Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2023, 11:13

General

  • Target

    zbyl.exe

  • Size

    1.7MB

  • MD5

    4f24c94182a964c6706c1920a73822c0

  • SHA1

    5fd5f215270c5f7ff7828d8e1fe7e784094ae2f0

  • SHA256

    45afb3a562e84e75c19fe08404921b2c05900a6037f04d5aa61eca9ea7254ef3

  • SHA512

    d1f7d8b5b6f1f3464a2946b861bc7c919623ad3fddeb7899d546fae93f6d864fd614a88b043c46d990942eaf59076a72702ad17dca26b178c8312c75219ce1fd

  • SSDEEP

    49152:zsRpndZn496l3tGPHbbe2q6d5axY5zGbpSFUxTJ:zsRfZn4gVKeOwozwRv

Malware Config

Extracted

Family

vidar

Version

3.6

Botnet

9bd43ccedb1e82a38795147b462c1fe9

C2

https://steamcommunity.com/profiles/76561199499188534

https://t.me/nutalse

Attributes
  • profile_id_v2

    9bd43ccedb1e82a38795147b462c1fe9

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\zbyl.exe
    "C:\Users\Admin\AppData\Local\Temp\zbyl.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4220
    • C:\Users\Admin\AppData\Local\Temp\SETUP_43862\Engine.exe
      C:\Users\Admin\AppData\Local\Temp\SETUP_43862\Engine.exe /TH_ID=_4172 /OriginExe="C:\Users\Admin\AppData\Local\Temp\zbyl.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4544
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c cmd < Yugoslavia
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1504
        • C:\Windows\SysWOW64\cmd.exe
          cmd
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1856
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell get-process avastui
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1820
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell get-process avgui
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4912
          • C:\Windows\SysWOW64\findstr.exe
            findstr /V /R "^TiesHighsFridayPromisedOrganismsPromotedStronglyBannersTermExplainOrganisedPhpLastingMaritime$" Finding
            5⤵
              PID:3584
            • C:\Users\Admin\AppData\Local\Temp\smzntdjf.xp4\27194\Bondage.exe.pif
              27194\\Bondage.exe.pif 27194\\M
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:4728
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks.exe /create /tn "dZVxEGlqbg" /tr "C:\Users\Admin\AppData\Roaming\claRXiEwVe\dZVxEGlqbg.exe.com C:\Users\Admin\AppData\Roaming\claRXiEwVe\H" /sc onlogon /F /RL HIGHEST
                6⤵
                • Creates scheduled task(s)
                PID:4968
              • C:\Users\Admin\AppData\Local\Temp\smzntdjf.xp4\27194\Bondage.exe.pif
                C:\Users\Admin\AppData\Local\Temp\smzntdjf.xp4\27194\Bondage.exe.pif
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1964
                • C:\ProgramData\64120359114169402129.exe
                  "C:\ProgramData\64120359114169402129.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4680
                • C:\ProgramData\94855117677656117160.exe
                  "C:\ProgramData\94855117677656117160.exe"
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:3516
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:Temp -ExclusionProcess *.exe -ExclusionExtension exe; Set-MpPreference -SubmitSamplesConsent NeverSend -PUAProtection Disabled
                    8⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3272
                  • C:\Users\Admin\AppData\Local\Temp\744d665f-7dd9-4313-9c4f-468645f1bece.exe
                    "C:\Users\Admin\AppData\Local\Temp\744d665f-7dd9-4313-9c4f-468645f1bece.exe"
                    8⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:232
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup dfslkdjfklhjsrhfgauiehruifghai
                      9⤵
                        PID:1292
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c cmd < 5
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2660
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd
                          10⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3660
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell get-process avastui
                            11⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3684
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell get-process avgui
                            11⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4956
                          • C:\Windows\SysWOW64\findstr.exe
                            findstr /V /R "^syXbtyYOvRrtwlrwBarUhdXsBSlrxLhdlLzfzDGmXzfNBcLMWdWSExswiFWkUVxLDNTfQOHXMDWTqlQyibutOcMQzsiOHxFeZEpNCvVoIYu$" 8
                            11⤵
                              PID:4108
                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\27527\Prague.exe.pif
                              27527\\Prague.exe.pif 27527\\m
                              11⤵
                              • Executes dropped EXE
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of SetWindowsHookEx
                              PID:796
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks.exe /create /tn "Fireplace" /tr "C:\Users\Admin\AppData\Roaming\Norfolk\Fireplace.exe.com C:\Users\Admin\AppData\Roaming\Norfolk\S" /sc onlogon /F /RL HIGHEST
                                12⤵
                                • Creates scheduled task(s)
                                PID:5104
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks.exe /create /tn "Jacksonville" /tr "C:\Users\Admin\AppData\Roaming\Norfolk\Fireplace.exe.com C:\Users\Admin\AppData\Roaming\Norfolk\S" /sc minute /mo 3 /F /RL HIGHEST
                                12⤵
                                • Creates scheduled task(s)
                                PID:2156
                      • C:\Users\Admin\AppData\Local\Temp\npp.8.4.7.Installer.x64.exe
                        "C:\Users\Admin\AppData\Local\Temp\npp.8.4.7.Installer.x64.exe"
                        8⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetWindowsHookEx
                        PID:3228
                    • C:\ProgramData\14811349209848313838.exe
                      "C:\ProgramData\14811349209848313838.exe"
                      7⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4320
                      • C:\Users\Admin\AppData\Roaming\asdfasdlkfjsdkfasdfnkjlsadnfsadf\zeron.exe
                        "C:\Users\Admin\AppData\Roaming\asdfasdlkfjsdkfasdfnkjlsadnfsadf\zeron.exe"
                        8⤵
                          PID:1412
                      • C:\ProgramData\87315974260293922403.exe
                        "C:\ProgramData\87315974260293922403.exe"
                        7⤵
                        • Executes dropped EXE
                        PID:1756
                  • C:\Windows\SysWOW64\PING.EXE
                    ping localhost -n 18
                    5⤵
                    • Runs ping.exe
                    PID:4360
          • C:\Windows\system32\OpenWith.exe
            C:\Windows\system32\OpenWith.exe -Embedding
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:3812
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
            1⤵
            • Drops desktop.ini file(s)
            • Checks processor information in registry
            • Modifies registry class
            PID:100
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
            1⤵
            • Checks processor information in registry
            • Modifies registry class
            PID:1336

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\14811349209848313838.exe

            Filesize

            33KB

            MD5

            7641caecd5021135bd5c03b4471715ff

            SHA1

            06ab473f6fcbd2af2fdc092ad464555ec4d209bb

            SHA256

            e53c407f87c47411d9b1d64c8ce8230705881c04514a30e8995c93853b7c4d16

            SHA512

            9a1eff8bb8ba7b42eda29446151c91065f10af19f231fb72525485fa0350f7ec39ad319e3e74671ceb6906307741c7097c14d4035322dffa3b7501218f0f3773

          • C:\ProgramData\14811349209848313838.exe

            Filesize

            33KB

            MD5

            7641caecd5021135bd5c03b4471715ff

            SHA1

            06ab473f6fcbd2af2fdc092ad464555ec4d209bb

            SHA256

            e53c407f87c47411d9b1d64c8ce8230705881c04514a30e8995c93853b7c4d16

            SHA512

            9a1eff8bb8ba7b42eda29446151c91065f10af19f231fb72525485fa0350f7ec39ad319e3e74671ceb6906307741c7097c14d4035322dffa3b7501218f0f3773

          • C:\ProgramData\14811349209848313838.exe

            Filesize

            33KB

            MD5

            7641caecd5021135bd5c03b4471715ff

            SHA1

            06ab473f6fcbd2af2fdc092ad464555ec4d209bb

            SHA256

            e53c407f87c47411d9b1d64c8ce8230705881c04514a30e8995c93853b7c4d16

            SHA512

            9a1eff8bb8ba7b42eda29446151c91065f10af19f231fb72525485fa0350f7ec39ad319e3e74671ceb6906307741c7097c14d4035322dffa3b7501218f0f3773

          • C:\ProgramData\43406283598433163183.exe

            Filesize

            18B

            MD5

            2dfc600946fa3c1a82b6ff6d18c342c3

            SHA1

            e307bb6552e857858d0ce4fc1299ab1e3fd1f0d5

            SHA256

            ad718123430d2b7e7eee71a7e96c2357373d1d2d44c66479deb3db26b9fb3944

            SHA512

            8553a052bbf53f8f669f6853b0f28d79f944f7d391b330b388f3f262bf12f01c5af2e57a37c63bc2361454bde1ba3ab84d8d2234d5101f762333548cd946a068

          • C:\ProgramData\64120359114169402129.exe

            Filesize

            9.7MB

            MD5

            1d9b67333e6b7513f6f1e5e37454993c

            SHA1

            afeeaf1b86e4b37528254aedc77d94db9d9dbfde

            SHA256

            21fd7af0b3046612bab9ca512bcafbe94643839137f46bb62f92efc2f6355d3c

            SHA512

            a08bf5ee1809f038c135c5e86e5aa5e006eb912f5fe8b7c49ba357fd70249dc559ab7e601d81cc32183329b8c6c1834af833db2aa308ca4dec2fa153ec498846

          • C:\ProgramData\64120359114169402129.exe

            Filesize

            9.7MB

            MD5

            1d9b67333e6b7513f6f1e5e37454993c

            SHA1

            afeeaf1b86e4b37528254aedc77d94db9d9dbfde

            SHA256

            21fd7af0b3046612bab9ca512bcafbe94643839137f46bb62f92efc2f6355d3c

            SHA512

            a08bf5ee1809f038c135c5e86e5aa5e006eb912f5fe8b7c49ba357fd70249dc559ab7e601d81cc32183329b8c6c1834af833db2aa308ca4dec2fa153ec498846

          • C:\ProgramData\64120359114169402129.exe

            Filesize

            9.7MB

            MD5

            1d9b67333e6b7513f6f1e5e37454993c

            SHA1

            afeeaf1b86e4b37528254aedc77d94db9d9dbfde

            SHA256

            21fd7af0b3046612bab9ca512bcafbe94643839137f46bb62f92efc2f6355d3c

            SHA512

            a08bf5ee1809f038c135c5e86e5aa5e006eb912f5fe8b7c49ba357fd70249dc559ab7e601d81cc32183329b8c6c1834af833db2aa308ca4dec2fa153ec498846

          • C:\ProgramData\87315974260293922403.exe

            Filesize

            5.8MB

            MD5

            67a388ee3e6e89fde50f780ecc5ca1fc

            SHA1

            c892ade7b8cdbbb573e88915c098809fb6a90325

            SHA256

            b7d4d61542c742b77631b7aef97c9fd6805ecb579c8bae8850097d7b51402544

            SHA512

            9b7f5054b4c2a25ffbb687c5e3ab41884bf6348ba06e0bb50be8bfa6a6413799a588539db761b32cde832c4c38eed22814c4fd1c5cb93d31826bbf23b6b74cb7

          • C:\ProgramData\87315974260293922403.exe

            Filesize

            5.8MB

            MD5

            67a388ee3e6e89fde50f780ecc5ca1fc

            SHA1

            c892ade7b8cdbbb573e88915c098809fb6a90325

            SHA256

            b7d4d61542c742b77631b7aef97c9fd6805ecb579c8bae8850097d7b51402544

            SHA512

            9b7f5054b4c2a25ffbb687c5e3ab41884bf6348ba06e0bb50be8bfa6a6413799a588539db761b32cde832c4c38eed22814c4fd1c5cb93d31826bbf23b6b74cb7

          • C:\ProgramData\87315974260293922403.exe

            Filesize

            5.8MB

            MD5

            67a388ee3e6e89fde50f780ecc5ca1fc

            SHA1

            c892ade7b8cdbbb573e88915c098809fb6a90325

            SHA256

            b7d4d61542c742b77631b7aef97c9fd6805ecb579c8bae8850097d7b51402544

            SHA512

            9b7f5054b4c2a25ffbb687c5e3ab41884bf6348ba06e0bb50be8bfa6a6413799a588539db761b32cde832c4c38eed22814c4fd1c5cb93d31826bbf23b6b74cb7

          • C:\ProgramData\94855117677656117160.exe

            Filesize

            9.4MB

            MD5

            718d69c7e8baa9b2fea5078ac9adf6b7

            SHA1

            b409fa7ffde8cc8dbaff27ae6a51d3f599e0ed75

            SHA256

            21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936

            SHA512

            ece9d1dac93453594fee0df92f8ad9ffa14ba17d4589773eac2c6f5ae1759d4b22e1067813245d2d5ab613d2b7c45173e5aebd1e72c7a720082474b76d403515

          • C:\ProgramData\94855117677656117160.exe

            Filesize

            9.4MB

            MD5

            718d69c7e8baa9b2fea5078ac9adf6b7

            SHA1

            b409fa7ffde8cc8dbaff27ae6a51d3f599e0ed75

            SHA256

            21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936

            SHA512

            ece9d1dac93453594fee0df92f8ad9ffa14ba17d4589773eac2c6f5ae1759d4b22e1067813245d2d5ab613d2b7c45173e5aebd1e72c7a720082474b76d403515

          • C:\ProgramData\94855117677656117160.exe

            Filesize

            9.4MB

            MD5

            718d69c7e8baa9b2fea5078ac9adf6b7

            SHA1

            b409fa7ffde8cc8dbaff27ae6a51d3f599e0ed75

            SHA256

            21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936

            SHA512

            ece9d1dac93453594fee0df92f8ad9ffa14ba17d4589773eac2c6f5ae1759d4b22e1067813245d2d5ab613d2b7c45173e5aebd1e72c7a720082474b76d403515

          • C:\ProgramData\mozglue.dll

            Filesize

            593KB

            MD5

            c8fd9be83bc728cc04beffafc2907fe9

            SHA1

            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

            SHA256

            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

            SHA512

            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

          • C:\ProgramData\nss3.dll

            Filesize

            2.0MB

            MD5

            1cc453cdf74f31e4d913ff9c10acdde2

            SHA1

            6e85eae544d6e965f15fa5c39700fa7202f3aafe

            SHA256

            ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

            SHA512

            dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            1KB

            MD5

            def65711d78669d7f8e69313be4acf2e

            SHA1

            6522ebf1de09eeb981e270bd95114bc69a49cda6

            SHA256

            aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

            SHA512

            05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

            Filesize

            53KB

            MD5

            124edf3ad57549a6e475f3bc4e6cfe51

            SHA1

            80f5187eeebb4a304e9caa0ce66fcd78c113d634

            SHA256

            638c51e173ca6b3469494a7e2e0b656021a761f77b4a83f3e430e82e7b9af675

            SHA512

            b6c1a9051feeffad54ba1092fd799d34a9578368d7e66b31780fe478c1def0eb4094dce2879003f7389f2f9d86b94a3ef3975e78092a604597841c9b8db120ee

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            18KB

            MD5

            1a498a884f6883d62760418eaf5172c1

            SHA1

            8e0f5333da983f67b6fbb3a9c75d898378c546b4

            SHA256

            ce7633fa4224a1e8127b7faa32a1298f0f3ec2741ec020c8e267b783a78bb5c2

            SHA512

            e63b51dae0efeee3d7f1a8c4c2a8b8e76ed33262d41f60155e3a0e68b972cc2200dfefb314b0d4b206482455aa074932c555ac476441614a26de16ec1dddf520

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            18KB

            MD5

            f5749f3f57321484e7a986ad2f799a6f

            SHA1

            1ed152c2c310dd978d1f4bde90ee1f4be7dcf4cd

            SHA256

            f7d00dab1e24f9208cf5a31bb9c8e2b4fe5a3e03fe68ddb48411183a1f8bb78e

            SHA512

            41f7af16a68021f71b2ebc9487f634896956eea4e255d6a2529343341621f0420142cbd567b7a979468faa7f6f4a9f3a5e2fe3b41f47a443b334b56be12f01df

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            18KB

            MD5

            255cb393b07b87b8f0b2c4d8fcbd81fc

            SHA1

            a2fa22adc5ae6169dc30a05035ea9879808c0d23

            SHA256

            bfc8a68f99e59aebfc82ab89606391ae7e0337d452fc305a49ad3b17d84ad538

            SHA512

            ac41de751e303e75d15e6315c92d726a67c75c83ca0cc3a228f990374d7d8ea6a64015a0e67dba1778e71a3df3bf33ac4697a4987f00a0e632e28820b78165e1

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            17KB

            MD5

            e4a074e482b4f1d77385f88e95d89bda

            SHA1

            cfbd18690a090595681d649cef30aa36c2c36d7b

            SHA256

            3ac25949f2898929eb828e0fee4c0b25a63085e03474a34c132a05c6ff0cdf17

            SHA512

            ce7a70e9baae7acbae27da48ed0091200af1c5dd69101992605bd0fccf3f26b288c6d34aff108c30073ba191841000669aed0e2f1ca9b9e0dacedc74136e9d94

          • C:\Users\Admin\AppData\Local\Temp\744d665f-7dd9-4313-9c4f-468645f1bece.exe

            Filesize

            1.8MB

            MD5

            ac9cdaa7e93365384a7af4c7deb940ef

            SHA1

            4458ab569efb896eebad6a0c11fd2b4bd2ea3c2d

            SHA256

            30cb69aad54794a964298c87be266406a84f7ff77492db61c9f477f0dae09e28

            SHA512

            eb14329d29e0a6527af1b22ee01470ae54b28aabce64cc96e44ce3a7fde075c63bf117cbd356519d374ea000d0a150eb8ab888067c5d028e67ca31e83f3b8223

          • C:\Users\Admin\AppData\Local\Temp\744d665f-7dd9-4313-9c4f-468645f1bece.exe

            Filesize

            1.8MB

            MD5

            ac9cdaa7e93365384a7af4c7deb940ef

            SHA1

            4458ab569efb896eebad6a0c11fd2b4bd2ea3c2d

            SHA256

            30cb69aad54794a964298c87be266406a84f7ff77492db61c9f477f0dae09e28

            SHA512

            eb14329d29e0a6527af1b22ee01470ae54b28aabce64cc96e44ce3a7fde075c63bf117cbd356519d374ea000d0a150eb8ab888067c5d028e67ca31e83f3b8223

          • C:\Users\Admin\AppData\Local\Temp\744d665f-7dd9-4313-9c4f-468645f1bece.exe

            Filesize

            1.8MB

            MD5

            ac9cdaa7e93365384a7af4c7deb940ef

            SHA1

            4458ab569efb896eebad6a0c11fd2b4bd2ea3c2d

            SHA256

            30cb69aad54794a964298c87be266406a84f7ff77492db61c9f477f0dae09e28

            SHA512

            eb14329d29e0a6527af1b22ee01470ae54b28aabce64cc96e44ce3a7fde075c63bf117cbd356519d374ea000d0a150eb8ab888067c5d028e67ca31e83f3b8223

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\0

            Filesize

            151KB

            MD5

            23545f48e8ae77155be81244d74fe69e

            SHA1

            22719b9794c4c5b01d6b5b31d3e6561deb39ed6d

            SHA256

            bd8f80f6b9acaea50a3002c2e7315740d70b9c873ba1cddf1c34067006433d7b

            SHA512

            fb2fc1cd94344ab67d0d2273086a6379e707e8abdc4dde6187e16754b5195bf68d491b51e33635dbb9813c2c20e70e6a7da97988055ec19e129148470ae432ff

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1

            Filesize

            151KB

            MD5

            36fa66114493e59c04653697c6f38abc

            SHA1

            65a6d72762ff8adfa1e6020e2a098ec8a70250b8

            SHA256

            5b353dbd696ce298d2e791616ad9b06ceaa010c517b14cf6b2555b53c601f0dd

            SHA512

            1b2bf92dd713cd65f927a212ecb527d89881076253fff98013f3ff8e60657d00fa8d5559434bfeefcfaead0fd364cfec7a3a9f316a0ded51b0fe2e094f92f143

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\27527\Prague.exe.pif

            Filesize

            872KB

            MD5

            c56b5f0201a3b3de53e561fe76912bfd

            SHA1

            2a4062e10a5de813f5688221dbeb3f3ff33eb417

            SHA256

            237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

            SHA512

            195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\27527\Prague.exe.pif

            Filesize

            872KB

            MD5

            c56b5f0201a3b3de53e561fe76912bfd

            SHA1

            2a4062e10a5de813f5688221dbeb3f3ff33eb417

            SHA256

            237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

            SHA512

            195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\302

            Filesize

            151KB

            MD5

            9a8335a43abefdd0b6e75ce535a21782

            SHA1

            c3c9aa388661c384239674f4b1f97c19fc79c913

            SHA256

            37241dd3147d3796005500266518abe93aa092d05659d8f6ddee9a54b7229b4d

            SHA512

            decf8586cb2a1787d0fe4fd54206a5851877186c4485daea770c715ef1bcaa867ab4287e37fb3df742b5125b2715eb61aedbffffd040a89399077122f0fab2af

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4

            Filesize

            117KB

            MD5

            f0782ac337551f4dd9df4ff54cce98fe

            SHA1

            86b474d1635fe602f1dfb1e74be467dd27f0057c

            SHA256

            21d5a8460a4c77454f814cc2570833ee048d9bd6f8c68255a6e995c2933497b5

            SHA512

            24d2e3e59c92662612a267b1e599451f164f86c18004d44d3f9d267984f4724937030a601c959eaf597220df50b31a589058365f23fca8952d433d611ae40b6b

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5

            Filesize

            12KB

            MD5

            05bb413f5ba120b0c746740c17c97fa2

            SHA1

            61716e2c9f375bfb9da6c36222890717eef4293e

            SHA256

            11cafc97516f7451af19bb5aa550003c28416580928b7f9abe430d743a1ed610

            SHA512

            133ca8be7349bac492476cc7cd9acbb6acde49cab191f07c6d7243e60ff0aac1ee81873d373075998765080068a149530ecc885610db25c6ba122f9e6e504518

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\579

            Filesize

            151KB

            MD5

            649156f7abaf3e9a68fe4e2ce7b89c88

            SHA1

            c42eee8461801838d755c9772b9e604ed0127c78

            SHA256

            554d466d050b7ffbe1054e114de44f32cff5491f4a99d2c5c183a8afdd4b9eb4

            SHA512

            01c5703ec2c7cda38fe7af27b18499e56aab79d8b23e5d4e6c8d282de77ec4a3956ca6c952a55d8b3a37de94ac9516f1eb52f277839c41d5e87406a1d326317c

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\8

            Filesize

            872KB

            MD5

            b8623efc8999d64001f3ba4f2b420404

            SHA1

            129425304bbff2d1a90368533ebc5d126878787a

            SHA256

            a8e48e1c2bf2f8bbec2fc50a37d4061db593ea64b8903adf6a75d14723f716d7

            SHA512

            2f4e810f26f626dcd01a762fdb9c78f29c968fde83d52ccc00535cca6dd18524a7d81c1b7c41990f2e762aa24fad177570e7d02de9b5d5555013e497bdf51f4c

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\87

            Filesize

            2.4MB

            MD5

            114939047a705fb6883619bb711a153d

            SHA1

            272b74bc5a623548c43d6f99a5cc604e357e1ddb

            SHA256

            74083a23c3f2ff9449c03fa54bbc867c79a9fbabf396c7de98e1e825ce738778

            SHA512

            322474fa19b33fba118d3467c9b5de26a2f3a13b2b7188a623739d2517c408e60d7d58a9f387e4b93690dc167c7a8c757ef3b5a420d04f60a3dfa3c26f4c2b7f

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\915

            Filesize

            151KB

            MD5

            925fa8a8ec5a53087efa3bad11f6b231

            SHA1

            326b6df67b8aa2eaab3962377e21e981f0354cb8

            SHA256

            bf84249469716a25537d7d4fff05cc175ae58548d419189aee2152b95ced7c24

            SHA512

            3af38c673944a71b4ba045f1164b007d155a7d6ee74939b6f320fba2a64064afaa8cb6fb2a2b7c667e18b62dd7d1797674858ac88c2bc68c1f6324145562cf88

          • C:\Users\Admin\AppData\Local\Temp\SETUP_43862\00000#Cancer

            Filesize

            101KB

            MD5

            d4c65e691f5a42538b02417f60c042be

            SHA1

            7726b2bd52dc94a9d3e79f2e82e92dd8820997ad

            SHA256

            d71b5a80bc3d6fce71c6fc6efb62542bd5536d7d3805d92067a29f512bd12c33

            SHA512

            e487f30b27b178a09d381802767f7425d63e6538bc9b0d5406ea39cf7f7c2c586d53850e460b897a49014b61e75ffbe817b4a93b9460a18ed89d223048dab62f

          • C:\Users\Admin\AppData\Local\Temp\SETUP_43862\00001#Foto

            Filesize

            199KB

            MD5

            60ad6b661b7d878936b63c39e7d94555

            SHA1

            655ca3b2c75ad015a02470c92e8d7b9d58541524

            SHA256

            650f797d33d5ecf29e1876324de2507a3b97cad3cc00c1e25ff02420a2e4e70e

            SHA512

            f44b3d36f26666c079354085471d44b2838c24553fd0797e12c3c96b14794aa24073574379e1e0abce3b38aaaa179dd1bf05c51ca3831aff82c90fe6699cc606

          • C:\Users\Admin\AppData\Local\Temp\SETUP_43862\00002#Gp

            Filesize

            74KB

            MD5

            4f39ba8b1c907e52d53215ea79a1896f

            SHA1

            975c70c4973697cce66c149a00cc8b20e79526be

            SHA256

            ace9abce7314ca6736b6b6acf5a1f96c7d24f7764678f99ffb795a897a6e7bf2

            SHA512

            e862921fbad7a8118a1c12f1c9ca33b7f41251b69b0dc48dcbf3c40350174f5db8946c75797b0042e3d9633821b66e523212a1998a901f712bc8b0053d1e7572

          • C:\Users\Admin\AppData\Local\Temp\SETUP_43862\00003#Management

            Filesize

            154KB

            MD5

            b0525ab549845919679f78453f554c1f

            SHA1

            3d2179acba0634cc71003502923c3a4a52b31d14

            SHA256

            31c86eb615672da32e64560553d46cb18c25e7ea794e4637cfac3c4be0a9fb47

            SHA512

            b983c3517cf878e99ad94d0227c25edb52e82c5ead93c7cbfa6ea2543d483db20be2f210029237131e8e5517497e910abcdb119edf88cdb7eac9e61c4f2a3087

          • C:\Users\Admin\AppData\Local\Temp\SETUP_43862\00004#Piece

            Filesize

            43KB

            MD5

            bf7a0cdf40d3aa9fc94c9accd73298d2

            SHA1

            a049a7323a8468d1bbd3e96a1ace4266fce4429c

            SHA256

            96eab71166cc7df7ec1eae988487d76d463c080f1da98b194bc60a1701e5d3ae

            SHA512

            6a0eb5de2f23ff986c90835b7b24e5299fdb882186bcc88fece6a6a4363871dda00b8313ee729557778cf4c14456e9c25d79108be35f31df1d9b697f5d89009e

          • C:\Users\Admin\AppData\Local\Temp\SETUP_43862\00005#Prototype

            Filesize

            33KB

            MD5

            ad1b6b16c6c6c23f01288183183ed0c1

            SHA1

            b60363ebd25d9953f202423b34e0c81fa24dafb6

            SHA256

            94fca15d4913ccc5955aef8942cb475306a6815190fe27ff742b40a808ff860e

            SHA512

            d461bf0dd5b20b1cb5dc07128be156b3ab144607c5794956635ca7ce90a2d643d539b2f6dd063c8889e01e074db74cacd41940a3d3bb53cd2406f77f0ccac6ce

          • C:\Users\Admin\AppData\Local\Temp\SETUP_43862\00006#Stands

            Filesize

            1.2MB

            MD5

            4a1f67fc0cacc5cf1c9ab1ab05e25ec6

            SHA1

            e955600ae7c0f6bec15a4126f1be10acc6a6b875

            SHA256

            ed299bf8533de2b3f0965295aa5be53e8486dfa0887e20de0b4c6c2fd3b30b4b

            SHA512

            e0f1a52209c13937afcdb954e59daba04d80f82cba702788e1d6d359f2e4dd189d01455f32a167b6014c68e5d670686d2ace1bfea0b8c31b3c91f2f052669675

          • C:\Users\Admin\AppData\Local\Temp\SETUP_43862\00007#Sue

            Filesize

            157KB

            MD5

            f51e203d3f2ac1e4f6ed5a89f5805fcb

            SHA1

            76195a680f2e178c03d35719a0adc776fe901289

            SHA256

            c6a7beb722fefad0a7f6f2057cbfda9a8cec198e56f2946191aeb9de7578b2ca

            SHA512

            8c2ab71bf608066d3a63cdac2924d8a6d6c983e8257aed07691f5dace70442de5e72ba0f3bfe8b6395314178ddde219ca5005e65aed305165a06cae2dba16bec

          • C:\Users\Admin\AppData\Local\Temp\SETUP_43862\00008#Welfare

            Filesize

            54KB

            MD5

            f5802553964d59c3874a7ea7f0313c68

            SHA1

            106f605a2e7704cb8341b27ca982f5f70d09bc0f

            SHA256

            35cc1497dc397cf46815bfb41953a134170bbea3fd0d5178ca45b6bbb01084f9

            SHA512

            8f495fc3ceda40788b3dc7a2eec223e3d40b5edf1ff4ed159f20a256f1ba71d8baba135b3b1bf9f6f07851dc99bd4e29fd2af1bc7984bccca4fc390c0fc83b23

          • C:\Users\Admin\AppData\Local\Temp\SETUP_43862\00009#Wines

            Filesize

            110KB

            MD5

            31ae6922272bfd6c6a863b679940d005

            SHA1

            df93b1021c3bb2087b249a82d4cbcd599659fcd6

            SHA256

            77031c9bf9a778abef4672a2b749dd7fb662a29b3e69ea391fe04dd4944601d8

            SHA512

            f0765279accdefbf611088e92433d258700bc97d28468b6cbd34c1be5b7cf27a54763009214bd4ce052c4bec87debd9464e2f040028fba40fb32da20d82669bd

          • C:\Users\Admin\AppData\Local\Temp\SETUP_43862\00010#Yugoslavia

            Filesize

            15KB

            MD5

            9852c7adb40127bf8e29ae2346482129

            SHA1

            d5decd97f329dc62f824a17b204a214a83a1292b

            SHA256

            85ad2b1fd775ecd859922d5550f76f87f8e8e9dd84d878ee786450a8aefee1ac

            SHA512

            0a89fa89340df63de408b106ac4503a649ac2bf60978f40452263b8690d81cedf9d812e4b71988a84e6fdb36fdd8dfc0ec30a78d1df2f0cb044b7afa3accc56b

          • C:\Users\Admin\AppData\Local\Temp\SETUP_43862\Engine.exe

            Filesize

            1.3MB

            MD5

            e4656c54b03a03f816ab33101a324cdc

            SHA1

            48cd8d9c5a20d36362214d727e184fe4e0075d4f

            SHA256

            bb998a1e5e162c305a942ade944230c62b0e3bfe347a2a30c33af497109467ba

            SHA512

            c2980491ab8417feddb609391e14b8f662182f2ca28af47902b74687ac420d8fb2aee4ea9df858668a7affa03c799b2a478213d5629444e9276147096110f7ba

          • C:\Users\Admin\AppData\Local\Temp\SETUP_43862\Engine.exe

            Filesize

            1.3MB

            MD5

            e4656c54b03a03f816ab33101a324cdc

            SHA1

            48cd8d9c5a20d36362214d727e184fe4e0075d4f

            SHA256

            bb998a1e5e162c305a942ade944230c62b0e3bfe347a2a30c33af497109467ba

            SHA512

            c2980491ab8417feddb609391e14b8f662182f2ca28af47902b74687ac420d8fb2aee4ea9df858668a7affa03c799b2a478213d5629444e9276147096110f7ba

          • C:\Users\Admin\AppData\Local\Temp\SETUP_43862\Modern_Icon.bmp

            Filesize

            7KB

            MD5

            1dd88f67f029710d5c5858a6293a93f1

            SHA1

            3e5ef66613415fe9467b2a24ccc27d8f997e7df6

            SHA256

            b5dad33ceb6eb1ac2a05fbda76e29a73038403939218a88367925c3a20c05532

            SHA512

            7071fd64038e0058c8c586c63c62677c0ca403768100f90323cf9c0bc7b7fcb538391e6f3606bd7970b8769445606ada47adcdcfc1e991e25caf272a13e10c94

          • C:\Users\Admin\AppData\Local\Temp\SETUP_43862\Setup.txt

            Filesize

            2KB

            MD5

            9f82e028a899fe0dded45d76ed1ed06f

            SHA1

            fc0e0f3e34451087e28d8c51c486a52934e59d4a

            SHA256

            3dd4285197d7ad7004789eee6464594666ae8e5d913bec23e57151608bd3b109

            SHA512

            22d4ad271965c8c5fbe038ead00cb374c299e89f7d669ea7657064e5b3c18f4dc7f9d51b102dc388c6f79e805c7196c085edf6e990e6bb33c41ac36854192b18

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oqtskdg5.hes.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\npp.8.4.7.Installer.x64.exe

            Filesize

            4.4MB

            MD5

            feaa91429fb314271bb2cd3db61bcb8a

            SHA1

            50758c9bea853caceddaf49dfbed82db8a72d994

            SHA256

            515d2c71ece7c4c7432794b9e1bb6fcf60fdaa2e499744c09af113c65d6dbb68

            SHA512

            fa0a891be025fc207a02018d82d85360f4653c10b414bcc7f175550d992bfefe39dbdbe23b1a848720ee595ae2745e9b9fb171ad2da1eef526ae3ada0fff3ef8

          • C:\Users\Admin\AppData\Local\Temp\npp.8.4.7.Installer.x64.exe

            Filesize

            4.4MB

            MD5

            feaa91429fb314271bb2cd3db61bcb8a

            SHA1

            50758c9bea853caceddaf49dfbed82db8a72d994

            SHA256

            515d2c71ece7c4c7432794b9e1bb6fcf60fdaa2e499744c09af113c65d6dbb68

            SHA512

            fa0a891be025fc207a02018d82d85360f4653c10b414bcc7f175550d992bfefe39dbdbe23b1a848720ee595ae2745e9b9fb171ad2da1eef526ae3ada0fff3ef8

          • C:\Users\Admin\AppData\Local\Temp\npp.8.4.7.Installer.x64.exe

            Filesize

            4.4MB

            MD5

            feaa91429fb314271bb2cd3db61bcb8a

            SHA1

            50758c9bea853caceddaf49dfbed82db8a72d994

            SHA256

            515d2c71ece7c4c7432794b9e1bb6fcf60fdaa2e499744c09af113c65d6dbb68

            SHA512

            fa0a891be025fc207a02018d82d85360f4653c10b414bcc7f175550d992bfefe39dbdbe23b1a848720ee595ae2745e9b9fb171ad2da1eef526ae3ada0fff3ef8

          • C:\Users\Admin\AppData\Local\Temp\nsxB071.tmp\InstallOptions.dll

            Filesize

            15KB

            MD5

            ece25721125d55aa26cdfe019c871476

            SHA1

            b87685ae482553823bf95e73e790de48dc0c11ba

            SHA256

            c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

            SHA512

            4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

          • C:\Users\Admin\AppData\Local\Temp\nsxB071.tmp\InstallOptions.dll

            Filesize

            15KB

            MD5

            ece25721125d55aa26cdfe019c871476

            SHA1

            b87685ae482553823bf95e73e790de48dc0c11ba

            SHA256

            c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

            SHA512

            4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

          • C:\Users\Admin\AppData\Local\Temp\nsxB071.tmp\InstallOptions.dll

            Filesize

            15KB

            MD5

            ece25721125d55aa26cdfe019c871476

            SHA1

            b87685ae482553823bf95e73e790de48dc0c11ba

            SHA256

            c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

            SHA512

            4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

          • C:\Users\Admin\AppData\Local\Temp\nsxB071.tmp\LangDLL.dll

            Filesize

            5KB

            MD5

            68b287f4067ba013e34a1339afdb1ea8

            SHA1

            45ad585b3cc8e5a6af7b68f5d8269c97992130b3

            SHA256

            18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

            SHA512

            06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

          • C:\Users\Admin\AppData\Local\Temp\nsxB071.tmp\System.dll

            Filesize

            12KB

            MD5

            cff85c549d536f651d4fb8387f1976f2

            SHA1

            d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

            SHA256

            8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

            SHA512

            531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

          • C:\Users\Admin\AppData\Local\Temp\nsxB071.tmp\ioSpecial.ini

            Filesize

            1KB

            MD5

            77ad272b0eca340933d9a40f280fa0ed

            SHA1

            f0db1f6149ba02282d6a43103ee877c4ce499e88

            SHA256

            ef9dbf3bf62aa12806d4cb5f056ec643b3e09eee70eb456857e8e28d0f664b1c

            SHA512

            8b84edf16c6b53921393afb0790e49e885caccf91c1ac10ab16f228b1524f29ea4c56717b8b0efe128de57d0ca3e9844ae695abb749fcff7817547ba82fbcead

          • C:\Users\Admin\AppData\Local\Temp\smzntdjf.xp4\27194\Bondage.exe.pif

            Filesize

            925KB

            MD5

            0162a97ed477353bc35776a7addffd5c

            SHA1

            10db8fe20bbce0f10517c510ec73532cf6feb227

            SHA256

            15600ccdef5a64b40d206d89234a51be1e11bd878dcefc5986590bcf40d9d571

            SHA512

            9638cab1aabe78c22a3d3528a391544f697d792640d831516b63fa52c393ee96bb588223e70163d059208cc5a14481c5ff7ef6ba9ac572322798a823d67f01f5

          • C:\Users\Admin\AppData\Local\Temp\smzntdjf.xp4\27194\Bondage.exe.pif

            Filesize

            925KB

            MD5

            0162a97ed477353bc35776a7addffd5c

            SHA1

            10db8fe20bbce0f10517c510ec73532cf6feb227

            SHA256

            15600ccdef5a64b40d206d89234a51be1e11bd878dcefc5986590bcf40d9d571

            SHA512

            9638cab1aabe78c22a3d3528a391544f697d792640d831516b63fa52c393ee96bb588223e70163d059208cc5a14481c5ff7ef6ba9ac572322798a823d67f01f5

          • C:\Users\Admin\AppData\Local\Temp\smzntdjf.xp4\27194\Bondage.exe.pif

            Filesize

            925KB

            MD5

            0162a97ed477353bc35776a7addffd5c

            SHA1

            10db8fe20bbce0f10517c510ec73532cf6feb227

            SHA256

            15600ccdef5a64b40d206d89234a51be1e11bd878dcefc5986590bcf40d9d571

            SHA512

            9638cab1aabe78c22a3d3528a391544f697d792640d831516b63fa52c393ee96bb588223e70163d059208cc5a14481c5ff7ef6ba9ac572322798a823d67f01f5

          • C:\Users\Admin\AppData\Local\Temp\smzntdjf.xp4\Finding

            Filesize

            925KB

            MD5

            f39dff6e12fa4e21277d39149fa7da7e

            SHA1

            804aa8256d1a98311d737e13ef62db0fa7d15ec0

            SHA256

            27deb687c50fe4c33b19f43ccb0d4cbdaa8292511df2a93c138d6740862e9fd0

            SHA512

            cceca80987fcfad926734a7c2ed16919a237ceb02f391fe9de667405f014498b10bcf735547e5ee53f9b146ed56b24db025be285422c53dac2770f1885d31f5c

          • C:\Users\Admin\AppData\Roaming\asdfasdlkfjsdkfasdfnkjlsadnfsadf\zeron.exe

            Filesize

            6.5MB

            MD5

            9b42dbaae4de910f6521d1a786111eb0

            SHA1

            f5a25ec1bcc8e12696c269bb386b745b9c8f5a04

            SHA256

            cecdfd08f19bbdb0aa344c13b34a05e152f58bae8feb84d695879dd89f90b282

            SHA512

            05afa173e5a34084d279d9d64d609a40c5e601a6f3c96366efc212a56a8100ce9346192a7f28685297ffe7fdfdf2079f3339b425c9fa274512cd3cfd03b6217a

          • C:\Users\Admin\AppData\Roaming\asdfasdlkfjsdkfasdfnkjlsadnfsadf\zeron.exe

            Filesize

            640KB

            MD5

            ed6277772d782ebfecf4561dfd06c599

            SHA1

            dbef65e4b363d07157f48cd5a87ce4e0b65aaff8

            SHA256

            ba0ad294cac8f8543319202a1895fa6f2cca011db33bd61ce33a2f89b70c1c85

            SHA512

            b7028be6498084902280e454d2fb4a5f93a8c6c68ef1f8c04c544112366bc0d38f7c10176cadc53766b91d7cc38f3a835cfa9f9c91cace7c8b4056c8f6d64331

          • C:\Users\Admin\Videos\Captures\desktop.ini

            Filesize

            190B

            MD5

            b0d27eaec71f1cd73b015f5ceeb15f9d

            SHA1

            62264f8b5c2f5034a1e4143df6e8c787165fbc2f

            SHA256

            86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

            SHA512

            7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

          • memory/1820-181-0x0000000004E50000-0x0000000005478000-memory.dmp

            Filesize

            6.2MB

          • memory/1820-198-0x00000000062D0000-0x0000000006366000-memory.dmp

            Filesize

            600KB

          • memory/1820-184-0x0000000004810000-0x0000000004820000-memory.dmp

            Filesize

            64KB

          • memory/1820-201-0x0000000007510000-0x0000000007AB4000-memory.dmp

            Filesize

            5.6MB

          • memory/1820-180-0x00000000047B0000-0x00000000047E6000-memory.dmp

            Filesize

            216KB

          • memory/1820-185-0x0000000004D90000-0x0000000004DB2000-memory.dmp

            Filesize

            136KB

          • memory/1820-187-0x00000000056E0000-0x0000000005746000-memory.dmp

            Filesize

            408KB

          • memory/1820-200-0x00000000062A0000-0x00000000062C2000-memory.dmp

            Filesize

            136KB

          • memory/1820-186-0x0000000005570000-0x00000000055D6000-memory.dmp

            Filesize

            408KB

          • memory/1820-197-0x0000000005D70000-0x0000000005D8E000-memory.dmp

            Filesize

            120KB

          • memory/1820-183-0x0000000004810000-0x0000000004820000-memory.dmp

            Filesize

            64KB

          • memory/1820-199-0x0000000006250000-0x000000000626A000-memory.dmp

            Filesize

            104KB

          • memory/1964-317-0x0000000000CE0000-0x0000000000D52000-memory.dmp

            Filesize

            456KB

          • memory/1964-236-0x0000000000CE0000-0x0000000000D52000-memory.dmp

            Filesize

            456KB

          • memory/1964-249-0x0000000061E00000-0x0000000061EF3000-memory.dmp

            Filesize

            972KB

          • memory/1964-239-0x0000000000CE0000-0x0000000000D52000-memory.dmp

            Filesize

            456KB

          • memory/3272-471-0x0000000007DB0000-0x0000000007DBE000-memory.dmp

            Filesize

            56KB

          • memory/3272-472-0x0000000007E00000-0x0000000007E1A000-memory.dmp

            Filesize

            104KB

          • memory/3272-470-0x0000000007BF0000-0x0000000007BFA000-memory.dmp

            Filesize

            40KB

          • memory/3272-469-0x00000000081D0000-0x000000000884A000-memory.dmp

            Filesize

            6.5MB

          • memory/3272-468-0x000000007F580000-0x000000007F590000-memory.dmp

            Filesize

            64KB

          • memory/3272-467-0x00000000079C0000-0x00000000079DE000-memory.dmp

            Filesize

            120KB

          • memory/3272-457-0x000000006F0D0000-0x000000006F11C000-memory.dmp

            Filesize

            304KB

          • memory/3272-456-0x00000000079E0000-0x0000000007A12000-memory.dmp

            Filesize

            200KB

          • memory/3272-455-0x00000000054E0000-0x00000000054F0000-memory.dmp

            Filesize

            64KB

          • memory/3272-453-0x00000000054E0000-0x00000000054F0000-memory.dmp

            Filesize

            64KB

          • memory/3272-454-0x00000000054E0000-0x00000000054F0000-memory.dmp

            Filesize

            64KB

          • memory/3272-475-0x0000000007DF0000-0x0000000007DF8000-memory.dmp

            Filesize

            32KB

          • memory/3272-572-0x00000000054E0000-0x00000000054F0000-memory.dmp

            Filesize

            64KB

          • memory/3272-573-0x00000000054E0000-0x00000000054F0000-memory.dmp

            Filesize

            64KB

          • memory/3272-575-0x000000007F580000-0x000000007F590000-memory.dmp

            Filesize

            64KB

          • memory/3272-574-0x00000000054E0000-0x00000000054F0000-memory.dmp

            Filesize

            64KB

          • memory/3516-376-0x0000000000920000-0x0000000001289000-memory.dmp

            Filesize

            9.4MB

          • memory/3516-853-0x0000000000920000-0x0000000001289000-memory.dmp

            Filesize

            9.4MB

          • memory/3516-524-0x0000000000920000-0x0000000001289000-memory.dmp

            Filesize

            9.4MB

          • memory/3684-661-0x00000000022D0000-0x00000000022E0000-memory.dmp

            Filesize

            64KB

          • memory/3684-662-0x00000000022D0000-0x00000000022E0000-memory.dmp

            Filesize

            64KB

          • memory/4220-182-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

          • memory/4220-235-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

          • memory/4320-740-0x00000208138B0000-0x00000208138C2000-memory.dmp

            Filesize

            72KB

          • memory/4320-378-0x0000020811F70000-0x0000020811F7A000-memory.dmp

            Filesize

            40KB

          • memory/4320-375-0x0000020811AC0000-0x0000020811ACE000-memory.dmp

            Filesize

            56KB

          • memory/4320-379-0x0000020811F80000-0x0000020811F90000-memory.dmp

            Filesize

            64KB

          • memory/4320-526-0x0000020811F80000-0x0000020811F90000-memory.dmp

            Filesize

            64KB

          • memory/4320-766-0x000002082C200000-0x000002082C222000-memory.dmp

            Filesize

            136KB

          • memory/4544-224-0x0000000000400000-0x0000000000550000-memory.dmp

            Filesize

            1.3MB

          • memory/4544-154-0x0000000000A00000-0x0000000000A01000-memory.dmp

            Filesize

            4KB

          • memory/4544-232-0x0000000000400000-0x0000000000550000-memory.dmp

            Filesize

            1.3MB

          • memory/4680-411-0x0000000000290000-0x000000000029A000-memory.dmp

            Filesize

            40KB

          • memory/4680-416-0x0000000003370000-0x000000000342D000-memory.dmp

            Filesize

            756KB

          • memory/4680-443-0x0000000024670000-0x00000000246A4000-memory.dmp

            Filesize

            208KB

          • memory/4680-521-0x0000000022D80000-0x0000000022D90000-memory.dmp

            Filesize

            64KB

          • memory/4680-522-0x0000000022D80000-0x0000000022D90000-memory.dmp

            Filesize

            64KB

          • memory/4680-523-0x0000000022D80000-0x0000000022D90000-memory.dmp

            Filesize

            64KB

          • memory/4680-434-0x0000000022B20000-0x0000000022BCD000-memory.dmp

            Filesize

            692KB

          • memory/4680-432-0x0000000023CD0000-0x0000000024460000-memory.dmp

            Filesize

            7.6MB

          • memory/4680-431-0x0000000023590000-0x0000000023CCF000-memory.dmp

            Filesize

            7.2MB

          • memory/4680-430-0x00000000050C0000-0x00000000050D9000-memory.dmp

            Filesize

            100KB

          • memory/4680-429-0x000000001FC90000-0x000000001FCBC000-memory.dmp

            Filesize

            176KB

          • memory/4680-428-0x000000001FD80000-0x000000001FECE000-memory.dmp

            Filesize

            1.3MB

          • memory/4680-427-0x000000001FBF0000-0x000000001FC8E000-memory.dmp

            Filesize

            632KB

          • memory/4680-426-0x00000000050F0000-0x0000000005173000-memory.dmp

            Filesize

            524KB

          • memory/4680-425-0x000000001F890000-0x000000001FBE5000-memory.dmp

            Filesize

            3.3MB

          • memory/4680-424-0x000000001F760000-0x000000001F88A000-memory.dmp

            Filesize

            1.2MB

          • memory/4680-422-0x0000000003950000-0x0000000003980000-memory.dmp

            Filesize

            192KB

          • memory/4680-423-0x00000000050A0000-0x00000000050A8000-memory.dmp

            Filesize

            32KB

          • memory/4680-420-0x00000000035A0000-0x000000000363D000-memory.dmp

            Filesize

            628KB

          • memory/4680-421-0x0000000003640000-0x0000000003740000-memory.dmp

            Filesize

            1024KB

          • memory/4680-419-0x0000000003490000-0x000000000359B000-memory.dmp

            Filesize

            1.0MB

          • memory/4680-340-0x0000000000A60000-0x000000000141E000-memory.dmp

            Filesize

            9.7MB

          • memory/4680-351-0x0000000022D80000-0x0000000022D90000-memory.dmp

            Filesize

            64KB

          • memory/4680-442-0x00000000244A0000-0x00000000244B8000-memory.dmp

            Filesize

            96KB

          • memory/4680-418-0x0000000003460000-0x000000000348B000-memory.dmp

            Filesize

            172KB

          • memory/4680-417-0x0000000003430000-0x0000000003452000-memory.dmp

            Filesize

            136KB

          • memory/4680-415-0x00000000022C0000-0x00000000022D6000-memory.dmp

            Filesize

            88KB

          • memory/4680-414-0x00000000031C0000-0x0000000003361000-memory.dmp

            Filesize

            1.6MB

          • memory/4680-412-0x00000000026F0000-0x00000000031B1000-memory.dmp

            Filesize

            10.8MB

          • memory/4680-409-0x0000000000A00000-0x0000000000A55000-memory.dmp

            Filesize

            340KB

          • memory/4680-410-0x00000000003C0000-0x00000000003D2000-memory.dmp

            Filesize

            72KB

          • memory/4680-408-0x00000000021F0000-0x000000000229A000-memory.dmp

            Filesize

            680KB

          • memory/4680-407-0x00000000020C0000-0x00000000021EA000-memory.dmp

            Filesize

            1.2MB

          • memory/4680-406-0x0000000002020000-0x00000000020BB000-memory.dmp

            Filesize

            620KB

          • memory/4680-405-0x0000000001B80000-0x0000000001C1E000-memory.dmp

            Filesize

            632KB

          • memory/4680-404-0x0000000001A50000-0x0000000001AFC000-memory.dmp

            Filesize

            688KB

          • memory/4680-401-0x00000000019C0000-0x0000000001A50000-memory.dmp

            Filesize

            576KB

          • memory/4680-399-0x0000000001620000-0x00000000018E9000-memory.dmp

            Filesize

            2.8MB

          • memory/4680-393-0x0000000001560000-0x000000000161E000-memory.dmp

            Filesize

            760KB

          • memory/4680-385-0x00000000002F0000-0x0000000000355000-memory.dmp

            Filesize

            404KB

          • memory/4680-353-0x0000000022D80000-0x0000000022D90000-memory.dmp

            Filesize

            64KB

          • memory/4680-352-0x0000000022D80000-0x0000000022D90000-memory.dmp

            Filesize

            64KB

          • memory/4728-230-0x0000000000E50000-0x0000000000E51000-memory.dmp

            Filesize

            4KB

          • memory/4912-216-0x0000000004640000-0x0000000004650000-memory.dmp

            Filesize

            64KB

          • memory/4912-215-0x0000000004640000-0x0000000004650000-memory.dmp

            Filesize

            64KB

          • memory/4956-676-0x0000000002450000-0x0000000002460000-memory.dmp

            Filesize

            64KB

          • memory/4956-675-0x0000000002450000-0x0000000002460000-memory.dmp

            Filesize

            64KB