Analysis
-
max time kernel
70s -
max time network
69s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
10-09-2022 19:12
Static task
static1
General
-
Target
NanoCore_1.2.2.0.exe
-
Size
6.2MB
-
MD5
22790f471d863288e8f083d19aed4def
-
SHA1
8f693204d1a6a266290ff7024546759cbe60ed71
-
SHA256
c64feb85bcca547c7c93bb64f8ad2151b44276e9cbfa5f4b17e073b76c598f0a
-
SHA512
b90e11eaf14667cefecbbd57078432822f3da702564d5854f4692749b5d3d36ca6e6e59d6afc4dbcf5d6f822e4b3a8ff30806d043027ce91761d826f0a027c83
-
SSDEEP
98304:JKUMPI3wxYjbMSzoXTT3HgoFw7JgN2oJChQ/YOQcNNSrNk0tRngFBL:JfMPjxYkSza7HgoFMqN2x2/YRc6rNk2I
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
crack.exeNanoCore.exepid process 4688 crack.exe 2728 NanoCore.exe -
Drops startup file 2 IoCs
Processes:
crack.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crack.exe crack.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crack.exe crack.exe -
Loads dropped DLL 13 IoCs
Processes:
NanoCore.exepid process 2728 NanoCore.exe 2728 NanoCore.exe 2728 NanoCore.exe 2728 NanoCore.exe 2728 NanoCore.exe 2728 NanoCore.exe 2728 NanoCore.exe 2728 NanoCore.exe 2728 NanoCore.exe 2728 NanoCore.exe 2728 NanoCore.exe 2728 NanoCore.exe 2728 NanoCore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
crack.exepid process 4688 crack.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NanoCore.exedescription pid process Token: SeDebugPrivilege 2728 NanoCore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
NanoCore.exepid process 2728 NanoCore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
NanoCore_1.2.2.0.exeNanoCore.exepid process 4584 NanoCore_1.2.2.0.exe 4584 NanoCore_1.2.2.0.exe 2728 NanoCore.exe 2728 NanoCore.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
NanoCore_1.2.2.0.exedescription pid process target process PID 4584 wrote to memory of 4688 4584 NanoCore_1.2.2.0.exe crack.exe PID 4584 wrote to memory of 4688 4584 NanoCore_1.2.2.0.exe crack.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NanoCore_1.2.2.0.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore_1.2.2.0.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\New folder\crack.exe"C:\Users\Admin\Desktop\New folder\crack.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\New folder\NanoCore.exe"C:\Users\Admin\Desktop\New folder\NanoCore.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\New folder\ClientPlugin.dllFilesize
19KB
MD5bdc8945f1d799c845408522e372d1dbd
SHA1874b7c3c97cc5b13b9dd172fec5a54bc1f258005
SHA25661e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403
SHA5124fa0ed4ef66e4c442f5fc628e8bfc8a4f84cb213210643996d9387027edb619c054f6104ac889ae77cece09f0304f95d5f20e14d66847e2d382ef51eecec0962
-
C:\Users\Admin\Desktop\New folder\Databases\core.sqliteFilesize
3KB
MD53732df3263fbaa868bb866bcca1f402c
SHA1f247dc7dfea7bcbb69116920d48af2dabf85b444
SHA256716d9992711b5b17eca841836ba5a63db0a62251bd056a92db96deccfa887b41
SHA512bb99cfe2be9488c6d7e57991b2bbc4e593ade8c8d2c79e4b7056ec5be60fd5e0b88467f65dca71c269540b800f0c3319e4e849e7e77069a6e9b1b89a2d4807fd
-
C:\Users\Admin\Desktop\New folder\Databases\main.sqliteFilesize
15KB
MD5623de89b53d69e79db98c9e7b85ed4cc
SHA13f91434ac168126513e7352d5fb62fc4e77b2c72
SHA25680a099223d278ab77e642697665bb4076393d30247bcdb50e712598e6ffdf075
SHA5121bd275b3ff5581d6c210c7fbe41338807038b926635e0cce1b816d952e67f5a0b91645672dad6d64a01f800f408a72cd3fcb2984da8bf21cd86f69a6426d1a78
-
C:\Users\Admin\Desktop\New folder\NanoCore.exeFilesize
1.4MB
MD51728acc244115cbafd3b810277d2e321
SHA1be64732f46c8a26a5bbf9d7f69c7f031b2c5180b
SHA256ec359f50ca15395f273899c0ff7c0cd87ab5c2e23fdcfc6c72fedc0097161d4b
SHA5128c59fdd29181f28e5698de78adf63934632e644a87088400f1b7ab1653622e4bc3a4145094601211a2db4bcbd04ea5f1ac44129907fbb727fe24a1f3652c7034
-
C:\Users\Admin\Desktop\New folder\NanoCore.exeFilesize
1.4MB
MD51728acc244115cbafd3b810277d2e321
SHA1be64732f46c8a26a5bbf9d7f69c7f031b2c5180b
SHA256ec359f50ca15395f273899c0ff7c0cd87ab5c2e23fdcfc6c72fedc0097161d4b
SHA5128c59fdd29181f28e5698de78adf63934632e644a87088400f1b7ab1653622e4bc3a4145094601211a2db4bcbd04ea5f1ac44129907fbb727fe24a1f3652c7034
-
C:\Users\Admin\Desktop\New folder\Plugins\AIO.ncpFilesize
17KB
MD560c274ccb344da9e3d77449f6068d253
SHA1ab25eddf3ddb61ef52104a01e5c9b8a23451c764
SHA2560a59aaee013c57f3b6190d683160d88ca1c5868565cbf5acbb7b17d3e925c602
SHA5129600d852b56557f31a5a18a6aa2cb76cf4fabf36ae32bbeccf82677f64737542234e2fb06ac8d917f9839120320b7db212d76e8dea24445f13096d86a474b9c9
-
C:\Users\Admin\Desktop\New folder\Plugins\CorePlugin.ncpFilesize
119KB
MD57914e7302f72d330aa5f6c5c8c26df43
SHA18c411f3fe5297a78cb018539b44df87c0a51606a
SHA256f66985518b1e56a04f512d110f5b79f21ed91cbcbf6bd3e17eba3dcdfb85f9b5
SHA5128959843f282162ff0c59d890d04012c4f62dc36058aa7095d708a97a34313082cd4ca5ea5df5623cd2d6b8b91c527297168cab08ec59c1ec48fafac5983ad012
-
C:\Users\Admin\Desktop\New folder\Plugins\DucPlugin.ncpFilesize
73KB
MD55eca68a8368e0e144b7016e30b85515c
SHA10ba48b49974156e5746958aeeb1c2a26c916b3be
SHA256e2ce89b3e68b003cb27e2c5652ccba073c8938bef194e51830539b2464a3f676
SHA512ea1d1363fb072a5c646ce070184855588124be42392dc492ce86c88fe93eae78e23f5de4f2df75fb5b0e8d67bf08ff192dd163ed3c62a1ccfb0b8436ae1df644
-
C:\Users\Admin\Desktop\New folder\Plugins\ManagementPlugin.ncpFilesize
300KB
MD5b612c2c9a6d361a5db14c04ba126119c
SHA1d2b29e235b0f45242088b78313438bdfd51209dc
SHA256b86fe4e126a9748a383a34d615b9598c715f2380c0aad957495c66923902026c
SHA512194d4688935235f3ca686868c9ff53c7945d4e076d4a51fdcbc254bfa1461494766480794c65715bce314256c7cc5268bd6547c937984d3010f54f5a3db4ba9c
-
C:\Users\Admin\Desktop\New folder\Plugins\MiscTools.ncpFilesize
66KB
MD578e3006fc6468eb7dfc7761072b84ac6
SHA1e46cae768d2754f48a29b7e424a9bddf0d67bcd8
SHA2563a3a3b105eefb45e3b70cc1592e484df02df7020d5154e8c2e5d7d439e295e46
SHA5120daa1cc9ddae70f442ee5eed784523dc1378b9d095edfaec1df95e02f00d09b461d60ee180f716f7ba755543ef7b0c87d791a454cf254dde0033b8615b2841e8
-
C:\Users\Admin\Desktop\New folder\Plugins\MultiCore.ncpFilesize
236KB
MD5becb82e1e914e906be158e3f9dd658ac
SHA1725d3d658680ca8dcb610d998db4b28733b5ee52
SHA2565494adf651fc64e3aa6c08e38165d8dbfec52056cdf4fadae90b76b0e6816a33
SHA5121d67e7d5686ea225262501afb572bec23e35bbd33c660a57e84b9cad7adfadbe457b128af0059ac705d53c6b65798f5525fe4ed3c16537b0c085414cdca74174
-
C:\Users\Admin\Desktop\New folder\Plugins\NanoBlack.ncpFilesize
107KB
MD5794ab16c092ebf2b1d812d6cce158537
SHA16dd9edd26b50265d5af4642f9d1f1f8703a44805
SHA2567919b7998d6b359d7cb700018dc2d69ff6ffb45bd01c9c190b98fb4c9ff4beab
SHA512e639bb0f7d309344c45ddff3d7f91212b3c6a9db6970d06db35f6bac228b389ed8c32dbda75ae23ad1359bb60f678b0b891caa3ed07245aaad21dcb3ea4a5347
-
C:\Users\Admin\Desktop\New folder\Plugins\NanoBrowser.ncpFilesize
102KB
MD58b13fdc96af0a84c152f5a601dcc6b06
SHA11250db70fda8a2c32f37bbdc5638074c6dc171a7
SHA256997c41b05150480bcfae9abb3132fc807f6c6b511b810b554fdb5aedf89f5db0
SHA512536d4e1b9e7c95ebac762d0a438106a5409c69e990940d3411709364783f957015d4a5dc0651b33591e37dcda8549e689a87b853e32f3ad065391a2d8190a552
-
C:\Users\Admin\Desktop\New folder\Plugins\NanoCoreSwiss.ncpFilesize
49KB
MD5fcb5afd01e75aca8ed9fbd35a46e54f3
SHA194b69f8612d31fc0698089d5e08aea1cafea52e7
SHA256bf0386f6e9b4a35fefe5fe917e2be7c64867efe24521f18e4567f8af5f6dd5e5
SHA512b587dd23eaea6de486c30864908f8603451c459153cd21b86a5e43bb9c2cca7cbc015daf620808fad76a4d56bbc4e57e127059c8e73be6c85bf958781c1343fe
-
C:\Users\Admin\Desktop\New folder\Plugins\NanoNana.ncpFilesize
157KB
MD5c5d40b767bd6b97f88ccce13956d0ad8
SHA1ef7f7fdd9d5ea0b55ffbb17c171ee6a46b347100
SHA256a3c39444ac74bb91f14f3f2ae6918d9b1d368268e137aca310450fefbc8983aa
SHA5123fcb5a6afdc7de59bac645d8b4dc6368b0405a51985ff86c95fc8cd579bd59bc423cab940dc0ab3de9a0cd0d9e04dad82e380ef18030330d72b2e72936a95ee1
-
C:\Users\Admin\Desktop\New folder\Plugins\NanoProtectPlugin.ncpFilesize
179KB
MD5e51af633e5f5f4a817a54773fb90d337
SHA10cb8a7965f9f042954b1f318ea1026b76e12f8e0
SHA256b37602dbb924bb94df0d9745d13fcace8a6642397fb738fbe02a88f667f3ab66
SHA5126454305121597073d4ea2b8f57a4bb4a4fe7fafbd05336c91265534faea5a5cdec7504c1329ea0c8cb344a4f32d59c60af5348dfd89375876ae95ee2c15f0c14
-
C:\Users\Admin\Desktop\New folder\Plugins\NanoStress.ncpFilesize
117KB
MD5ba6f59df971d6db7a8951edbd5d6691b
SHA1ed766de1fb4ab0889b3fbc8127f1393eb3cddc15
SHA2566b33a572e019266749a3e04966e2c57822e247c5197f6f9bd6a4bb8792633581
SHA512bbd50d7cb2b2799055b8864da3d3d6037bbac41312ce8582c4627611ef856ae38ecff67dc4223e236d1b555bf02a7c0c7284a76ab90007621a2f2997b6bc5dd2
-
C:\Users\Admin\Desktop\New folder\Plugins\NetworkPlugin.ncpFilesize
319KB
MD570e5b02349742a550fbfcfb5bb78c906
SHA12319b68398af74fe08b6a3a7d6943cf700240a4e
SHA256160030b8444b6fa86775a11d1be35df6a75252070fc5661055884d3f8b07296d
SHA512bbb5d2fd6eff637da303a4ab2fdb02f781619ffe25c5795c5b9e514214227717771a98ce6c3becc87b29c15303ac4373ee3847060ad5755a2455362e6e26932b
-
C:\Users\Admin\Desktop\New folder\Plugins\SecurityPlugin.ncpFilesize
74KB
MD544bd68199bb393d0eeb7ae83b56d9b9f
SHA1c6cfa069a17ace16c651a11945bd54f4ca6193d1
SHA25625b1b0836838740d394cd35eaefc660e9eabeb611a701a451eb1119f6427fc12
SHA512a02b82e40f66dc925de3324c03e8a0a497bfdb6ed44549001efbf86f2e5381aaf9259978908cce9ecc7798f083d3691f007b207ea301a9dc73f2430662146bb4
-
C:\Users\Admin\Desktop\New folder\Plugins\SurveillanceExPlugin.ncpFilesize
423KB
MD5195fbe66986564288c3285935fe87b27
SHA12fe84fbbf109b3e4c7c63b414689021ba847b568
SHA256a2ce9ed783b26d01d58e07b9c97bcfecace9ced72960cf3ecf471fbd008afbae
SHA512552161e555d07fdf7062a4c0d3738819b13ad4c9a5c54f09db48dccf6faf49b014eb043037500abdac7af0210ed118c5232d8d54be367d8a4caccfae7904332e
-
C:\Users\Admin\Desktop\New folder\Plugins\SurveillancePlugin.ncpFilesize
352KB
MD5ed3edf12bac989d1dd6edf7146feb805
SHA1776a667bf2341b43e199c3601856ac223b86d221
SHA2563301f9fd4700458a18589956fd2bb6e5101b15c14f52d5e079ae1c3a008da040
SHA512e6873a5d1caada8954907bdb3120aa2c60a4137fb9d04abdbb74ade58f35ada1ff87a447cf6a35f5798dbd0e1e0ed813d62e34d98de8d6402b6432746aa80413
-
C:\Users\Admin\Desktop\New folder\Plugins\ToolsPlugin.ncpFilesize
130KB
MD5699eb468e7d6bee9c429923b5b477545
SHA180bc420c3e441c9b9c3813ac05ea9e168cca1e3a
SHA256d753bc28d842e44ffbf6cf99314febe5ed7759b25a74ca34a47fdd153bf2a6ab
SHA5125d82a98e918ea3eb024dbb7552e5cdecc317b49635a5789029e7a0035d2f0cb2a3c47ef53e603217afd17d6f59fc78a918e2e5f70266119c619e41b3b647aac9
-
C:\Users\Admin\Desktop\New folder\Plugins\VisibleMode1.1.ncpFilesize
49KB
MD537c2ef6e5214600396ee87c4168a5664
SHA169b6e1f612f5a3435fab05074cffd3ebd1c232fa
SHA2564a8d45e13a38c502a3109d2ea17a81905fb9eabbf643ae611b62f62ef11f09b2
SHA512667ad370f48470d60dbd437b0601eb05de421ab59b281adcf9c6f54b9c6fd272d3aa34c35e7e6df889771dc5fbdfa9bc683a4bf156727827595edf6eb2fe8cab
-
C:\Users\Admin\Desktop\New folder\Resources\ContextIcons\application_delete.pngFilesize
580B
MD5333c3e0cc3ff3a57b9ca358de9bd39cb
SHA1799169a02fc0ad101dad6b8d6d86c5ba76015841
SHA2569e3de440bec32e23846a9ef37235453ea627a8aeb0a17ac0afedb433fcb448ee
SHA5123551ad2fba75328aab0ca185290c18d44c1943fc1423f9c3c12b6f450c14be27c4fbfa548d98a664e06693cc706dce1a41c3f5bfaac245440692a25fb11b6b82
-
C:\Users\Admin\Desktop\New folder\Resources\ContextIcons\arrow_refresh.pngFilesize
674B
MD59b1a30ac871af0684baa0e4e76911d48
SHA1c1bf620aa2e493ed63d96729842c650b62c26ab3
SHA2566141eaf716680ef3030c0db1252bb39bf3145e4a17225d787808c7731ba9358d
SHA51222c6a8d27ed029cde7812b5cc0442c8e6733fa00f1f62506f6f94cec48026709e0c444fb72dd123b37182c791bb9358d00cac899bd65480c9d05d4b8ce80758d
-
C:\Users\Admin\Desktop\New folder\Resources\ContextIcons\books_stack.pngFilesize
1KB
MD5f85aa7e604e376846e22060f39ed5cef
SHA152682e511e742f72f370946a87022d00e6218e64
SHA256e10f4dd9daaf95f3aa0f6009e2d82d5c09981cced09c253bf105931a40673750
SHA5123ccb257db311259887b811ba217122325dc7ff443697abb875a56950be3dd0d1ba481f9ff9b1666c264c277e40938ac403df90179ff1f43749e5882897a9d6b6
-
C:\Users\Admin\Desktop\New folder\Resources\ContextIcons\clipboard.pngFilesize
503B
MD5bba5acfe2a3448910760402af17b2057
SHA1b5a17fcaa8462818cc7bab6ec28f0b394f47c553
SHA256bc6045247ed76340995951f6fdeb18c24b8ee53db3450a3426b8aca85175b308
SHA5122f27d130675eefb2e6586645a75fd3d0729e9050a3ad7b8dc1671ed86c270831589f9c03f6c39fe1755a7c485fab42af789bb446ee5ab7615e574fe5a0f6fe35
-
C:\Users\Admin\Desktop\New folder\Resources\ContextIcons\computer.pngFilesize
715B
MD5c0dc4d56147b86b211c7419f727be0a3
SHA171740927a6e212b9caaf30a04eba86ad549bf63c
SHA256b0b606f3f84b5e1f8c7f8558dd3f092adce374f5c810613845276d47a6401d58
SHA512a1e89366800e611979fe693cc1a87d75d3e0e9629523b2d19a222b87a4f80e813319f861fd972cb861cf227de272d701f7bac508fb48c8f2d025485fe8b75a97
-
C:\Users\Admin\Desktop\New folder\Resources\ContextIcons\control_panel.pngFilesize
636B
MD549811b46491e436958be941d0e5e2bd2
SHA1aab6685832f9de619929f7bdf288ac668f35ce02
SHA25604030a3e3e23baaf7573e297ca0b83f5d196f905568fceefba0b1e0413d1a063
SHA512cb078f7341c646f9ec65a2a0e9f20dd3fe83c713bd4999cd79619ba52729ac673fc1a9f24c0b7547058b22664d8ad79df14ab2a3656c5577b8ce3bc751ceb54c
-
C:\Users\Admin\Desktop\New folder\Resources\ContextIcons\disconnect.pngFilesize
661B
MD5560aa223ee6d663270b49df9fee84d7a
SHA15e177aa1e3180cccc15fc81bce5d23ae32ddef6e
SHA256d79ca587e71fa6dc2fe27b2fb678b84b01b0509a1956ee8bd852417e860d5fa7
SHA5127a2295769cd2ed15ad9491afda427a7584fe206fe1158caf01d5d229d7d223820b92fe6b804ed0a5681f0cfd25ba3a2a7280b4180a985c0ba67cd3eca2c37487
-
C:\Users\Admin\Desktop\New folder\Resources\ContextIcons\file_manager.pngFilesize
647B
MD5aa7e817a2d4f55e9873a24a1586ebf54
SHA113bbe5a713599e6c7fb7cf043339995e02cd088b
SHA2564623a50fc347c3f745ae9acb1bcddf6394e18d07bb532036b7fcaef4e161e33b
SHA512b7dd1ef3b7fdac61ad014283dd2fa6af0ba83ea4162cccbd652576bab215c474c4c1feb343117cefa20741a29390b0e6eff67cf3030af40cd5baefe85b0615f9
-
C:\Users\Admin\Desktop\New folder\Resources\ContextIcons\remove.pngFilesize
399B
MD551f8eafbfab6b02f83e24336f4bb7ec8
SHA1e18154aabac4f28b829197666e0c156b6fe52349
SHA256e2a8bd43684bf7955927ed689b191b0fb79552c1440342f0c6dd2ab6bccd7b7f
SHA51256777a5b8a0e1f65c6767325d6c0527de33e19055fa9af6e4a11af4127d5f2ec22c2a957fbd972991eb754202f56effe53ee392a5cf80ccd5fccb47dfc8c90bf
-
C:\Users\Admin\Desktop\New folder\Resources\ContextIcons\system_monitor.pngFilesize
541B
MD5cbc5a799bd030812570fe27b8a5c804b
SHA1ef0be2295a7165b76785602e9bd7f5fc13c8cb6d
SHA2569913c8c7871b787d832a3688db5623e8f72ac547d0517a5c1741e9c24d6ea279
SHA512ec40b627f37e1c368314cfa7dd6d13adf8d4ab420c96267cb5a1f384a625ec8a4eb8fbbedab0e2b8239906e1eb1961c862a6a104fde83adf14f3fe29109e1197
-
C:\Users\Admin\Desktop\New folder\Resources\ContextIcons\wrench.pngFilesize
660B
MD5da4053b4dd7f25ab2f0fc2efd1ed871a
SHA14c5314dbb63ec94c8735bf83cccb66926f4f9d92
SHA2560149f17649f85866d19b503c0a75c592d5e6a2bd62cac1a11cbb180ecfcb3f79
SHA5121d039be60f312d58145eaea5d83d16b9214fdd91c13580567f1aa6cccd8dcd497aff95368d0ebfa770f79545a6626f943fea8ed9c19717e405a625269cbe9006
-
C:\Users\Admin\Desktop\New folder\Resources\TabIcons\builder.pngFilesize
303B
MD5d2d498dc06990b948ef42c479c4c1f94
SHA1eb380e6d156f5cc2ab28baa5add2ba8acda088b3
SHA256ce8e344d1975972fa3f1b54383ab01cf522217e83b4e01f5c5b8563641bf6550
SHA512fd9f99b7489507d8208432847085507e5d1823f1eed5d3c7e644c59bc5e5b36d8705d4add01a0c291240029458b25d72894fc05efede8b795bb6872e1e5f9ef9
-
C:\Users\Admin\Desktop\New folder\Resources\TabIcons\clients.pngFilesize
462B
MD50331dbac2291c05d567461b58654d350
SHA11f89cdf7199983e788fd1f22b873ab9b0500952d
SHA2568d1339e002540de132326aeb1d17c66a9a60b0af7e3daca9bc40df17e9c96542
SHA5122d12a85226a21670c49038e4347b39227b8d8bca07b8eb66f2adae0ccf1135270f5ba5f16a40bf526477c70c00c1ca572bfb973306e6eb8dd057600de38da161
-
C:\Users\Admin\Desktop\New folder\Resources\TabIcons\home.pngFilesize
343B
MD50a482ce7f891fe7a64118bbb34a34b9c
SHA12aba3c06942273aebc5e616602620e4b2526ebe7
SHA25676d3e6c51702b37227b73a4f84771e44d7c1a8551b4c1fdd90e341f03a805346
SHA5120e900eff9109ac2f32137d9d18993a29ed6065299ef96554f2288128fe07d1e8db1a0dac29b39b0eb05bb8a9bdca5f083da8e25dec3c880ef155401fd649107b
-
C:\Users\Admin\Desktop\New folder\Resources\TabIcons\network.pngFilesize
230B
MD548780574121d519661c2e0bc51b25b68
SHA189d8d5e42fbae3d95c8036c1738656b8e6343091
SHA25628f4c682d85fb4ef531a71b7fed8f0d7ef548f1126da378aaf60349219a681d6
SHA5127f0d9b6e18b812350b9d57439069ebb9140365830ea6fa247527f793cc58271ed7743c514d7488f026064b6d44afaf93717192bcff3ea8a3b501f2bf7718ff30
-
C:\Users\Admin\Desktop\New folder\Resources\TabIcons\plugins.pngFilesize
14KB
MD53191ca0269497a9566299585d427bc15
SHA17db0caabd0a466730b264d07c8cceeb62648788c
SHA256e60d5bbd1aaa36e731ef53f09dd4b010a041dd7c346c4f3ae0b824f63c37959f
SHA5126d76f44efea93a2f43e3d9ac11bb97d279a9d3fe668382c2e747ec5bcc0e48d5decf59e2772058e804bf32bc74f4b0380db8dcd0f652073661e68abcbe5adb08
-
C:\Users\Admin\Desktop\New folder\Resources\TabIcons\system.pngFilesize
273B
MD59993c66f33d16d11e701abbabf5a5db8
SHA1415a0069f21dc5fcbb7bdaa7f17a679eb18e6b1e
SHA25624c4edf86254f9e2359508909ba52dd683e1f6af0d8c1a52f875c472fc73bd40
SHA5127a3f0546f4fb12e72fd774f5c4446e8bcc2a26c762aad91675c3bc10931c1c0ac2c40d66a25afd0a376ab665427164367c1cf398c22811eedf88c90ce51a23e7
-
C:\Users\Admin\Desktop\New folder\ServerPlugin.dllFilesize
28KB
MD5952c62ec830c63380beb72ad923d35dc
SHA16700baa1fb1877129e79402dfe237f0b84221b69
SHA2562e5fbfb7932b117a2f6093dc346cdee4a5702e39739d9c40d27bfd1580f6f0d7
SHA5125dc19d7d6ab7670ded766f357e481328c8df4a96ac3c2a00194a5ccea8c34bca0e34cfea3d9d17934db384d302446be2fec9853438371561d70580665bffe121
-
C:\Users\Admin\Desktop\New folder\System.Data.SQLite.dllFilesize
256KB
MD5dd3d6f00b1aba3f1d9338d9727ab5f17
SHA1faf9364a7ab15f27c93a6e6f97fa025030c9dad7
SHA256f0d4beab24e94e61f219df451d90dbba3d0f48539f9b6a448f91e0c94b4e80c4
SHA5120794d850a133a98affe627e3023114b229b982e507d366895ece6a1ef99b42d708554c64b52f0f2ed63673e1c5aeea7e794085d45f0797159e21ba4efdf23cd7
-
C:\Users\Admin\Desktop\New folder\builder.logFilesize
1KB
MD5f4becbf84fa42ff104b05106513289e3
SHA1113653be7db0946372dd1ec4f9be6c9421443b8b
SHA25671ad3a3f04e6869cfd4387913d0ba5e9c35125a03e852db5d87ff3dcd7e5760f
SHA5125319552bd767c72aeb8b578df9ff75d20fab839b813dc92b2d2ec98c6ea8c028069fcd5719d1e8b07be863e8df6ea2f2f56a0f2a283f1da02ea7fdbab613fed6
-
C:\Users\Admin\Desktop\New folder\client.binFilesize
130KB
MD5906a949e34472f99ba683eff21907231
SHA17c5a57af209597fa6c6bce7d1a8016b936d3b0b6
SHA2569d3ea5af7dc261bf93c76f55d702a315aa22fb241e4207dc86cd834c262245c8
SHA51229fd20ae7f1b8bac831c0bb85da4325a62e10961989e14299f5f50776c8f7e669cc1527bf2c3868bd7230e73ac110ba8b1f0491ac0f2923d79d7a2871c7c961d
-
C:\Users\Admin\Desktop\New folder\crack.exeFilesize
18KB
MD52a62b2d78f2c0f2efd39f07641d231e1
SHA130e17f27edb951a306fd907e37aacc170bf3c7be
SHA256b4b1dd5fc206b0089ca1e7d613d6475a9a06bbcf4c207830d7c0cf02a94ae79a
SHA5124246bb79753f803aaeef24ec6bb9f5ec23859f2cc24d3cfb58c901722cd089b98cf8a2eae6763d18f1a2a330f71887aa8dfbfbd2bb92865680c2f1135a371ca5
-
C:\Users\Admin\Desktop\New folder\crack.exeFilesize
18KB
MD52a62b2d78f2c0f2efd39f07641d231e1
SHA130e17f27edb951a306fd907e37aacc170bf3c7be
SHA256b4b1dd5fc206b0089ca1e7d613d6475a9a06bbcf4c207830d7c0cf02a94ae79a
SHA5124246bb79753f803aaeef24ec6bb9f5ec23859f2cc24d3cfb58c901722cd089b98cf8a2eae6763d18f1a2a330f71887aa8dfbfbd2bb92865680c2f1135a371ca5
-
C:\Users\Admin\Desktop\New folder\plugins.binFilesize
240B
MD55e709fc806e8ba3385487699004f6d29
SHA12f32547ed5b9db3b33969fb4858945610aaeedb2
SHA2569ecbf989dedf1403db953fb4e5955c9f63415cbe1f6492c3246bac405a4d036f
SHA512a6706c9f76d837a7e0ab12e3c1c6d94fedde9dc52d4fecd02befd8850752155e2bf801cdf0488a98e49c50c4f0595a3fc4916950badba9bb83a5b7a35d3ffaab
-
C:\Users\Admin\Desktop\New folder\public.binFilesize
17B
MD5602d0cc4e7246f8a3b8a5ee9c7fabe30
SHA1e9ecc8f782cf27ae68339b0cdfd0f79c69aa4afc
SHA2566de29ee3e660fd3ab419f568fcf65f8418484eb43d5bfcdbfac5d456fd8488f2
SHA512ccaf306f4e4b4ee7de6a62954bbebcb52d131da49912d2d6ad39d07012dffe66ec6109dfbd5fbfd166e98e7bcb2c564b75eda0a2eda2ee815f71db5986506f43
-
C:\Users\Admin\Desktop\New folder\server.logFilesize
26KB
MD594b077234490a33228a743a400eddbb7
SHA135e68deb6aed1bd130f1cfeff7a1cce475a47e8f
SHA25661b45afd63d8adf0a44751b3bac3c63f6810e2dad903108c79d59060480fc328
SHA512f03b669cc2ea58c3054ff197d2fe6b34bc7d75a32b79a182709e227020f17bffbf95028d8101b5e7bfed628c71132d8af1854eaf9b2751b5d2c367f21ada8c5d
-
C:\Users\Admin\Desktop\New folder\settings.binFilesize
80B
MD53cd80f795614c7729c04d899ee49cd28
SHA168aa14cd23ac7952e302e10e7aef50781937f1fd
SHA256bd7bd09555fecfac76bdf7efc5d0e71f43ec5615796c765b8b8279d7ff3433ef
SHA512b8496274b2fe37da7248d4e25c56ad6157c197d224627a1cb5639d67cd49e8db0e5012820c560d96d8ef76a1d7e25de25ad78e0cce6392b3fc46a9e590786b4c
-
C:\Users\Admin\Desktop\New folder\x86\SQLite.Interop.dllFilesize
792KB
MD59b19dcee960dc215e64b1d82348707a9
SHA19c1e0f76673eb385787120e17404df179316ca2b
SHA2563515f704b0012c01fc8be5b717905c0587b29255fc9eb7ad3f2b66a130691d38
SHA512cc1304ab171feb2ac6df941f4b35aab8ce7b503f96b5539b366b39268cce8b21ea2fdbce16eff809a9a121a60a65ebbd0f59f75360800f541b9e5f93e729a55d
-
\Users\Admin\Desktop\New folder\ClientPlugin.dllFilesize
19KB
MD5bdc8945f1d799c845408522e372d1dbd
SHA1874b7c3c97cc5b13b9dd172fec5a54bc1f258005
SHA25661e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403
SHA5124fa0ed4ef66e4c442f5fc628e8bfc8a4f84cb213210643996d9387027edb619c054f6104ac889ae77cece09f0304f95d5f20e14d66847e2d382ef51eecec0962
-
\Users\Admin\Desktop\New folder\ClientPlugin.dllFilesize
19KB
MD5bdc8945f1d799c845408522e372d1dbd
SHA1874b7c3c97cc5b13b9dd172fec5a54bc1f258005
SHA25661e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403
SHA5124fa0ed4ef66e4c442f5fc628e8bfc8a4f84cb213210643996d9387027edb619c054f6104ac889ae77cece09f0304f95d5f20e14d66847e2d382ef51eecec0962
-
\Users\Admin\Desktop\New folder\ClientPlugin.dllFilesize
19KB
MD5bdc8945f1d799c845408522e372d1dbd
SHA1874b7c3c97cc5b13b9dd172fec5a54bc1f258005
SHA25661e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403
SHA5124fa0ed4ef66e4c442f5fc628e8bfc8a4f84cb213210643996d9387027edb619c054f6104ac889ae77cece09f0304f95d5f20e14d66847e2d382ef51eecec0962
-
\Users\Admin\Desktop\New folder\ClientPlugin.dllFilesize
19KB
MD5bdc8945f1d799c845408522e372d1dbd
SHA1874b7c3c97cc5b13b9dd172fec5a54bc1f258005
SHA25661e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403
SHA5124fa0ed4ef66e4c442f5fc628e8bfc8a4f84cb213210643996d9387027edb619c054f6104ac889ae77cece09f0304f95d5f20e14d66847e2d382ef51eecec0962
-
\Users\Admin\Desktop\New folder\ServerPlugin.dllFilesize
28KB
MD5952c62ec830c63380beb72ad923d35dc
SHA16700baa1fb1877129e79402dfe237f0b84221b69
SHA2562e5fbfb7932b117a2f6093dc346cdee4a5702e39739d9c40d27bfd1580f6f0d7
SHA5125dc19d7d6ab7670ded766f357e481328c8df4a96ac3c2a00194a5ccea8c34bca0e34cfea3d9d17934db384d302446be2fec9853438371561d70580665bffe121
-
\Users\Admin\Desktop\New folder\ServerPlugin.dllFilesize
28KB
MD5952c62ec830c63380beb72ad923d35dc
SHA16700baa1fb1877129e79402dfe237f0b84221b69
SHA2562e5fbfb7932b117a2f6093dc346cdee4a5702e39739d9c40d27bfd1580f6f0d7
SHA5125dc19d7d6ab7670ded766f357e481328c8df4a96ac3c2a00194a5ccea8c34bca0e34cfea3d9d17934db384d302446be2fec9853438371561d70580665bffe121
-
\Users\Admin\Desktop\New folder\ServerPlugin.dllFilesize
28KB
MD5952c62ec830c63380beb72ad923d35dc
SHA16700baa1fb1877129e79402dfe237f0b84221b69
SHA2562e5fbfb7932b117a2f6093dc346cdee4a5702e39739d9c40d27bfd1580f6f0d7
SHA5125dc19d7d6ab7670ded766f357e481328c8df4a96ac3c2a00194a5ccea8c34bca0e34cfea3d9d17934db384d302446be2fec9853438371561d70580665bffe121
-
\Users\Admin\Desktop\New folder\ServerPlugin.dllFilesize
28KB
MD5952c62ec830c63380beb72ad923d35dc
SHA16700baa1fb1877129e79402dfe237f0b84221b69
SHA2562e5fbfb7932b117a2f6093dc346cdee4a5702e39739d9c40d27bfd1580f6f0d7
SHA5125dc19d7d6ab7670ded766f357e481328c8df4a96ac3c2a00194a5ccea8c34bca0e34cfea3d9d17934db384d302446be2fec9853438371561d70580665bffe121
-
\Users\Admin\Desktop\New folder\System.Data.SQLite.dllFilesize
256KB
MD5dd3d6f00b1aba3f1d9338d9727ab5f17
SHA1faf9364a7ab15f27c93a6e6f97fa025030c9dad7
SHA256f0d4beab24e94e61f219df451d90dbba3d0f48539f9b6a448f91e0c94b4e80c4
SHA5120794d850a133a98affe627e3023114b229b982e507d366895ece6a1ef99b42d708554c64b52f0f2ed63673e1c5aeea7e794085d45f0797159e21ba4efdf23cd7
-
\Users\Admin\Desktop\New folder\System.Data.SQLite.dllFilesize
256KB
MD5dd3d6f00b1aba3f1d9338d9727ab5f17
SHA1faf9364a7ab15f27c93a6e6f97fa025030c9dad7
SHA256f0d4beab24e94e61f219df451d90dbba3d0f48539f9b6a448f91e0c94b4e80c4
SHA5120794d850a133a98affe627e3023114b229b982e507d366895ece6a1ef99b42d708554c64b52f0f2ed63673e1c5aeea7e794085d45f0797159e21ba4efdf23cd7
-
\Users\Admin\Desktop\New folder\System.Data.SQLite.dllFilesize
256KB
MD5dd3d6f00b1aba3f1d9338d9727ab5f17
SHA1faf9364a7ab15f27c93a6e6f97fa025030c9dad7
SHA256f0d4beab24e94e61f219df451d90dbba3d0f48539f9b6a448f91e0c94b4e80c4
SHA5120794d850a133a98affe627e3023114b229b982e507d366895ece6a1ef99b42d708554c64b52f0f2ed63673e1c5aeea7e794085d45f0797159e21ba4efdf23cd7
-
\Users\Admin\Desktop\New folder\System.Data.SQLite.dllFilesize
256KB
MD5dd3d6f00b1aba3f1d9338d9727ab5f17
SHA1faf9364a7ab15f27c93a6e6f97fa025030c9dad7
SHA256f0d4beab24e94e61f219df451d90dbba3d0f48539f9b6a448f91e0c94b4e80c4
SHA5120794d850a133a98affe627e3023114b229b982e507d366895ece6a1ef99b42d708554c64b52f0f2ed63673e1c5aeea7e794085d45f0797159e21ba4efdf23cd7
-
\Users\Admin\Desktop\New folder\x86\SQLite.Interop.dllFilesize
792KB
MD59b19dcee960dc215e64b1d82348707a9
SHA19c1e0f76673eb385787120e17404df179316ca2b
SHA2563515f704b0012c01fc8be5b717905c0587b29255fc9eb7ad3f2b66a130691d38
SHA512cc1304ab171feb2ac6df941f4b35aab8ce7b503f96b5539b366b39268cce8b21ea2fdbce16eff809a9a121a60a65ebbd0f59f75360800f541b9e5f93e729a55d
-
memory/2728-263-0x0000000073D30000-0x00000000742E0000-memory.dmpFilesize
5.7MB
-
memory/2728-396-0x000000000129A000-0x000000000129F000-memory.dmpFilesize
20KB
-
memory/2728-392-0x000000000129A000-0x000000000129F000-memory.dmpFilesize
20KB
-
memory/2728-395-0x0000000073D30000-0x00000000742E0000-memory.dmpFilesize
5.7MB
-
memory/2728-391-0x0000000073D30000-0x00000000742E0000-memory.dmpFilesize
5.7MB
-
memory/2728-390-0x000000000129A000-0x000000000129F000-memory.dmpFilesize
20KB
-
memory/4584-162-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-123-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-131-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-133-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-134-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-132-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-181-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-180-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-179-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-178-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-177-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-176-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-175-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-174-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-173-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-172-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-129-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-171-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-169-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-170-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-168-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-167-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-166-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-165-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-128-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-127-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-126-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-125-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-124-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-163-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-164-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-161-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-118-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-130-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-122-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-121-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-160-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-159-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-158-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-157-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-156-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-155-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-154-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-120-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-153-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-152-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-151-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-150-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-119-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-149-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-148-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-147-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-146-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-145-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-144-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-143-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-142-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-141-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-140-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-139-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-138-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-137-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-136-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4584-135-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/4688-207-0x0000000000000000-mapping.dmp
-
memory/4688-211-0x00000000001F0000-0x00000000001FC000-memory.dmpFilesize
48KB