Overview

overview

10

Static

static

10

virus/Froz...ED.exe

windows10-ltsc 2021-x64

10

virus/Wire...64.exe

windows10-ltsc 2021-x64

9

$PLUGINSDI...ns.dll

windows10-ltsc 2021-x64

3

$PLUGINSDI...em.dll

windows10-ltsc 2021-x64

3

Qt6Gui.dll

windows10-ltsc 2021-x64

1

Qt6Network.dll

windows10-ltsc 2021-x64

1

Qt6Svg.dll

windows10-ltsc 2021-x64

1

USBPcapSet....0.exe

windows10-ltsc 2021-x64

8

WinSparkle.dll

windows10-ltsc 2021-x64

1

Wireshark.exe

windows10-ltsc 2021-x64

3

brotlicommon.dll

windows10-ltsc 2021-x64

1

bz2.dll

windows10-ltsc 2021-x64

1

charset-1.dll

windows10-ltsc 2021-x64

1

comerr64.dll

windows10-ltsc 2021-x64

1

d3dcompiler_47.dll

windows10-ltsc 2021-x64

1

snappy.dll

windows10-ltsc 2021-x64

1

snmp/mibs/...IB.vbs

windows10-ltsc 2021-x64

1

snmp/mibs/...IB.vbs

windows10-ltsc 2021-x64

1

snmp/mibs/...IB.vbs

windows10-ltsc 2021-x64

1

snmp/mibs/...IB.vbs

windows10-ltsc 2021-x64

1

styles/qwi...le.dll

windows10-ltsc 2021-x64

1

tls/qcerto...nd.dll

windows10-ltsc 2021-x64

1

tls/qopens...nd.dll

windows10-ltsc 2021-x64

1

tls/qschan...nd.dll

windows10-ltsc 2021-x64

1

tshark.exe

windows10-ltsc 2021-x64

1

tshark.html

windows10-ltsc 2021-x64

4

vc_redist.x64.exe

windows10-ltsc 2021-x64

7

wireshark-filter.html

windows10-ltsc 2021-x64

4

wireshark.html

windows10-ltsc 2021-x64

4

zlib-ng2.dll

windows10-ltsc 2021-x64

1

zlib1.dll

windows10-ltsc 2021-x64

1

zstd.dll

windows10-ltsc 2021-x64

1

Analysis

  • max time kernel
    350s
  • max time network
    354s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    11-12-2024 15:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    virus/Wireshark-4.4.2-x64.exe

  • Size

    83.2MB

  • MD5

    5753792c3617a96786bf3df591ffafdf

  • SHA1

    20a4304ff7153e38f07121a76a59f442b369cd42

  • SHA256

    69a7f6e94e3744422efbb83528d42dd3ee19c12e253db040c33b75453152dce2

  • SHA512

    68d3504b7c561bd9909ecf593b88fb5faf44951a50dc18dc5926241a5502201ee3a5111a2ce018871bdb0cc24f25d7c8057faf5b98e005a067a057b35d2188b3

  • SSDEEP

    1572864:JEgr3yLzlPfF5kO8l0/z75q5V9STIO1xOi3QOExUmdeiS3Gl1dN2Ohge1n+pB:JJ3WQPC7g0LOHl/LnrdNpbOB

Score
9/10
discoveryevasionexecutionpersistence

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Drops file in Drivers directory 3 IoCs
  • Manipulates Digital Signatures 1 TTPs 8 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 43 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 35 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 59 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\virus\Wireshark-4.4.2-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\virus\Wireshark-4.4.2-x64.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3692
    • C:\Program Files\Wireshark\vc_redist.x64.exe
      "C:\Program Files\Wireshark\vc_redist.x64.exe" /install /quiet /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4560
      • C:\Windows\Temp\{F3FB4132-5560-4563-91F2-BE63D4709723}\.cr\vc_redist.x64.exe
        "C:\Windows\Temp\{F3FB4132-5560-4563-91F2-BE63D4709723}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\Wireshark\vc_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=692 /install /quiet /norestart
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1632
        • C:\Windows\Temp\{8918A7E6-B342-4D01-B41D-3D81C3D7368E}\.be\VC_redist.x64.exe
          "C:\Windows\Temp\{8918A7E6-B342-4D01-B41D-3D81C3D7368E}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{1139B49F-4C3D-46DB-AB67-C1D1C2210742} {7CCF75F8-A657-4ADD-948E-46BDE2982FBE} 1632
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3920
          • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=1020 -burn.embedded BurnPipe.{925D43F7-B619-498D-A743-CFAC1761D451} {5222425B-8149-412A-B1C8-6A9B6DDF0750} 3920
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4596
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=1020 -burn.embedded BurnPipe.{925D43F7-B619-498D-A743-CFAC1761D451} {5222425B-8149-412A-B1C8-6A9B6DDF0750} 3920
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1296
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{1D4A2DCB-CB9B-4F0F-8F04-F8982EF27B56} {B2B9DB57-1C48-47B3-A24B-F6A88DBF6E3F} 1296
                7⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:4644
    • C:\Program Files\Wireshark\npcap-1.79.exe
      "C:\Program Files\Wireshark\npcap-1.79.exe" /winpcap_mode=no /loopback_support=no
      2⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2712
      • C:\Users\Admin\AppData\Local\Temp\nseAE8E.tmp\NPFInstall.exe
        "C:\Users\Admin\AppData\Local\Temp\nseAE8E.tmp\NPFInstall.exe" -n -check_dll
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:892
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Get-ChildItem Cert:\LocalMachine\Root | Where-Object {$_.Thumbprint -eq '0563b8630d62d75abbc8ab1e4bdfb5a899b24d43'} | Sort-Object -Descending -Property FriendlyName | Select-Object -Skip 1 | Remove-Item"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:456
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "If (Get-ChildItem Cert:\LocalMachine\Root\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43){certutil.exe -verifystore 'Root' '0563b8630d62d75abbc8ab1e4bdfb5a899b24d43';If($LASTEXITCODE -ne 0){Remove-Item Cert:\LocalMachine\Root\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43}}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1204
        • C:\Windows\SysWOW64\certutil.exe
          "C:\Windows\system32\certutil.exe" -verifystore Root 0563b8630d62d75abbc8ab1e4bdfb5a899b24d43
          4⤵
          • Manipulates Digital Signatures
          • System Location Discovery: System Language Discovery
          PID:3848
      • C:\Windows\SysWOW64\certutil.exe
        certutil.exe -verifystore "Root" "0563b8630d62d75abbc8ab1e4bdfb5a899b24d43"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3008
      • C:\Windows\SysWOW64\certutil.exe
        certutil.exe -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nseAE8E.tmp\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43.sst"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2020
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Get-ChildItem Cert:\LocalMachine\Root | Where-Object {$_.Thumbprint -eq '5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25'} | Sort-Object -Descending -Property FriendlyName | Select-Object -Skip 1 | Remove-Item"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3248
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "If (Get-ChildItem Cert:\LocalMachine\Root\5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25){certutil.exe -verifystore 'Root' '5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25';If($LASTEXITCODE -ne 0){Remove-Item Cert:\LocalMachine\Root\5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25}}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4412
      • C:\Windows\SysWOW64\certutil.exe
        certutil.exe -verifystore "Root" "5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1164
      • C:\Windows\SysWOW64\certutil.exe
        certutil.exe -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nseAE8E.tmp\5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25.sst"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2836
      • C:\Windows\SysWOW64\certutil.exe
        certutil.exe -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nseAE8E.tmp\signing.p7b"
        3⤵
        • Manipulates Digital Signatures
        • System Location Discovery: System Language Discovery
        PID:4656
      • C:\Program Files\Npcap\NPFInstall.exe
        "C:\Program Files\Npcap\NPFInstall.exe" -n -c
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3888
        • C:\Windows\SYSTEM32\pnputil.exe
          pnputil.exe -e
          4⤵
            PID:4720
        • C:\Program Files\Npcap\NPFInstall.exe
          "C:\Program Files\Npcap\NPFInstall.exe" -n -iw
          3⤵
          • Executes dropped EXE
          PID:1132
        • C:\Program Files\Npcap\NPFInstall.exe
          "C:\Program Files\Npcap\NPFInstall.exe" -n -i
          3⤵
          • Drops file in Drivers directory
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:4092
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Microsoft.PowerShell.Management\Start-Service -Name npcap -PassThru | Microsoft.PowerShell.Management\Stop-Service -PassThru | Microsoft.PowerShell.Management\Start-Service"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:416
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "ScheduledTasks\Register-ScheduledTask -Force -TaskName 'npcapwatchdog' -Description 'Ensure Npcap service is configured to start at boot' -Action (ScheduledTasks\New-ScheduledTaskAction -Execute 'C:\Program Files\Npcap\CheckStatus.bat') -Principal (ScheduledTasks\New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount) -Trigger (ScheduledTasks\New-ScheduledTaskTrigger -AtStartup) -Settings (ScheduledTasks\New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Compatibility Win8)"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4272
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3400
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:4
      1⤵
        PID:776
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1032
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
        1⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of WriteProcessMemory
        PID:1828
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7f990359-e6cb-8a42-8bd5-cd602cd74f19}\NPCAP.inf" "9" "405306be3" "00000000000001CC" "WinSta0\Default" "00000000000001DC" "208" "C:\Program Files\Npcap"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:4344
      • C:\Program Files\Wireshark\Wireshark.exe
        "C:\Program Files\Wireshark\Wireshark.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        PID:3740
        • C:\Program Files\Wireshark\extcap\etwdump.exe
          "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-interfaces --extcap-version=4.4
          2⤵
          • Executes dropped EXE
          PID:3088
        • C:\Program Files\Wireshark\extcap\etwdump.exe
          "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-config --extcap-interface etwdump
          2⤵
          • Executes dropped EXE
          PID:4660
        • C:\Program Files\Wireshark\dumpcap.exe
          "C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE -S -D -L --signal-pipe 3740.dummy -Z 1904
          2⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:4424
        • C:\Program Files\Wireshark\extcap\etwdump.exe
          "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-dlts --extcap-interface etwdump
          2⤵
          • Executes dropped EXE
          PID:3192
        • C:\Program Files\Wireshark\dumpcap.exe
          "C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE -S --signal-pipe 3740.dummy -Z 2840
          2⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:1280
        • C:\Program Files\Wireshark\dumpcap.exe
          "C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE -F pcapng -i \Device\NPF_Loopback --ifdescr "Adapter for loopback traffic capture" --signal-pipe 3740 -Z 2836
          2⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:2108
        • C:\Program Files\Wireshark\dumpcap.exe
          "C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE -S --signal-pipe 3740.dummy -Z 2836
          2⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:1064
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        1⤵
          PID:1132
          • C:\Windows\system32\net.exe
            net start npcap
            2⤵
              PID:3360
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 start npcap
                3⤵
                  PID:4948

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Config.Msi\e5b9aea.rbs
              Filesize

              19KB

              MD5

              0631387a370569791b5093c7d71cae22

              SHA1

              112f2161b882477c1f47ddd9af7636ec79f4308b

              SHA256

              05ba7c0b9307598fe86369a9e8a77d20eb522734655cac841b3334cb09251fa4

              SHA512

              9d985aa25d296d408699c7c163d2ae12625736dbac4b44eea750f36d29d184aaa137eb8fbf4964204fa4cc62a583e57788864e2aec4c9b85e8802350a17e89c3

              Download Submit

            • C:\Config.Msi\e5b9af6.rbs
              Filesize

              19KB

              MD5

              a908386570a252d8b898bedf2e19e938

              SHA1

              bdf95b0b2db7dc5192d13a8eda3eda1c80c4305f

              SHA256

              a9a55a4eb1c6c52c4dbb325bf259b4817a4bf7c881920b464cb2fc48d37c6fff

              SHA512

              b59425ced38d8d718274e6cb27ec6da2be29e2e5a8cd79c72c46ab4a7e642b3c9f56e9ff1c3da65db77fefcfb8c055bdca68b119024dbbac6aa00e5d8182ebd8

              Download Submit

            • C:\Config.Msi\e5b9afd.rbs
              Filesize

              21KB

              MD5

              f0f6134a13ab1056cb337d20a9a355cf

              SHA1

              5c2581d7376a9c0a87672aaaa1ad955c6b49da4d

              SHA256

              f9f1364cfa3573dc2dd6c0f241429679b4112f0c14dd7ee4c13d4bd5621af14e

              SHA512

              ec654291729ecc8b891215241e489d26bcf0f2143481bf3da0f8e782074c546419f27f4ab225b6c5e98584c718b7d282d3a81f5a8ae635cbbf68e1647e834f66

              Download Submit

            • C:\Config.Msi\e5b9b0c.rbs
              Filesize

              21KB

              MD5

              49a97b76d2cdc553bccd332a7d011b3b

              SHA1

              6f1d148b461853e66cfd29bfd8396b9425b461cf

              SHA256

              3d5758a95f33aabd3d7c2480d0ce3fd8d2485d5068d445383cdeb0df1d18dc88

              SHA512

              cfc935abe44a360518eac0f2038f0036a2b3e08c8fbf77a99a8527bc969f1c77af90b887bbc9e40084dfed7af280deb0a1f073ddf18e604d39845e49ed42b770

              Download Submit

            • C:\PROGRA~1\Npcap\npcap.cat
              Filesize

              12KB

              MD5

              851cc374a87e0a83956a29c762c008c5

              SHA1

              1f1c907e687631c551caaaffb0de28dfcfb03c01

              SHA256

              f05d0dfba14aceb7cb27b49ec8c4f1ce179813e0cf89a32855d7ea2fda91e124

              SHA512

              260c822dbb2fd53cec2ad352e97a42a665fc030de9cf0b223fed3a945822ccbd7e0e12fa0873646aaf38f5f7b93428f29c0bed3709fbaaa83a3dab6dc39a2dc7

              Download Submit

            • C:\PROGRA~1\Npcap\npcap.sys
              Filesize

              68KB

              MD5

              1637086aa0ba4637d2788dc20a0cc67c

              SHA1

              4628fe7561526714361764ec637339b21ea88b60

              SHA256

              734c62543768e37c36386b4a07582bb5b322a60d5c997626465725c5b5cef978

              SHA512

              92fb3dd73873ef8a888823f14911f52fe7c11a06bf4172929783a3f3106ea6298d660389cfca902153424b8df64fbe9dc9c5651228d5eb72a650655df21f7cdc

              Download Submit

            • C:\Program Files\Npcap\NPCAP.inf
              Filesize

              8KB

              MD5

              ed7304fce3f5e3de28435d3f9e8b4156

              SHA1

              45bc86c10386c9368ac482f341999a289dd46897

              SHA256

              64be5edac3eba224120138c6dea3e4a75740e23324fba5a0799499402d96a258

              SHA512

              d7532a12b726869e430745da536b7e1e85ce5871bbf3c3cf5fb4261f5b3d5d4307e6267a8b5f53a6719369e261c66c85c05f3941974594ae4864b16242cae41b

              Download Submit

            • C:\Program Files\Npcap\NPCAP_wfp.inf
              Filesize

              2KB

              MD5

              8ca4504e8e9b66d925107a8f13d9babb

              SHA1

              a1d34e2a6e9ce395da0702a9b1e1ec815dc144f0

              SHA256

              d1b2726787010252e4dec2a1a47fdd42d86b917c9c41f8baab2219de938b90cb

              SHA512

              4c3fe98134c6e7c180829f82374b22ab052e1cadd2d2ff71ff6eefa4e2a7ff21b8bff14ff21677099d2656a0c216c40abb9246860e70be9f254d73d58b624c38

              Download Submit

            • C:\Program Files\Npcap\NPFInstall.log
              Filesize

              393B

              MD5

              68e1ef21950069826c161f576a498098

              SHA1

              8d491c1302ebe0ec80b1c87164ced08ba6c5e474

              SHA256

              ced85fdda9e4c84a453da13948fabb729c4b03093d92a375605306aa63a9deb0

              SHA512

              984368562479104dbb8e176381ce3a5487b3b8c279c0cc5f883d4a3b2d2b7dc2650126fddb9a662cc6bbde4e7d645f6f1a85d6952cb58102f213b01cf93cafec

              Download Submit

            • C:\Program Files\Npcap\NPFInstall.log
              Filesize

              1KB

              MD5

              71323b267afa1de21fe6943d443a47a3

              SHA1

              0586f017a38b1a0e56304af0f93e53a3ea0dfce3

              SHA256

              7b314c86416303dc4fcbbf4f1de8b9dec959e1a5b65e644191b11bc07b39ad3b

              SHA512

              1a73c6f2282889f6293402d01eb69def7a34455bda0ae833cb45e13bf967c5100003f00cdb92810c6c85739a890ec83e2ec51f5eb6384dad680be02ecec428fa

              Download Submit

            • C:\Program Files\Npcap\NPFInstall.log
              Filesize

              1KB

              MD5

              af2f9239d5dd601c5c1866c0220c6c1f

              SHA1

              7e851e241450f7cbfbc4190c77261e2ab0694042

              SHA256

              c776521a50d3ba3c57baee186c4078d7b1f7ba4e1ec8dedd204f319faf07824f

              SHA512

              6bf26f2f99e7ef4e6341f69665e4f26d586935f32b20544b51e329b9b7609fcb1c3fba8f7c036713b98dbf732e344e9a6e073fe6799c61bd35408c6a138c8708

              Download Submit

            • C:\Program Files\Npcap\NPFInstall.log
              Filesize

              1KB

              MD5

              5b3cf626d0e038c21557f70dbd0c6476

              SHA1

              c6e83d93aab59a840331639377beb0327b601561

              SHA256

              f4ed23fd5e088e59a3c49e0370d54fff57342920f0311d08f962f955f3951da5

              SHA512

              42cccf0baeafe5e4d5bd166c29f95c25d6ce13fce3f8a6ed8d52d11ded1b22955566c298ebdb7a96bcdc2495828350cfdb914d0da7227a8fb849df7b9b4bd9fe

              Download Submit

            • C:\Program Files\Npcap\NPFInstall.log
              Filesize

              2KB

              MD5

              4a6d916ff2e9bc23e2304777ce0ac37e

              SHA1

              205499ee63e119b9fdaab5612d72f85ee0be8b4f

              SHA256

              9ba7fb7ccc378eba5500fdd1ec2c919cf7f036653c5a0f2f91ef9bf8877eb9f9

              SHA512

              87cbb94cc70139412d177a885dace7be7ca4bc1e995e392ed93d267a70d2ae41323e6688f7b32bc8e10a8d3f74e3ccd41564fa880ddd4b004746eae1011b376e

              Download Submit

            • C:\Program Files\Npcap\NPFInstall.log
              Filesize

              3KB

              MD5

              5192677ee2d779818140aee97b3de73f

              SHA1

              955a3184d397186e05a2b81c14feeafdf0214279

              SHA256

              bc14bac8b750653bb8fd1d9c8a0a818575248c35b83d80213da5327ee4343ff8

              SHA512

              ec5886d3ee60c1852485eca6d612091dc2b812ef9c920d4e53f66fe5c33194d5fc292606e7bcca6a59e0ecc3071a85009a2ec8127d7690a10e7824bc0c52f7de

              Download Submit

            • C:\Program Files\Npcap\NPFInstall.log
              Filesize

              3KB

              MD5

              23f046033b0e9746df3f9e9c383b8e55

              SHA1

              f69ec936ebddceca127c1c0f8220112d6bbef1ea

              SHA256

              ec2d6c29e9e95b77026fb9496ea486700e43e352d9ac04e2802cefcf729a6b3e

              SHA512

              5a74f547400502e5e92f04e0d2fd6209dd12c342370376471bb38cdefa1497ec93bb102e545813b747a741628a5dc7e0c279f9c90b9dad9b9264209e7662497c

              Download Submit

            • C:\Program Files\Npcap\NPFInstall.log
              Filesize

              3KB

              MD5

              7b5a9c1e9f83a11b9589d2d620282598

              SHA1

              e269e7f2f2452c355437c305749a43754e241cbe

              SHA256

              162fbb537df44d70f2e0cdd8ada0e40ca509da3add4af89fb1023db2a8f6cf63

              SHA512

              bc8632dcf5ab95d6bccad90c8e67feede8e196550bf1b9212756fbce9e5f0395654d8071750999cb1e0afb552b6f20cd84e243b5ffc944c3d7e06659a41f7e5a

              Download Submit

            • C:\Program Files\Npcap\NPFInstall.log
              Filesize

              3KB

              MD5

              c39b2053c6074672c24c26db735e70fb

              SHA1

              08bfbd45ae863959cc5e59b19b5333caa9783de6

              SHA256

              789f6c3ee09c0b639a8eae0e6058670732afcc642302a24a6c2fc0e3454eccfa

              SHA512

              85d25ba6a99af1d035ab7ab5fd99834928bf65d7edb689de9f94d0a906273a8b523363b8af3db8ab5c44622b87f9d33ec0c88c5b5f6e183e847b10fecb2d12bb

              Download Submit

            • C:\Program Files\Npcap\NPFInstall.log
              Filesize

              4KB

              MD5

              e3863f7fc6a04c00c3d34e04f324900b

              SHA1

              ad57c68390e133bbca1cad764f20093d62b241ed

              SHA256

              b57816f94401cae865650c6861b4a552ee1d7a02938e9fb159dd942e01bcfa02

              SHA512

              a0659b8669cb32747ae6a482519f558f0a16d150a88774dd536ecc490c8ec9a53f3d2603c30d5bfdd32d05574a52bc9e59d3ade83ebd89adadf908c5dd38df7d

              Download Submit

            • C:\Program Files\Wireshark\npcap-1.79.exe
              Filesize

              1.1MB

              MD5

              a4d7e47df742f62080bf845d606045b4

              SHA1

              723743dc9fa4a190452a7ffc971adfaac91606fa

              SHA256

              a95577ebbc67fc45b319e2ef3a55f4e9b211fe82ed4cb9d8be6b1a9e2425ce53

              SHA512

              8582b51b5fea23de43803fa925d13f1eb6d91b708be133be745d7d6155082cd131c9b62dc6a08b77f419a239efe6eb55a98f02f5783c7cd46e284ec3241fc2ee

              Download Submit

            • C:\Program Files\Wireshark\vc_redist.x64.exe
              Filesize

              24.3MB

              MD5

              689d09bce45c75db883db7e78b6f4e9b

              SHA1

              ba92a00f0f55dcae85c1bbd098efe606bd080b3c

              SHA256

              814e9da5ec5e5d6a8fa701999d1fc3baddf7f3adc528e202590e9b1cb73e4a11

              SHA512

              4db5078fdd9eb9ce00a1b6195a67c779a1d3c719de0fbd4729adbdac2d8ca442cf4e0a31aa40d213f29617ec073f1a7e42570dcc2f931eb9534c45f1ec6de253

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
              Filesize

              2KB

              MD5

              d7d9a8cf42183bee617ca839d64b7a95

              SHA1

              e5b64017e435f6b41d922755a737a0ba8e15b017

              SHA256

              061b8c7fac080d3a0c4de98b36aa7412a699faa0f6303fa5b59442ee58816ed0

              SHA512

              6f3620568deacaf7683ed1bf63640966568fabaf5c8d46b3d282e54909a3c88599b3ef69e77ca2da779aa171e11dacd57ec3596d1b1af61ca128bb0c065878bd

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              17KB

              MD5

              4cb2b521a99b0e026b9d2e69084d3292

              SHA1

              c4c55087d5ab1f01d0295e3f50aa24574a5ef0e1

              SHA256

              50fe4dda75c6d21fa8492e7a346ed964d09883f48a9255e32c4f35d30952ae4d

              SHA512

              cc66aa2ffbbc763ede72bd550a3b6767f88ef049b120b7cba5895626fcd2a77c24e70ce7882ecd8798df4ee7b3f052e1b1a94ae5f6a5d010d62d306c67ed7546

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              16KB

              MD5

              e00cb5a8d72128f18b531e9a4a7f91a5

              SHA1

              416ca5c4e6e8aa3492b2b3b0df586f2c614c1612

              SHA256

              b1a67701971aef0226ee07bbd08db30acf0d516c98f316276e180f6907b5ec5f

              SHA512

              3f939bce292717fb53cbd2d12a75dd2d6aed931784c08a40058c4cccc43e6e7eaf7f824165c20b15921ecbabef039a221ce452befc248ee4c43cf638a033ec3f

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              17KB

              MD5

              9cb61a72c518f7e84d74bad242928fed

              SHA1

              0bad0b0ceabc6243792809f6d609c3fcbc9a0ec3

              SHA256

              052cb4eb52e081d27beebd46fd9f06183b9640473fce82b53a59d20815a91fd7

              SHA512

              9d317dab832fd3ae18327823e722462baf3cded6db7aa00aa7f2faba868e83d6e23e57cae552614754784b0159702a9ca089a37c63fd7afd9b3f6c22375abbc9

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              18KB

              MD5

              0d2c1de60bc8e3e059c1d64fadb87cb3

              SHA1

              2b135222c9e3ddf9bf98b0f61a2f6120947aa553

              SHA256

              5a1c1715adefbff6f8521e1745f49041f1ddaad318006bd1581a3459a39a3603

              SHA512

              7e9ab7ab1959c7d259c7fad05e6c6bcf8d383aee47051678c6ed262bc080605a488f28b979b32504f7e3391a0d372d93be69e8a480913cc548232860164f54da

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              17KB

              MD5

              5389dfafe77500367e7f0905cfb9d63c

              SHA1

              7cae40b98251567b451ebca15ff54fe026622b7f

              SHA256

              516910b667fec9a599361558c275776df4ea6259450c16f5236999eed864614e

              SHA512

              c99b40b9962019d95af9369ce2e30bac9a50840054012e21a1d0c7596ed95b5dcddf8a36f316544f53a9e2bacc5128b3c3ba162876de5fb8d95eb508b653841d

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_egjg4uat.rwt.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20241211160502_000_vcRuntimeMinimum_x64.log
              Filesize

              2KB

              MD5

              566055e73dc254fcf47403f35fc01a15

              SHA1

              d9bbb98871f386466f055d4f9bfcd189a8b6c5b2

              SHA256

              5023d0407862af0dec814732aa292cf4afe9a039fd1dccf1a1b708ac49df7831

              SHA512

              3fbc361f66669e00aa3a6a8482e9869f6f3dea0d95cc9614e4864e07acb6ebc75098c094c88def03fd56b0d9d8149e56d0398fe0dca27726cef28b442696cc08

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20241211160502_001_vcRuntimeAdditional_x64.log
              Filesize

              2KB

              MD5

              c86c9f88fd5ebb29ef915f45569861c2

              SHA1

              4a14d685ccfcc05e29815ea5d69e7d2f5336e754

              SHA256

              55c263392072101d53ff779a60132208c617f78ba7919455ef5c120de5c31e98

              SHA512

              9c63b3585606fb454d0309b7530c5054ad8ca41d86cc0b9782f06c021e916ea3b923c4767b35e81e2db5c817bb82f8fd585031946f2901b0f0eed9d49c8b5d66

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nseAE8E.tmp\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43.sst
              Filesize

              1KB

              MD5

              de825a838e33ccf3d06b82de337c06d8

              SHA1

              68956e777f646361eae3f06ce6899cd48bb9f593

              SHA256

              3b63b09dff7e4c5fe7ccafff74d9f845d1eb04809b0b77a536b2e4aa7dd1097e

              SHA512

              e935ef759abfcafa4d9cf70a1c5508179600fc85d237e53d3e7f2683fa2e14859e5eee167007328995606996a19f4fcc0c1f9a851011a6fa8db6b53c68160a12

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nseAE8E.tmp\5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25.sst
              Filesize

              1KB

              MD5

              a52f3195b5585e1d9a9b38fef66a1801

              SHA1

              986a5f05ff51d261fe595f0ab56598658aadc9c9

              SHA256

              40795f603b2eab75fbd886715b0103f2f362494576400ae88925ed1ba7063bdc

              SHA512

              e9eeb34c3667e56c425b91890f463b5d80e4e5e9f485c2bd3ac064e1784ad118c1460af461e5af8acbbb3bc02432e4f914e54e41d2bdaeaa8af528f0e669b64a

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nseAE8E.tmp\InstallOptions.dll
              Filesize

              22KB

              MD5

              170c17ac80215d0a377b42557252ae10

              SHA1

              4cbab6cc189d02170dd3ba7c25aa492031679411

              SHA256

              61ea114d9d0cd1e884535095aa3527a6c28df55a4ecee733c8c398f50b84cc3d

              SHA512

              0fd65cad0fcaa98083c2021de3d6429e79978658809c62ae9e4ed630c016915ced36aa52f2f692986c3b600c92325e79fd6d757634e8e02d5e582ff03679163f

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nseAE8E.tmp\NPFInstall.exe
              Filesize

              300KB

              MD5

              c01beb6c3526554ec9dfad40502317f2

              SHA1

              89f468496bd7e6d993a032f918c5baabb21c11be

              SHA256

              5d54a5e7230baf2b80689ee49d263612a6011bc46ec52843e7b4297e9656d32d

              SHA512

              a7fdb3d69cc2b12c9795c8f5e34f64014273e471dc0639ff4693f18e3d5ea758f38f58a5dfc4d1800511ce3e130a7454fd371579e31dbba049770fb74b889339

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nseAE8E.tmp\System.dll
              Filesize

              19KB

              MD5

              f020a8d9ede1fb2af3651ad6e0ac9cb1

              SHA1

              341f9345d669432b2a51d107cbd101e8b82e37b1

              SHA256

              7efe73a8d32ed1b01727ad4579e9eec49c9309f2cb7bf03c8afa80d70242d1c0

              SHA512

              408fa5a797d3ff4b917bb4107771687004ba507a33cb5944b1cc3155e0372cb3e04a147f73852b9134f138ff709af3b0fb493cd8fa816c59e9f3d9b5649c68c4

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nseAE8E.tmp\final.ini
              Filesize

              568B

              MD5

              cae757421db8d011e41266bfd9439885

              SHA1

              7108a9f0740ee4e3a118f6ac9212e0446f074181

              SHA256

              ff350a68202aadb145f590c8579f9284d2e3c324b0369fde39e5a3a31d7b8204

              SHA512

              785d19c796834065c823a7da99036378bba54b932ea1e47d4ba0c1d123a0a09ec307a3459fb862221de74ce61d9a8d7ec73901c9de007d31e7b39eb7a19b16b5

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nseAE8E.tmp\nsExec.dll
              Filesize

              14KB

              MD5

              f9e61a25016dcb49867477c1e71a704e

              SHA1

              c01dc1fa7475e4812d158d6c00533410c597b5d9

              SHA256

              274e53dc8c5ddc273a6f5683b71b882ef8917029e2eaf6c8dbee0c62d999225d

              SHA512

              b4a6289ef9e761e29dd5362fecb1707c97d7cb3e160f4180036a96f2f904b2c64a075b5bf0fea4a3bb94dea97f3cfa0d057d3d6865c68da65fdcb9c3070c33d8

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nseAE8E.tmp\options.ini
              Filesize

              2KB

              MD5

              4c03a565eafdd997f6d501d81e3ad3c9

              SHA1

              1a8e728e164148dc08c4b24242721e6ecf515812

              SHA256

              0f5a91ef783df6ea57ff35297d7a05f5cc6b38b04ff6f307eabb08be6484b43f

              SHA512

              fd1c34b3f5ffe51fd91ee82ad68b131918724e6b0b4b19947c17ad169bf3cd1bcd37d6fea36afac817929a9f74c13a65b5e1736de83af65dfdcd895f002e229c

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nseAE8E.tmp\options.ini
              Filesize

              2KB

              MD5

              31e2faee80521c6ace0bbd28e083d56f

              SHA1

              1318c7c8b7f6c21cfc96f28c3072d20260ab0d22

              SHA256

              bb9855fb96614f0e0103e08b8af7742ca929cc1a217c0234bf66804631267f18

              SHA512

              a632f25998a7cd8f01b9b5bb2a7833f01d2a885608827919c0bedeb953784ff6647bffe54b8961a1a3300d4adea7b4475437a10352d9f042c474ab302f430980

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nseAE8E.tmp\signing.p7b
              Filesize

              7KB

              MD5

              dd4bc901ef817319791337fb345932e8

              SHA1

              f8a3454a09d90a09273935020c1418fdb7b7eb7c

              SHA256

              8e681692403c0f7c0b24160f4642daa1eb080ce5ec754b6f47cc56b43e731b71

              SHA512

              0a67cc346f9752e1c868b7dc60b25704255ab1e6ea745850c069212f2724eba62ffaaa48309d5eba6ae0235223518610fb4b60fc422e4babba4f33d331c71db5

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsy75CE.tmp\DonatePage.ini
              Filesize

              904B

              MD5

              a7503cc175535989650d0749c18c8881

              SHA1

              1f4d8aed9a2677e9a2f0467c022fc98b732ce81a

              SHA256

              e0f775ff3740334da3924a6537b87d8fc1211942e42d4565f9edd26cf50e7b3f

              SHA512

              3495eee44dd3756b180e50a6f59e3b5fb41707bd243e9f2631e8f23e8f2cc1f668e449a0f905d8876e997c341adbc234ca4a0b7a6f9857d77ee7fd2f689face5

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsy75CE.tmp\InstallOptions.dll
              Filesize

              15KB

              MD5

              d095b082b7c5ba4665d40d9c5042af6d

              SHA1

              2220277304af105ca6c56219f56f04e894b28d27

              SHA256

              b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

              SHA512

              61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsy75CE.tmp\NpcapPage.ini
              Filesize

              2KB

              MD5

              7f8588dc6bd696b36b2bbe0e8cee0156

              SHA1

              1000dd884a4cdfc2952e30896bf3871220935ecb

              SHA256

              89b8718f3446aa95be0c968046a61a26f75eaf8cc865452c5e7d27bb6f92a221

              SHA512

              b0106a2c3e87fd9641a719e463cab7558adc6c65f3830ff71b3140c23dd7a93ad1955476fa8c46f057a7e334ad751e0aad9c3255f9e6a7d74f1f2b71b7e65b97

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsy75CE.tmp\NpcapPage.ini
              Filesize

              2KB

              MD5

              511c2c65cf643ca999dee7f827199e94

              SHA1

              2c78b15ddbb2372711903e003eb04d12413141c4

              SHA256

              3aec087e19c6c34ace3ad754a58f497d0a54b60894b777c64346bf40f8515c4d

              SHA512

              685941488192eec5c4c1be0d59d1d8cd0cf0430ac8e46ae8a61e9e9d9c2e351386dc97f20f905f59009091c0c90f7e72c9521b31286a065026439bea8580c524

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsy75CE.tmp\System.dll
              Filesize

              12KB

              MD5

              4add245d4ba34b04f213409bfe504c07

              SHA1

              ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

              SHA256

              9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

              SHA512

              1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsy75CE.tmp\USBPcapPage.ini
              Filesize

              2KB

              MD5

              e99e395d6bfc37663626c4a01c732692

              SHA1

              75813eb6682b97de44dafdd6f98afae7e4d3868b

              SHA256

              b4c5e164a7dc968941eab553a3c0f53f3aae8209b8eef74d4be9838b78b51503

              SHA512

              e13cf96693c5d3971fdb5b14ee25e629b7016b045719f59d451789651127323b0a260f6c085f0b746b64d04a06a4d408aafc20eb71635d6064d8584af20973f6

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsy75CE.tmp\USBPcapPage.ini
              Filesize

              2KB

              MD5

              2c9b26e3cd82c785909565d16930f967

              SHA1

              e84e088f8468aff4092b916f3e05365804e7a71b

              SHA256

              12b7c8407403be28bbe750a7836cbb1311dfce29a60481293a11abd5957f7222

              SHA512

              d916cfb498c8079eb39867717ac34329060b75038eb819750ac7479888bc7f6dc5f1da2478374711970da8eec58779dd1312a6b8c5690d6c4ddd8a0d0d9e227d

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsy75CE.tmp\modern-wizard.bmp
              Filesize

              25KB

              MD5

              cbe40fd2b1ec96daedc65da172d90022

              SHA1

              366c216220aa4329dff6c485fd0e9b0f4f0a7944

              SHA256

              3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

              SHA512

              62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsy75CE.tmp\nsDialogs.dll
              Filesize

              9KB

              MD5

              1d8f01a83ddd259bc339902c1d33c8f1

              SHA1

              9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

              SHA256

              4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

              SHA512

              28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

              Download Submit

            • C:\Windows\Temp\{864CA675-05D6-4172-B975-B095A322A333}\.ba\wixstdba.dll
              Filesize

              191KB

              MD5

              eab9caf4277829abdf6223ec1efa0edd

              SHA1

              74862ecf349a9bedd32699f2a7a4e00b4727543d

              SHA256

              a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

              SHA512

              45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

              Download Submit

            • C:\Windows\Temp\{8918A7E6-B342-4D01-B41D-3D81C3D7368E}\.ba\logo.png
              Filesize

              1KB

              MD5

              d6bd210f227442b3362493d046cea233

              SHA1

              ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

              SHA256

              335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

              SHA512

              464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

              Download Submit

            • C:\Windows\Temp\{8918A7E6-B342-4D01-B41D-3D81C3D7368E}\.ba\wixstdba.dll
              Filesize

              215KB

              MD5

              f68f43f809840328f4e993a54b0d5e62

              SHA1

              01da48ce6c81df4835b4c2eca7e1d447be893d39

              SHA256

              e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e

              SHA512

              a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1

              Download Submit

            • C:\Windows\Temp\{8918A7E6-B342-4D01-B41D-3D81C3D7368E}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
              Filesize

              5.4MB

              MD5

              92f06ebd6d7dd8fc4373a257ba81e19e

              SHA1

              479f3a9fa2d3fed500088812f9201197adf01e17

              SHA256

              8265bab100e281ddd366a9a435aee439bb87a1fe848fbfce0881449c4f08e485

              SHA512

              76eb034b06f05a0dcbe62843d791a28959c9354c5e290b90a4320451ba0d5081432f2f6581fb16aedde1fbdc7a60b85c0d7f13907ab7d5e563c57dd2aa6fb9ea

              Download Submit

            • C:\Windows\Temp\{8918A7E6-B342-4D01-B41D-3D81C3D7368E}\cab5046A8AB272BF37297BB7928664C9503
              Filesize

              967KB

              MD5

              3ec3d0ebf9e94535ab326fb3ed1ebefd

              SHA1

              5331e4062617df4cfe8dd1fed67a39e1778c3e86

              SHA256

              78cd0d63fb93470f11a300d79c5bafe4554142035126068710d6583fc23d49fa

              SHA512

              c3f4899d2bf3079485c5c47c8a910023b654e0ae4821ced54b995df5626692551e12fecdc65551d56d9a99f8e5dcdb6176011afe97dc45a734c192834ed0485a

              Download Submit

            • C:\Windows\Temp\{8918A7E6-B342-4D01-B41D-3D81C3D7368E}\vcRuntimeAdditional_x64
              Filesize

              208KB

              MD5

              c41d1aa655205cb772e3aeb0de9c14df

              SHA1

              a3d95bdfa9c9552536adb589f66ccf28dfeabb1c

              SHA256

              a4b5cd38dbac2d9588bb15d6b02b24a05c340c2c0a10d1ac86037e6dd14262c5

              SHA512

              dd5b8f32021bcff98f2a96582d4cfc28571bef870ca3b1d6f7e58d6d4e18f12eb91063f2524094beb699396814109e39f87183e9935742b9579bae75f5f32f52

              Download Submit

            • C:\Windows\Temp\{8918A7E6-B342-4D01-B41D-3D81C3D7368E}\vcRuntimeMinimum_x64
              Filesize

              208KB

              MD5

              cbb2aeab99bcc3085738c1c41fdf3225

              SHA1

              9462fcbb04046d68df7250f5124e79c269f771b2

              SHA256

              59a148da299c73d6bd4ef9a8e99736c3d3eabb3b9f895ad8ab183b657516cc22

              SHA512

              aec8238b7d7a4727b1f3fdcd5d3c6064bf72af6da5d8ef6542fe5fd97b8e24b7d15540426fae029a628d7e160f9fb31fc482edccc416d970f93656ecad0fd5e7

              Download Submit

            • C:\Windows\Temp\{F3FB4132-5560-4563-91F2-BE63D4709723}\.cr\vc_redist.x64.exe
              Filesize

              670KB

              MD5

              261f741c93973d184d4fccf833f0c075

              SHA1

              cb7846fc45cc545b3ac6ab0aa3425461e219b196

              SHA256

              1ec6ded595b12262d8bfcf8436046c9d84febff424924cb839a1946dad76ca4e

              SHA512

              90ca6a11c6bbd5f97d1ed146da5279bf40330bf9020b40eb816ede0d914ed4d769e9c48cb8c839924700dec818d4f818f89e6d6afbc7091e2a2809ebe099da81

              Download Submit

            • memory/416-1528-0x00000000062D0000-0x0000000006627000-memory.dmp

              Filesize

              3.3MB

              Download

            • memory/456-1311-0x0000000007020000-0x000000000705E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/456-1305-0x0000000005C00000-0x0000000005C4C000-memory.dmp

              Filesize

              304KB

              Download

            • memory/456-1308-0x0000000006150000-0x0000000006172000-memory.dmp

              Filesize

              136KB

              Download

            • memory/456-1303-0x0000000005760000-0x0000000005AB7000-memory.dmp

              Filesize

              3.3MB

              Download

            • memory/456-1304-0x0000000005BB0000-0x0000000005BCE000-memory.dmp

              Filesize

              120KB

              Download

            • memory/456-1307-0x00000000060D0000-0x00000000060EA000-memory.dmp

              Filesize

              104KB

              Download

            • memory/456-1309-0x0000000007440000-0x00000000079E6000-memory.dmp

              Filesize

              5.6MB

              Download

            • memory/456-1289-0x0000000004570000-0x00000000045A6000-memory.dmp

              Filesize

              216KB

              Download

            • memory/456-1306-0x0000000006D90000-0x0000000006E26000-memory.dmp

              Filesize

              600KB

              Download

            • memory/456-1292-0x0000000005510000-0x0000000005576000-memory.dmp

              Filesize

              408KB

              Download

            • memory/456-1293-0x00000000055F0000-0x0000000005656000-memory.dmp

              Filesize

              408KB

              Download

            • memory/456-1310-0x0000000008070000-0x00000000086EA000-memory.dmp

              Filesize

              6.5MB

              Download

            • memory/456-1291-0x0000000004C60000-0x0000000004C82000-memory.dmp

              Filesize

              136KB

              Download

            • memory/456-1290-0x0000000004D10000-0x00000000053DA000-memory.dmp

              Filesize

              6.8MB

              Download

            • memory/1204-1327-0x00000000056A0000-0x00000000059F7000-memory.dmp

              Filesize

              3.3MB

              Download

            • memory/1296-713-0x0000000000BC0000-0x0000000000C37000-memory.dmp

              Filesize

              476KB

              Download

            • memory/3740-3899-0x00007FF988C60000-0x00007FF989221000-memory.dmp

              Filesize

              5.8MB

              Download

            • memory/3740-3900-0x00007FF7CF9B0000-0x00007FF7D0354000-memory.dmp

              Filesize

              9.6MB

              Download

            • memory/4272-1545-0x0000000007C50000-0x0000000007C82000-memory.dmp

              Filesize

              200KB

              Download

            • memory/4596-714-0x0000000000BC0000-0x0000000000C37000-memory.dmp

              Filesize

              476KB

              Download

            • memory/4644-676-0x0000000000BC0000-0x0000000000C37000-memory.dmp

              Filesize

              476KB

              Download