f2556dfaf37f72c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
757f9692a70d6d6f226ba652bbcffe53

SHA1
771e76fc92d2bf676b3c8e3459ab1a2a1257ff5b

SHA256
d0c09cff1833071e93cda9a4b8141a154dba5964db2c6d773ea98625860d13ad

SHA512
79580dd7eb264967e0f97d0676ba2fcf0c99943681cad40e657e8e246df1b956f6daeb4585c5913ca3a93fdfd768933730a9a97a9018efa33c829ab1dea7a150

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
1f1b53961c51fde100a2ad3b9b7c1350

SHA1
e83933141834f91fd992a026a33beb9b9b322ad1

SHA256
cba902300933aaae0fecd06768e7d4fe1efcedec2ffe2ca1c55f8dcbca4fabf2

SHA512
ecc15665e873ab1f0eec5d7a38e5ba9a67012db0c56ef7223aff158c74c35f538a97493529024a53869a56ba044dc62b34f1c049676c4d2bdf066b6590cabebe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
4edf3bf47b9ab600a49da2427cf7fd97

SHA1
0ed0d59f58dad43ac7d2e5541a9816019f95919b

SHA256
2b84238c1ec12f20f1e65f8d83ab2db8012d78667b30c1cd71210270d6b0e6e9

SHA512
53c37263c2b4dd2186a875eb72a444fe6e35e9b78c68588288a57e538d9bf3015f5fe53673c0120f6e86da56f96f4ef67e437817744b2ca34edd05031b633d48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
257KB

MD5
4d7322417e1111d6e07aea7b10bd227d

SHA1
dc0f4b1b4930fbcb0dcc473e2b7eefa3c79bb687

SHA256
55dcffdadeca25e496a2d1c2a672e93991aaea0bd09ed644f70c5898575fc76d

SHA512
5d20a3a0caa92b7b51ed02061e1dc3175928e9ab826e8e0fe262faa93b8a50b98526a0a3b56903a44c61f468f8f95255147f9aade2770ea7541b125b3dc6bcf1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
257KB

MD5
9e0e3ffd0df585d6c979d7723d90cfc1

SHA1
cbd5933e40f00c42c68058c38adb64a780df3fab

SHA256
9209f53b93362c194ca262eebb38d8a17a14bb5ddc7fa76a58201a9ba2e1708b

SHA512
8bcb563e605ec8df38636b3067bce3b6f4d76b0a5deb445600eebc179a176f10ba7e0c1731baa92fe661fb2a1bdd0038b3cb0a6ae3e9a0db29b83d4a4d6f81ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk744D.tmp\System.dll
Filesize
22KB

MD5
b361682fa5e6a1906e754cfa08aa8d90

SHA1
c6701aee0c866565de1b7c1f81fd88da56b395d3

SHA256
b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04

SHA512
2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9

Download Submit
C:\Users\Admin\Desktop\ClearBackup.wav
Filesize
604KB

MD5
a24484ee9ed1f313f1ea7402e1795259

SHA1
9dd733244eeeaa11116fb76d39f5cdb1e64a7a62

SHA256
76bf109be542b3503603af94ec18b34d4ec8542ea5c57424c5ff9d7995cc71f3

SHA512
b50aa120be06ff48cd9b0690c6aa1b0e0f20f52e8995b4436e34a201d9354c90f7ee704eb07ec4210d8a03ff65dd21433407ccb06279cb9484a281df6e38005e

Download Submit
C:\Users\Admin\Desktop\CompareLock.asp
Filesize
755KB

MD5
2823b82513058e7ecb22a3761f066480

SHA1
98f1e6fc1a081e4313aafef5a039e446a5c2c0ab

SHA256
5ee863a36984e2fc29e7882ee18e8ac4be7cd13ac88db104b582a78cb7ccd0d8

SHA512
325038882d0c6af28cf08054277c9f95aa9ac0de53b481a8d3867cbb0bc2aa3aad578a6ab19ae1e2c35bd463eaff72712304f8d798b06877a9c0569b1ad793d4

Download Submit
C:\Users\Admin\Desktop\CompressGet.lock
Filesize
513KB

MD5
26a428e9c64a9956c65ccbeeaba167e7

SHA1
8eeacc69240b41c62af679194191dc7114ead7d2

SHA256
7b4b0994233f726b912d011dff52bdbe010ee864412de8ab4a5e71f34b46343b

SHA512
e1aa34c637a768190d99575150b02ad249e0200cb167c5b7e48bf862f0242d22d4cdd453e8bc8d6390fad751b8704a1b047776e4633da3b861fed3870c6ccb4f

Download Submit
C:\Users\Admin\Desktop\DebugSwitch.xsl
Filesize
936KB

MD5
3d78867b0cd28b1d56e3c30d8b98f3b8

SHA1
6a426bf068bcb6cba891307475c6d89063b47a63

SHA256
37d0fc6aa46ae8e245969f9738266753ef8aceb652a83fc6deca5ebba3dee81f

SHA512
9cfd96a9b39f03d04af86150bfa29a26e50ff69d6a4958c61a0746eb09d992875cbc2fd89cc0bb218871c2ae8d9dd116cb5b1533888befe5fa9507f44db4cb61

Download Submit
C:\Users\Admin\Desktop\DisableApprove.nfo
Filesize
362KB

MD5
c6c6916e884efa236a02fba9c2f31c78

SHA1
c14dc8fd60eb4a921e8de3d83b0898bb70bb16df

SHA256
0e65897f998d2299135e52e9495f7df54baed78dd007265edfbc91c64d99e950

SHA512
ae442cb903542c37c2c836d38edc3122b8457d9a43e660d82d325430b484a32fa85cedb954050696d7076aa27bd35d7296f3b8c29f7f69fc0580e1cba62aec6b

Download Submit
C:\Users\Admin\Desktop\DisableSplit.dxf
Filesize
392KB

MD5
50aa9525903f5bebaffb615fafd43943

SHA1
a25758d78d067f3dcc4dfa18695ec1928cdea75b

SHA256
ea99ae98328c59debc108d2898f156a6f97d9e6a7003b72676cc326d87761bbd

SHA512
fd32c8da3b90f307c38c59894d8d0b1d1f3c50527c944a7134903e473a3edb0fc974819e8f060921bbca702b19d6c247d535302da1dbe5041aa2db2c649179fd

Download Submit
C:\Users\Admin\Desktop\DisconnectInvoke.potx
Filesize
574KB

MD5
5b829a5c6b5082fe28443e6f47c1ce77

SHA1
a9fd508d130c9b77e6ad79388465415e46d13d6e

SHA256
b78f36fab23674152a0e070250125112b284cd1327ef1c97277c95a46d6df100

SHA512
2e74f7b9a0c76aaa808b53e1e05e4da7cb3f59e8768182a51524731742d09f740621f76f2d9f2e4bebb159dfbd37497880f26fe595f66ccae58ed0698d7eed03

Download Submit
C:\Users\Admin\Desktop\GrantEdit.bin
Filesize
695KB

MD5
0bad6f6cbff34b0a86e12ab1e7e53d11

SHA1
4d672c148f22e92f626d0980f5d060e909cd0d8f

SHA256
0f1841941bba598d34eed24c80ca1bfba03d1ad943c31bf116bfde8ed0fd545d

SHA512
58ed7c6439f8c47dc51730c4a480c6dbc5a2caee7f2fc7b71ecf520c12931f6d2da9435d9ee3980f521ec8ec6590b15dac9678eba3119987e20e5dc6b994ac9e

Download Submit
C:\Users\Admin\Desktop\InvokeRestore.csv
Filesize
725KB

MD5
6435e43f6088e67fc52f597bb2e4fd81

SHA1
3214995a403357542a71198bcdfde450dec6d89d

SHA256
509e58ef1739dd9350664d41216c78f150d007cf5913eecaae326d6d3dc99ddc

SHA512
dfa6aff9336b1b21eed90c369092a1f5487a7aba0a7a718cdc5c5cf2a1c167aaa2aedb137577b762aacc7b07af0d822ffb67872fb023a30df0b0c06751f8a558

Download Submit
C:\Users\Admin\Desktop\MergeUnregister.wdp
Filesize
453KB

MD5
be9d702f81ed6c15396f8bd76568c174

SHA1
f056df5574cdbc04c99b3122941ed2b4981952c5

SHA256
5894adc90380c5cd506c88735ccc37501fd169ff9d78de30fbcd9a17409c151a

SHA512
fe6ac8036ce98d9cb09c82c4347e4789b70da4b41efa8b09100abb56b32ea4a2549315a4931d8b21fef47ac8f7fc97a5f32e2a61e55b6a8e97948b091b272cdb

Download Submit
C:\Users\Admin\Desktop\MoveStart.vdx
Filesize
1.4MB

MD5
fb3860d83c7d34e8d05de867fac61a5f

SHA1
c9a2853b193dfa654a4429860cec405b32271ff1

SHA256
4239ab6d89d7fc3e8e6c6ba21c1b10a55c16efd765870e839d1c107f385ec1cf

SHA512
c642a0af675d7f9fb5a1d537cfbfcbb035b7a67710a6ee42c93fdca89eff31447d1a4a7426373a43d0dc0d09acc2f181f138e72d3c00e772275cc2146dfeb5db

Download Submit
C:\Users\Admin\Desktop\RemoveInitialize.xml
Filesize
544KB

MD5
0b024c8b91e4fcdf21e2ee172f908b5b

SHA1
24cfcd39b448ffc53ced15c9f6a85f91c41284a8

SHA256
48872de533eb90c5dcaea008e82b09375fc826cf1db9f1fb42989f46f0d17f5d

SHA512
226592d1a595a6416f10e9ab2b6d294b8a5cc0e389adf44068a5ecaab762571b175c961c0dff52ec7be14ecf296c7d023fb1ea1130fe4779382ee4f84ea30c31

Download Submit
C:\Users\Admin\Desktop\RepairSync.php
Filesize
846KB

MD5
91b40933018e317bcf704cc176576e00

SHA1
755b5f0f9af1ac6dfce0f5cc33306f66db95a534

SHA256
9c070db44b6bba0991f847606ccaf7a5c1ce7b2c3b179e5379636e74013c792f

SHA512
aebdf937b7fc8f885fc4dea06f08293bcb4d5104fcfb0eb0e8ceaa42042e976ce3a937e2c1683a6af26be32f9e2b782dac7648c00bf7c0d7b0b98175f995ce86

Download Submit
C:\Users\Admin\Desktop\RequestShow.png
Filesize
876KB

MD5
c71a05476be9b2c908feb0a6a80be71f

SHA1
f3c100bba4eabee209a69499249fb640d786843d

SHA256
10a8825e80ff416485cc5a0ead806627ce249188e5cdd896a0d92d12b4ee1c9a

SHA512
d7a73cb60293b104515646bd704832e2bee99be0100e611ee7ccc6f96fcd3a4b449ac676ea7cd158fc1272c3731ab2fa66bdb9ef092ff29d11518d062aeee93c

Download Submit
C:\Users\Admin\Desktop\RequestUndo.ppsm
Filesize
906KB

MD5
049b0ca4ea3557237c208d4b91377c0f

SHA1
ef6f2f237bb3ec64a5d0a11412049043b2d7ee87

SHA256
7f9c45d2bd5baf2f9c9187af4470835fcd720d856d7f3e0147370ab2e5570ebc

SHA512
b6b545d942c4c6fe7b6414509be77837f18a5413ce9857584b0ad967706e0507d745b16aeb40b3e6d7ddf0f818ee4af71c20f50c516d5a77b6a9066db652d0b4

Download Submit
C:\Users\Admin\Desktop\ResetFind.xlt
Filesize
785KB

MD5
f0a2f4fc34b26a98d075d7998c3ec298

SHA1
7ad586dda3e2e4cc46b9b0492f3931ef15c99395

SHA256
dfa6e090935ff4836cd1a1a53a80831bffc357daad539789c416bdb05cfa3e16

SHA512
6b458465f91c654d65490cdd0bb9d005118f812bd372382c032093dd7ad7354867763c0e66d3a36c736da68f381c658b9f0c8dbb0e3ee724722159eb62e7743a

Download Submit
C:\Users\Admin\Desktop\ResizeAdd.M2T
Filesize
997KB

MD5
7a1b637096302b938a9ec9aff27cb73b

SHA1
099f58a02e6f817e760c07ed498b51f7bc8f7cb5

SHA256
7f7bf11719936da971ea30a0053911f2ef082c1fb7db513f7f1701762cff46e8

SHA512
803eab999a1609623816eb301de5444c82ae968beb79ebddcebef07b9e85fbf39e71358c1e6214d2d9f7b4b5db7757f4ce4759d4b4cd89c3515c1a72a5870e7f

Download Submit
C:\Users\Admin\Desktop\ResizePop.xlsx
Filesize
664KB

MD5
e0a729ba886e4000f82195421f084831

SHA1
8c88d6e9a304d7f8232cda7b19a8fa28b46261fb

SHA256
d6f6ce850e5e83df805de844310be9aa51e84803ab7ce40ab73044c11d2f38eb

SHA512
ac5556c8cee30ba87df50b7bb7e0ee4a9143c28ed4997864970fec144a6d047ec0db9d45f56eb4859f922cc567b70ba9f7ad2b56b40427e989fc7d6ff2f1c951

Download Submit
C:\Users\Admin\Desktop\ResolveConfirm.scf
Filesize
634KB

MD5
68e25e829a0512bc981f646d144f1a3d

SHA1
2a704100a73352d42032dd1d8d109c7746ff94a5

SHA256
abe7c3a1aed5c2cc02ebefc77e48b10fbf7e8d7481b958b3afc54035defa423e

SHA512
ad6a001b8e58385af2d8d8c0e08bb177a6fa9bfd75048435b3402fb5c31c661358e2bfbfb4030abdccdd79cd10364dbf6d253f53e16c6b2263a7a3e0be8e9f06

Download Submit
C:\Users\Admin\Desktop\ShowStop.ADTS
Filesize
967KB

MD5
27772348bf92dae3ab416ed62e47fcf3

SHA1
43c2f37c4ff9bb9aa44f3182a5e43198c61ea85f

SHA256
cabf417e73f10d41b149db1bca386b839d3f768c57da674a6b34e73021ee0d81

SHA512
ee688dafe088b789e47ea491880e49bcfc64f87aed74dfec26d47f1aedfd6dfe151d70953986b3bc6955f03b76df3c468b608452571e8b93de5b779fdd517663

Download Submit
C:\Users\Admin\Desktop\StartDeny.wvx
Filesize
1.0MB

MD5
e2a94c58ebbf66b0809474d73028724f

SHA1
e45e58930430af6ee36972038447239364148c1b

SHA256
b5434d1ee4c0637255853719e3c190071889b7b832d2c7b45b879ac1b015203e

SHA512
8ef1014a2d77ac40ea6cf420cbad0ecdf797d5779db19e3411ab812a2073726c15470f8029483ddf49093fcd1285cc0a9b4f8d1089fdb8a648244e4bc8147c6d

Download Submit
C:\Users\Admin\Desktop\StepApprove.snd
Filesize
816KB

MD5
4d5dda207de03405544946318795f541

SHA1
828ac7afba859dc4dfd29506702439a8e90b37e2

SHA256
56b80347afb398316b3cb27ce7d7c674afd3059db8693ab486df8319494bbc72

SHA512
efb2757e2c9cf86a438b10aa747c615c145ee414608ce6dbe9f29e3ca06ecbf94e13393903aef854983506e09a5c743a2213e3b36875ffdfe7acfede06bb85ee

Download Submit
C:\Users\Admin\Desktop\SwitchBlock.mid
Filesize
483KB

MD5
4c69ffa4adb709b2614f2d6bb37aa41e

SHA1
7f2ab23c0a2b0ea3603e1f84c905b95b0416a724

SHA256
54a61825f874303ec070f2d1a2ff13482742b85ff419bb35ec94eae5b07fcf6d

SHA512
9a0c7dc4c95975adabace5a4624f5a23b0e42f303888686b21b008a7a22072431c426cdfe6f463c49a346c6fcd1aa41f36d7d87495cf8796573dd21093a1c996

Download Submit
C:\Users\Admin\Desktop\WatchCheckpoint.vbe
Filesize
423KB

MD5
6315a5e2111f5060e2d9715de8203818

SHA1
244a6c42fa914a22b5d88963a206a622342e57bf

SHA256
b40d49c5ad95c6bb1b2f96ba68840f82a39ea73175075a781f1b207e95cc495d

SHA512
f81256bb3fa129cd4832c5a626947eac890787f44c3935956d812df6bddde614d7867247a8046f327006d2e5ed058b73fea9ea40dde2e450d65e54c697330513

Download Submit
C:\Users\Admin\Documents\Opened.docx
Filesize
11KB

MD5
bfbc1a403197ac8cfc95638c2da2cf0e

SHA1
634658f4dd9747e87fa540f5ba47e218acfc8af2

SHA256
272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

SHA512
b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

Download Submit
C:\Users\Admin\Documents\ProtectSubmit.vsx
Filesize
660KB

MD5
389d315cac79c44e7ac56383997993e0

SHA1
32a38ca0e1dadf9b9a429507bce36b553cd86e5e

SHA256
2b486e52e7f3d0af2c13b3d9421ea0da9105b21c5da280af3d386ab2675913bf

SHA512
06aa0db9a25696f52847cff0343ec9b7cf60cf3befbed1f49599d2065cd72ddbd82d4642b0cbd63861e77591c820796cd86d433d0d366094cbbefcb1041ab578

Download Submit
C:\Users\Admin\Documents\Recently.docx
Filesize
11KB

MD5
3b068f508d40eb8258ff0b0592ca1f9c

SHA1
59ac025c3256e9c6c86165082974fe791ff9833a

SHA256
07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

SHA512
e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

Download Submit
C:\Users\Admin\Documents\RemoveSave.csv
Filesize
880KB

MD5
23e30a12d9a0ecda677ba728c136deb0

SHA1
98b951ec25d3ceddc013211b8314eb2c7e3793ca

SHA256
36fc0d5dd36108e178af0e318d6f8dfde5e11168f2db18cdca60dfcb38e8f47c

SHA512
b759e122c0a5dc95e6dbe8b85409918cac1d6b538ed87c5d4b57115603fa5239f4519bbf0ccb38faa5de6cac2a6f023cf8f74f41e77ebc4233b7f48a9eedb539

Download Submit
C:\Users\Admin\Documents\RenameSet.pps
Filesize
396KB

MD5
0993a838482418d6f322e35e6667bcba

SHA1
96a160a1404870cd1ff2ca3506ef512a4ad5b5a0

SHA256
82834c68b92579b5a673c93552c0cde7e7f4b0efa6a6298b99e309a7ce9ada0b

SHA512
867b389141ac40e0cfd23099ab2ff301186a80a9814b6628014232ba75be0d6ce5ed18e116ed5e64b8a1c0f13b22ad33d1cf3d2d5c0dfc83cc5f16009186e95e

Download Submit
C:\Users\Admin\Documents\RequestConvertTo.mpp
Filesize
748KB

MD5
78b736caa53fc9e5e57d966b0fb7e6c1

SHA1
a8baafb34e673f47efd62461e34addfa1da7bf57

SHA256
e29ac60eb7b415d7da84ac83dae3d306565641d2d6135ae05fd1bdac755848ac

SHA512
02a8e472b894db08124f48192942a06fe9be1d3948ef3283e9076bcabab5bd4bd91a47305d9c6987baa8922c93e8b603231a072e66505b5b99651ae37f15a2d3

Download Submit
C:\Users\Admin\Documents\SearchConvertTo.odt
Filesize
924KB

MD5
19d4e1a51b280891b30943b348ed1858

SHA1
bfce97483340080a67642bc2f1b821bfd0feaca7

SHA256
40a87a209b750d224964d4f6c2a2b527d74210a9df5d56c5a9645da2b4357271

SHA512
e7a0fce0c5c01cf87d335c80fd4d5ecb02f0e20caf5321a1654dfed34ba881e8c652a1ecd7d072df7e9651f295e998e33f8b590128c2e7aace57bbfc4c8855c7

Download Submit
C:\Users\Admin\Documents\These.docx
Filesize
11KB

MD5
87cbab2a743fb7e0625cc332c9aac537

SHA1
50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

SHA256
57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

SHA512
6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

Download Submit
C:\Users\Admin\Downloads\BackupPop.AAC
Filesize
450KB

MD5
8f8df093a767557593e7307d14c2e94b

SHA1
8e8efa9cf80b7294edbd9fcdce57cb865360ac0e

SHA256
c5dfd8d66bbb8183e1cd5be53ef0af6a7bf20a9587ea46662b63c130c4ff2871

SHA512
6c770813c019f3701715236e9cb2331e94a8555a45e2a98da6976d64397bd921bf140f15766ed2b2b8842e2a72c07c28b32dbd4556137c0b651949d6f4453a4e

Download Submit
C:\Users\Admin\Downloads\CloseEdit.pub
Filesize
220KB

MD5
8be591e6848f922f2004a50e0cce4537

SHA1
98b43d48fba43614f2b7d4ae48d803e68c78b9a4

SHA256
b41fc0afbe822c8db224ea5fba5d7f0738c82f13f554606ca51032e607f9b5d9

SHA512
8b4532e33c2762c94f90287a4acc5da5f25ba26452a46355ee7adb832181630f13c30ef988121afe2dcb35ef328f934c1e5f2e8617a60939b5b61c3303779d53

Download Submit
C:\Users\Admin\Downloads\ConnectPush.ppsm
Filesize
270KB

MD5
265d921015df935133209ccf267b9ddd

SHA1
52bd7ae67cc27ae17e0079ce4a275901ade87093

SHA256
7f6a65625f6645b3cdc816c68c1ab93d4c28dfbf404e762a80e36ba25aa361b4

SHA512
31e1db8e254556d6473c33bc401e23872e9df36f472c65d9b49c34ed4f3d056f71730fc30eff39f48cd30e9bf6d060dabf0febfcdf4a29c76de8cd4045cf5808

Download Submit
C:\Users\Admin\Downloads\ConvertRename.pot
Filesize
240KB

MD5
299015113eda4e3780862062c775851b

SHA1
5604bdd0fd826793e0d2d5eef01ba79205842386

SHA256
bba86a0a11372d699a7995d9ed38e4c6b6b168e1f0fa73c6edaf18ca5d28f239

SHA512
9f51fe2dfbcf8571dca938dc39aaf488290aa9477c43cb442b9105ff002113ced474dd9e64caa45ed13ffc87442bda13e8540872c9de329758410a1d65196985

Download Submit
C:\Users\Admin\Downloads\ConvertToDismount.bmp
Filesize
290KB

MD5
a978970bb1049b5b074c2e8d48311666

SHA1
04a869ee4eda4b03dea17fb8061e5d680b3417c1

SHA256
8dad3a08e83582038a29b4d2a3ed8b51945baeae9c20690d67d3e9b13c110e6e

SHA512
91e7a895b0fce68988735086ab7cf4c575e09bee0973aa08237c584c8e6dbfb385a8d28771cc3c0580e1f9033dc2b14783638ca1fb14856d5f8ff499fc0c8824

Download Submit
C:\Users\Admin\Downloads\DisableAdd.asp
Filesize
310KB

MD5
9af8b8de2c053581b8077ef624653e34

SHA1
590ab270a0cb97f2ff399289ff4ea920caf7339d

SHA256
a2340898b0ffa044968a08f505233c61646cbd96865c1554a26a021c389352fe

SHA512
43f096d2a43eff43a05b578e1c27439aaceb3f0c525c03569212e1bf65635e317dc7e154b401bb34d79e2c7a614c14fa981104cf200ec0bf04c9ef9fe4094832

Download Submit
C:\Users\Admin\Downloads\ExportUnlock.xlsb
Filesize
400KB

MD5
511f71062d31b0c368786b66e8e06196

SHA1
2df282b5ed6ec0688f3f6b02765b99c776799575

SHA256
f527e26cb2ecf2311b32e5ebb5a9594a60023de5ebf984c0e80d73063dc7288f

SHA512
47e30aab8b94ffafbcc854d898529cb2f00ce31923de0fb39f051e6039c8043413f7c7f4aa4377dc3c5f37878448502fb3e74d9048fb55263c1f820587252cc2

Download Submit
C:\Users\Admin\Downloads\FindInstall.mpg
Filesize
420KB

MD5
8daf9fecb7611a88848eb9c06fef6379

SHA1
9be84dc9d059de1a484e742890e8f0c58fe75759

SHA256
d04103cbd07175b18f4596e24c75d0f91a5685f672ae5d613f082a15e67d0eea

SHA512
953563204f6a15075a1bc2eef8c00f3ffe9770a539b1d015c01bdc8e536cab9d2e282ac3f17d3976b04f6b7f86fe7e13bff07d0b23d678ae5c49decc455ab81c

Download Submit
C:\Users\Admin\Downloads\FindUpdate.ppt
Filesize
250KB

MD5
1c7ee4e960e66cf16d34a6fc8689fb46

SHA1
ece7eb471cba9f1029db145da6da19748b01b258

SHA256
753a1bd1549118a5d15fc41066a541e5a49b8b77539ef23c222e943a43a67448

SHA512
7e0cea70d34c6e786fcfe326427521b0dfaacd49d16cd1c997bee290bc590f7e5363873dc3b6f5b2c09da676e9a8762119e1392de53882f25b32b6ff02bdd6fa

Download Submit
C:\Users\Admin\Downloads\FormatUnregister.7z
Filesize
260KB

MD5
c3cd03aa76f0a72523935be59ba4e0e3

SHA1
54c25caac16d1bad9207d09e08f91da902b46195

SHA256
55cebcf5bfacf391a6ed142ab90a1abc3610de0d4be9a84be0cd105866283203

SHA512
48388544143da8df8ca674d43deb9f1b220ddab63cf410456d5074b1a1ad3453bfae54bb8c32516eb16c9359a6862a8b17dfc9d73e5b131609d8b161130b54b6

Download Submit
C:\Users\Admin\Downloads\GrantResume.sql
Filesize
280KB

MD5
3ce9459bbc883ef52e75cd09a6f45ea8

SHA1
25e5f64fb6f200509ea5290ec1843b5b9e621a51

SHA256
e05819da3a660c739dff9863774ba47ddfd09cdd593fa2cf128c5ba3c910a5bd

SHA512
30c62a63ba3ea4d5442e750700b11e53de3d72527ee65fd11d205adaa7ffdd5dae15177d9ab4a7e07014cc5f54739383378b235e0ebea220e9488187a5398ae9

Download Submit
C:\Users\Admin\Downloads\InvokeUnpublish.001
Filesize
180KB

MD5
90a8562c7ab14c09637060bf93d39a59

SHA1
ed607aabcbb1255d4e5f4a8d75a981cef48f735c

SHA256
3d52d7588db85b550a3b9ec30e386c82ee6fa8616c975805d0593ea893bc866d

SHA512
f837c4ead0a7aed929949a8f50c52a23d8feb67f7dc0f050160ec6385271ca69e7452b056388059257e168f517d6e01fa92eb68ba28ef78ca904a73e2480d666

Download Submit
C:\Users\Admin\Downloads\MountStop.emf
Filesize
440KB

MD5
cc2e7e6899266f7c9c41ba95e675fc77

SHA1
32957a0e706b938f307e97f6d2456f420e12c886

SHA256
98c7149ea9c8a9b7d4894fa728d2ef2096dff9d0484322a79493862c838d0d90

SHA512
d1ff83d78e225418b4dc55ccad45f8614f5f8e2e4266b0f84ff88f0fbb61581ed3df0a7b6e0f675c50c3d814b4a37e443728809d2e858158f3e7e3bf3a58e387

Download Submit
C:\Users\Admin\Downloads\OpenCheckpoint.dll
Filesize
190KB

MD5
faac9fce6464e43d3a3b069fcdc59342

SHA1
5a2f673ae85fe68d37413f1165d2fcfc72c5876c

SHA256
a424fb0ce98a34981dd80de5e6f99e7065a5b82c407bd5cae9a2b4e41bdeaeb8

SHA512
373b301d3c86fe302687040ed6736a3525f9f42ed8cb315ba7211dca3f753ac54cc0d0219bcf7f86a5628632baec9ee8c1fb607f43dd62ade8f39152eb0b2865

Download Submit
C:\Users\Admin\Downloads\OptimizePing.kix
Filesize
300KB

MD5
770c7defcb8daddf6e26e631c68e7599

SHA1
eaf72af94a2fb89e62b43d7afee11b9009d4ea93

SHA256
6dc9ca0311b8c2a02a689b5da3f56e30a61de712f8088ea294801d6ffe904012

SHA512
6eed3e945e98bc1adad2bc06dd1dd9608dedcf3033c94910806eb3cc14f50315c9044eefb3c8d7a04ecbf629e01c0cbb68add76c023d27f4d77e2a0010049a5e

Download Submit
C:\Users\Admin\Downloads\PingComplete.bin
Filesize
430KB

MD5
4a5e21fe6ddf7efd82af5732f93d72e6

SHA1
7d7054aa5077ec695ad7df6a924ae5efac758b19

SHA256
02a369430df9f89db5be48b06f3c5911d1cca1a8ba7ff0f6857fd807e055d8f4

SHA512
d7816733e655f7127a15edb1fc02dd544eb8a50637d6bcaf5e42597a164248720b19bc6e5066049dbc51d5aa094a6ecd4b7317553712f60d7e28e82beb1a2d67

Download Submit
C:\Users\Admin\Downloads\ReadCheckpoint.wma
Filesize
330KB

MD5
b108c2f7b90df4503ee5a23b656cafee

SHA1
e87bf74263c079c9eed7040edccfd02f4f8d8e06

SHA256
dc0450aea52f3137f7cf8e1846442177d86b76537f2bd79efbc79755082cd301

SHA512
36d6ed14c1969685a2f7728872ba9554bf4a3976ff10d8f79ab360ff6c6cd71e40c47930518e5d01cc3f645da8907e0e00333f532dea2de35c0ad20b0989a0cf

Download Submit
C:\Users\Admin\Downloads\ReceiveGrant.mpg
Filesize
210KB

MD5
a9132aad65fdbc6702676a6aa91d7816

SHA1
3cb5178707b68d2313546a7897565933f664c3ca

SHA256
60463611601d2e7e887f8c8b51e4f341c0d4c5765fcd9b77d60d72981a36b6f5

SHA512
ec3f5ef6dc29f888f8ee511bfb91fddd5af4450f97a348066e3e32b95802c9814a232a032ce2b7a345ec090412358a2e90ec17c5fbb460b17adb06665ef619a2

Download Submit
C:\Users\Admin\Downloads\RedoClose.m4v
Filesize
630KB

MD5
8631c5f7edc4a88d9c48566e8e798480

SHA1
b532613d3aa074daa590d07cdc0f23accc3119f0

SHA256
9be952e0cd20f1c8f2fb677b9f49de75ce86e62e1b9a9c3bbf869d617bb1f698

SHA512
fc8b2bde963896fdaa2502b9b52c9fdf4362a786e2f493140d3c06bc5da4000febfc0e8ac93f3f2ca776921587fe1e216945dd46962b16e2ee4fad16c2738e9e

Download Submit
C:\Users\Admin\Downloads\RedoMerge.xsl
Filesize
410KB

MD5
b938ee2f37f32ff523b28e629dafc63a

SHA1
814bdae56ecac854b1a082f522dd06cac4b9f3f7

SHA256
85d8c668fd6ed89a15e9af78b210ecbd2e594ee3b81ab3b996ddac17508f058b

SHA512
f1c851814308ef94ad649696c90aa0064b3bf7d1143847da5fe3af4b3a4e25f1264b25b508671e6f7af99eb1f49b6a327dfd5ffad3cee8717c553fc7af629eb4

Download Submit
C:\Users\Admin\Downloads\RemoveGet.jpe
Filesize
380KB

MD5
f22bd33a1dd9ae24fb2ebd8b57abb65e

SHA1
2b48f975182eeb21a7392a564827f0304deeb290

SHA256
d89f7247242cdea81225ca220fe1eced29172fd230c7965bcf3c5d8a070ba389

SHA512
a2b7ed20b7eaf4d95d2f27685cc58d57f33daca83c0576fd84b26595233f72e43ca768ee8ed34bdf14539ed92cd88b387787c3384e711c2c5f85d976bd79ef4f

Download Submit
C:\Users\Admin\Downloads\ResizeDismount.ini
Filesize
360KB

MD5
e509c0c835fe5e1dd2af1e6b3a9b87d3

SHA1
f63ad1666e7f1e05777832f54bbaf60f375b43aa

SHA256
ec9885b9965176aaadafa688f952ba6f4e7bd6518c6a2ae202b6bd06df985e90

SHA512
8662e31bd5934ed36a639d34e7a86c4ccd668ae22e2d6b5c98c523b39f9089160fe42b2e39e5edf47ed08a1ea12b2ace824c3a0e59ed8b769755a8079f9d4242

Download Submit
C:\Users\Admin\Downloads\SplitCompare.jpg
Filesize
370KB

MD5
b12298e96da3780ffec0841ec586fa1d

SHA1
0ea5f09763186b362c607f2bb676a288013ce8be

SHA256
443a862324855ef4a0d917bafda2c8862b343e2bc6255bbc2741d71da9a7f9e6

SHA512
424d9f092e377b747197328109b224964b5a8a48c898070d91c95156a2ce504cfa04e032fc8671b3fa2dd2a7d40ff97b0bfb5e8a046aa9673461c4f19b37c208

Download Submit
C:\Users\Admin\Downloads\SplitWrite.rtf
Filesize
320KB

MD5
8443fe4eb6db7818ffa56d622771819e

SHA1
0160fad62e2f8f905706b5123a6d01d49fc236b7

SHA256
037d6f016bcdce767a7cd1de465495a72bb284530131547e15fd857422985b9b

SHA512
9615aa1f98ad04e9a0bfa15bb7313b0724a2035f53a40299c2c2a1789ba37e689000ac7341d413221082f6bb6eb9b691787754b96f07855c6d9053b82f7de78d

Download Submit
C:\Users\Admin\Downloads\StartResume.ADTS
Filesize
460KB

MD5
fc586a300f56bfd151e1084458a45ae3

SHA1
4bff19c62cf1b466b1525976f4d7d5133cd5dfaa

SHA256
55564a955cb0e3f1ffd1119fe10f8418f0c1b887ed4f6b6847ef3c6b3cbfb964

SHA512
16417cdbb5ef6245dd331940f128df6cd79d5a0888c27ace01f8e325accd3c074ef8807ae0413f7b407becfe6e340e70bbe65750eb7708d1b1653492c2b7946f

Download Submit
C:\Users\Admin\Downloads\StepWait.odt
Filesize
200KB

MD5
77eb43733d50acd3e2f743733e91b811

SHA1
a27e1353b3e8dcc4a0904e857551ea04aaab2e2c

SHA256
48a955e7b1f469b0a27bac8ab7b6a89a4202cfe1af8da1e337c638c503c73841

SHA512
d0c67e2f7cfd194a04c9921c49dab96155cbadf9ed5a3d778c8c7d495f9046a47d4ea4f0fb72329a44f373ea83431829592f9d99b76a048b6b75b20d80dae15a

Download Submit
C:\Users\Admin\Downloads\StopPublish.xltm
Filesize
390KB

MD5
26f080b7332c4657c011013a9231bbd4

SHA1
4ad73c18a9a961781c3aca7060c4dc3e1e279bff

SHA256
7ac8c75bee1100c60cd599daee49b95c11998342b9c1c928ce97b9ee03bde695

SHA512
d8b3ed6ab071b84a1ba0e6e9408a78f9f3b5fab7b5141f55b596913cc5bf222305bb30c584775c3d410081b84d5732736e1ee9c04bf9a31684a4f478a5288d02

Download Submit
C:\Users\Admin\Downloads\SubmitConvertTo.gif
Filesize
350KB

MD5
779762903f262ccef7b3918da9d02511

SHA1
1e12bc657e70492acb52053a4a61f2d27844f7fe

SHA256
58628f0c723612b34f9c4072ee6179cf541e9056f9a4e501308e5fe188a1fa76

SHA512
c24f5bf45fc41d654f8dcff33cb5fdf25b3bf00ca3f853e966f88135b7d68404b88fe4f50fec5ac23d319c855eb17596200c845cc503ddd7fca2e80a4aa8fc27

Download Submit
C:\Users\Admin\Downloads\SwitchSend.mhtml
Filesize
340KB

MD5
4e2c9b5d33666404e6404a0f0e6ca738

SHA1
d9729ef655188aff26907f7e4a1d8ddb8c0a5662

SHA256
227c7e870c2fa15f6474a4af71c526aeaeb5165946d5648f62c7ade23db66e2d

SHA512
4c10dcb41631682121628ad118bfe9774f2962c79505107cf65c518a86c21862493bbec8e7176093133d02d31512d6a7d73e608feb8b12c77cfa70734151938e

Download Submit
C:\Users\Admin\Downloads\TraceExpand.ttc
Filesize
230KB

MD5
a2a76553ea9a660e928f8960ac8a9654

SHA1
65f91b7a294128e289191ff94bc08427554c32c7

SHA256
b75509ede50a87407d43701ddf5e32146e6018fba7ee449252fe0a16bcd2b2cf

SHA512
079e16bae3c10aca71a06254f4b98b8c0d64b3aa46350a8afc42eb46556a9426dc1c3d655653337d765802f14f795e304499ee2a650577d6a3bd8da87207e142

Download Submit
C:\Users\Admin\Downloads\UnblockUndo.jpeg
Filesize
170KB

MD5
8edb3ea0042561b00ed887ee2bebf634

SHA1
dee06204e1479dd0bfe3344319e485e67f5b962b

SHA256
ec3493bf0ae4a8d4816ace750c7079ce032c00660a01aba0b0ba9c8644aaf7bc

SHA512
a67519bbaf70bfedbdc44388728948086eaa9f724104162ed65623f6eca8ee8c47bc0ed2748e62fac888ac07cb81c6f92c94d73429e201ccd33558faf488b14d

Download Submit
C:\Users\Admin\Downloads\UpdateCompress.DVR
Filesize
160KB

MD5
6d82a3fe5e2377e5b4a4d7cdc9a46db5

SHA1
bca6e696c20b8ea13653c9a4670b35d92ac1f162

SHA256
6261189ded568a79a085f7b73de580f6aee6a94982919d36329b314681880fb8

SHA512
8843da6bb4552a1674ff1674a3c46309bfd645603b5045e8ee6b42548517e185044407c923b14bba2b1eedd084d7a5b8138602fdcd904ae0d284e52edc3b5d5b

Download Submit