c56e935232fa91e05add4c3320dc9323150b19a7161a0c17bdec7feff3c1bb19

Analysis

max time kernel
71s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/12/2022, 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_UAM-4.3.exe
Size

7.5MB
MD5

2954fb716499ea044d603a657f640a10
SHA1

5ff33032c66ef86de6333ab49ca9cb88f714073d
SHA256

c56e935232fa91e05add4c3320dc9323150b19a7161a0c17bdec7feff3c1bb19
SHA512

35e862e0642ca484bce1d4953514249c1f74d8b5269dbe6cf3fa44dc20e41cfd34b0f7d2ad00c10fcaa2bb2123305499fd8722ffd22b33f0d5e7a286b7be4d66
SSDEEP

196608:IABChm0D6EGFWCmvsBiTlA1aHzEadEI7huiTtKNd:INmm6XFWmLawYGipKNd

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2012	setup_UAM-4.3.tmp
520	FontsInstaller.exe
1336	UBNT-M-TOOLKIT2.exe

Loads dropped DLL 6 IoCs

pid	Process
1284	setup_UAM-4.3.exe
2012	setup_UAM-4.3.tmp
2012	setup_UAM-4.3.tmp
2012	setup_UAM-4.3.tmp
1336	UBNT-M-TOOLKIT2.exe
1336	UBNT-M-TOOLKIT2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-E2BSN.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-53JQN.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-1H95F.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\en\is-O9PGV.tmp	setup_UAM-4.3.tmp
File opened for modification	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\es\Updater.resources.dll	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\unins000.dat	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-7RQ4B.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-JUPIH.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-ABL95.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-RD1ED.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-37P1F.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-8IG07.tmp	setup_UAM-4.3.tmp
File opened for modification	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\HtmlAgilityPack.dll	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-QM8BE.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-I9NJR.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-C9EK2.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-S2UB0.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-N3G8L.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-2H9RJ.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-T6AG8.tmp	setup_UAM-4.3.tmp
File opened for modification	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\unins000.dat	setup_UAM-4.3.tmp
File opened for modification	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\Renci.SshNet.dll	setup_UAM-4.3.tmp
File opened for modification	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\es\UBNT-M-TOOLKIT2.resources.dll	setup_UAM-4.3.tmp
File opened for modification	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\SecureBlackbox.SSHCommon.dll	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-N9FK0.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-EHKNP.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-JMT44.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-LUMQR.tmp	setup_UAM-4.3.tmp
File opened for modification	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\Updater.exe	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-8QM8D.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-GPCIP.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-AK8G8.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-OEIP3.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-5ET3R.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-U6B4M.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-36SAT.tmp	setup_UAM-4.3.tmp
File opened for modification	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\SecureBlackbox.SSHClient.dll	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-MTJBM.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-1PHGN.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-FUJ6O.tmp	setup_UAM-4.3.tmp
File opened for modification	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\UBNT-M-TOOLKIT2.exe	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-B1I8F.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-LF32T.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-K6T58.tmp	setup_UAM-4.3.tmp
File opened for modification	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\FontsInstaller.exe	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-8806Q.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-L6N1K.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-LGSRB.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-NMLBT.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-QFREG.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-5NSVG.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-RNT2V.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-HQCTM.tmp	setup_UAM-4.3.tmp
File opened for modification	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\MadMilkman.Ini.dll	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-VF9KF.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\es\is-UE57J.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-U90SB.tmp	setup_UAM-4.3.tmp
File opened for modification	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\en\UBNT-M-TOOLKIT2.resources.dll	setup_UAM-4.3.tmp
File opened for modification	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\Bunifu_UI_v1.5.3.dll	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\is-54BKL.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-ROI64.tmp	setup_UAM-4.3.tmp
File opened for modification	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\SecureBlackbox.dll	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-02REQ.tmp	setup_UAM-4.3.tmp
File created	C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\is-VBS5O.tmp	setup_UAM-4.3.tmp

Drops file in Windows directory 34 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\Lato-MediumItalic.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\Lato-BlackItalic.ttf	cmd.exe
File created	C:\Windows\Fonts\Lato-HeavyItalic.ttf	cmd.exe
File created	C:\Windows\Fonts\Lato-LightItalic.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\Lato-BoldItalic.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\Lato-HairlineItalic.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\Lato-SemiboldItalic.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\Lato-Hairline.ttf	cmd.exe
File created	C:\Windows\Fonts\Lato-Regular.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\Lato-Light.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\Lato-Medium.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\Lato-MediumItalic.ttf	cmd.exe
File created	C:\Windows\Fonts\Lato-Thin.ttf	cmd.exe
File created	C:\Windows\Fonts\Lato-BlackItalic.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\Lato-Heavy.ttf	cmd.exe
File created	C:\Windows\Fonts\Lato-HairlineItalic.ttf	cmd.exe
File created	C:\Windows\Fonts\Lato-Light.ttf	cmd.exe
File created	C:\Windows\Fonts\Lato-Medium.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\Lato-Thin.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\Lato-Bold.ttf	cmd.exe
File created	C:\Windows\Fonts\Lato-Hairline.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\Lato-LightItalic.ttf	cmd.exe
File created	C:\Windows\Fonts\Lato-Heavy.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\Lato-HeavyItalic.ttf	cmd.exe
File created	C:\Windows\Fonts\Lato-BoldItalic.ttf	cmd.exe
File created	C:\Windows\Fonts\Lato-SemiboldItalic.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\Lato-ThinItalic.ttf	cmd.exe
File created	C:\Windows\Fonts\Lato-Black.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\Lato-Black.ttf	cmd.exe
File created	C:\Windows\Fonts\Lato-Semibold.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\Lato-Semibold.ttf	cmd.exe
File created	C:\Windows\Fonts\Lato-ThinItalic.ttf	cmd.exe
File created	C:\Windows\Fonts\Lato-Bold.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\Lato-Regular.ttf	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2012	setup_UAM-4.3.tmp
2012	setup_UAM-4.3.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1336	UBNT-M-TOOLKIT2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	setup_UAM-4.3.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 2012	1284	setup_UAM-4.3.exe	28
PID 1284 wrote to memory of 2012	1284	setup_UAM-4.3.exe	28
PID 1284 wrote to memory of 2012	1284	setup_UAM-4.3.exe	28
PID 1284 wrote to memory of 2012	1284	setup_UAM-4.3.exe	28
PID 1284 wrote to memory of 2012	1284	setup_UAM-4.3.exe	28
PID 1284 wrote to memory of 2012	1284	setup_UAM-4.3.exe	28
PID 1284 wrote to memory of 2012	1284	setup_UAM-4.3.exe	28
PID 2012 wrote to memory of 520	2012	setup_UAM-4.3.tmp	29
PID 2012 wrote to memory of 520	2012	setup_UAM-4.3.tmp	29
PID 2012 wrote to memory of 520	2012	setup_UAM-4.3.tmp	29
PID 2012 wrote to memory of 520	2012	setup_UAM-4.3.tmp	29
PID 2012 wrote to memory of 520	2012	setup_UAM-4.3.tmp	29
PID 2012 wrote to memory of 520	2012	setup_UAM-4.3.tmp	29
PID 2012 wrote to memory of 520	2012	setup_UAM-4.3.tmp	29
PID 520 wrote to memory of 1840	520	FontsInstaller.exe	30
PID 520 wrote to memory of 1840	520	FontsInstaller.exe	30
PID 520 wrote to memory of 1840	520	FontsInstaller.exe	30
PID 520 wrote to memory of 1840	520	FontsInstaller.exe	30
PID 1840 wrote to memory of 1976	1840	cmd.exe	32
PID 1840 wrote to memory of 1976	1840	cmd.exe	32
PID 1840 wrote to memory of 1976	1840	cmd.exe	32
PID 1840 wrote to memory of 1976	1840	cmd.exe	32
PID 1840 wrote to memory of 1508	1840	cmd.exe	33
PID 1840 wrote to memory of 1508	1840	cmd.exe	33
PID 1840 wrote to memory of 1508	1840	cmd.exe	33
PID 1840 wrote to memory of 1508	1840	cmd.exe	33
PID 1840 wrote to memory of 1604	1840	cmd.exe	34
PID 1840 wrote to memory of 1604	1840	cmd.exe	34
PID 1840 wrote to memory of 1604	1840	cmd.exe	34
PID 1840 wrote to memory of 1604	1840	cmd.exe	34
PID 1840 wrote to memory of 1520	1840	cmd.exe	35
PID 1840 wrote to memory of 1520	1840	cmd.exe	35
PID 1840 wrote to memory of 1520	1840	cmd.exe	35
PID 1840 wrote to memory of 1520	1840	cmd.exe	35
PID 1840 wrote to memory of 916	1840	cmd.exe	36
PID 1840 wrote to memory of 916	1840	cmd.exe	36
PID 1840 wrote to memory of 916	1840	cmd.exe	36
PID 1840 wrote to memory of 916	1840	cmd.exe	36
PID 1840 wrote to memory of 968	1840	cmd.exe	37
PID 1840 wrote to memory of 968	1840	cmd.exe	37
PID 1840 wrote to memory of 968	1840	cmd.exe	37
PID 1840 wrote to memory of 968	1840	cmd.exe	37
PID 1840 wrote to memory of 1572	1840	cmd.exe	38
PID 1840 wrote to memory of 1572	1840	cmd.exe	38
PID 1840 wrote to memory of 1572	1840	cmd.exe	38
PID 1840 wrote to memory of 1572	1840	cmd.exe	38
PID 1840 wrote to memory of 1744	1840	cmd.exe	39
PID 1840 wrote to memory of 1744	1840	cmd.exe	39
PID 1840 wrote to memory of 1744	1840	cmd.exe	39
PID 1840 wrote to memory of 1744	1840	cmd.exe	39
PID 1840 wrote to memory of 1932	1840	cmd.exe	40
PID 1840 wrote to memory of 1932	1840	cmd.exe	40
PID 1840 wrote to memory of 1932	1840	cmd.exe	40
PID 1840 wrote to memory of 1932	1840	cmd.exe	40
PID 1840 wrote to memory of 1780	1840	cmd.exe	41
PID 1840 wrote to memory of 1780	1840	cmd.exe	41
PID 1840 wrote to memory of 1780	1840	cmd.exe	41
PID 1840 wrote to memory of 1780	1840	cmd.exe	41
PID 1840 wrote to memory of 1012	1840	cmd.exe	42
PID 1840 wrote to memory of 1012	1840	cmd.exe	42
PID 1840 wrote to memory of 1012	1840	cmd.exe	42
PID 1840 wrote to memory of 1012	1840	cmd.exe	42
PID 1840 wrote to memory of 1608	1840	cmd.exe	43
PID 1840 wrote to memory of 1608	1840	cmd.exe	43

C:\Users\Admin\AppData\Local\Temp\setup_UAM-4.3.exe
"C:\Users\Admin\AppData\Local\Temp\setup_UAM-4.3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Local\Temp\is-G8VBC.tmp\setup_UAM-4.3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-G8VBC.tmp\setup_UAM-4.3.tmp" /SL5="$70122,6917631,891904,C:\Users\Admin\AppData\Local\Temp\setup_UAM-4.3.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\FontsInstaller.exe
    "C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\FontsInstaller.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:520
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\install-fonts-min.cmd"
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1840
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Black (TrueType)" /f
        5⤵
        
        PID:1976
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Black (TrueType)" /f
        5⤵
        
        PID:1508
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Black (TrueType)" /t REG_SZ /d Lato-Black.ttf /f
        5⤵
        
        PID:1604
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Black (TrueType)" /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\Lato-Black.ttf /f
        5⤵
        
        PID:1520
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Black Italic (TrueType)" /f
        5⤵
        
        PID:916
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Black Italic (TrueType)" /f
        5⤵
        
        PID:968
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Black Italic (TrueType)" /t REG_SZ /d Lato-BlackItalic.ttf /f
        5⤵
        
        PID:1572
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Black Italic (TrueType)" /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\Lato-BlackItalic.ttf /f
        5⤵
        
        PID:1744
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Bold (TrueType)" /f
        5⤵
        
        PID:1932
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Bold (TrueType)" /f
        5⤵
        
        PID:1780
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Bold (TrueType)" /t REG_SZ /d Lato-Bold.ttf /f
        5⤵
        
        PID:1012
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Bold (TrueType)" /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\Lato-Bold.ttf /f
        5⤵
        
        PID:1608
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Bold Italic (TrueType)" /f
        5⤵
        
        PID:816
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Bold Italic (TrueType)" /f
        5⤵
        
        PID:2044
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Bold Italic (TrueType)" /t REG_SZ /d Lato-BoldItalic.ttf /f
        5⤵
        
        PID:868
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Bold Italic (TrueType)" /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\Lato-BoldItalic.ttf /f
        5⤵
        
        PID:1736
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Hairline (TrueType)" /f
        5⤵
        
        PID:1972
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Hairline (TrueType)" /f
        5⤵
        
        PID:812
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Hairline (TrueType)" /t REG_SZ /d Lato-Hairline.ttf /f
        5⤵
        
        PID:836
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Hairline (TrueType)" /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\Lato-Hairline.ttf /f
        5⤵
        
        PID:620
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Hairline Italic (TrueType)" /f
        5⤵
        
        PID:1376
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Hairline Italic (TrueType)" /f
        5⤵
        
        PID:1816
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Hairline Italic (TrueType)" /t REG_SZ /d Lato-HairlineItalic.ttf /f
        5⤵
        
        PID:1532
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Hairline Italic (TrueType)" /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\Lato-HairlineItalic.ttf /f
        5⤵
        
        PID:956
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Heavy (TrueType)" /f
        5⤵
        
        PID:1864
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Heavy (TrueType)" /f
        5⤵
        
        PID:900
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Heavy (TrueType)" /t REG_SZ /d Lato-Heavy.ttf /f
        5⤵
        
        PID:1028
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Heavy (TrueType)" /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\Lato-Heavy.ttf /f
        5⤵
        
        PID:2036
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Heavy Italic (TrueType)" /f
        5⤵
        
        PID:1588
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Heavy Italic (TrueType)" /f
        5⤵
        
        PID:1808
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Heavy Italic (TrueType)" /t REG_SZ /d Lato-HeavyItalic.ttf /f
        5⤵
        
        PID:2020
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Heavy Italic (TrueType)" /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\Lato-HeavyItalic.ttf /f
        5⤵
        
        PID:600
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Light (TrueType)" /f
        5⤵
        
        PID:1032
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Light (TrueType)" /f
        5⤵
        
        PID:1344
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Light (TrueType)" /t REG_SZ /d Lato-Light.ttf /f
        5⤵
        
        PID:756
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Light (TrueType)" /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\Lato-Light.ttf /f
        5⤵
        
        PID:960
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Light Italic (TrueType)" /f
        5⤵
        
        PID:1340
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Light Italic (TrueType)" /f
        5⤵
        
        PID:1680
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Light Italic (TrueType)" /t REG_SZ /d Lato-LightItalic.ttf /f
        5⤵
        
        PID:1304
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Light Italic (TrueType)" /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\Lato-LightItalic.ttf /f
        5⤵
        
        PID:1420
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Medium (TrueType)" /f
        5⤵
        
        PID:1896
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Medium (TrueType)" /f
        5⤵
        
        PID:2008
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Medium (TrueType)" /t REG_SZ /d Lato-Medium.ttf /f
        5⤵
        
        PID:1880
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Medium (TrueType)" /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\Lato-Medium.ttf /f
        5⤵
        
        PID:2032
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Medium Italic (TrueType)" /f
        5⤵
        
        PID:1484
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Medium Italic (TrueType)" /f
        5⤵
        
        PID:1408
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Medium Italic (TrueType)" /t REG_SZ /d Lato-MediumItalic.ttf /f
        5⤵
        
        PID:1508
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Medium Italic (TrueType)" /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\Lato-MediumItalic.ttf /f
        5⤵
        
        PID:1604
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Regular (TrueType)" /f
        5⤵
        
        PID:1524
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Regular (TrueType)" /f
        5⤵
        
        PID:1804
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Regular (TrueType)" /t REG_SZ /d Lato-Regular.ttf /f
        5⤵
        
        PID:968
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Regular (TrueType)" /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\Lato-Regular.ttf /f
        5⤵
        
        PID:788
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Semibold (TrueType)" /f
        5⤵
        
        PID:1964
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Semibold (TrueType)" /f
        5⤵
        
        PID:1932
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Semibold (TrueType)" /t REG_SZ /d Lato-Semibold.ttf /f
        5⤵
        
        PID:1780
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Semibold (TrueType)" /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\Lato-Semibold.ttf /f
        5⤵
        
        PID:1012
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Semibold Italic (TrueType)" /f
        5⤵
        
        PID:964
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Semibold Italic (TrueType)" /f
        5⤵
        
        PID:816
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Semibold Italic (TrueType)" /t REG_SZ /d Lato-SemiboldItalic.ttf /f
        5⤵
        
        PID:2044
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Semibold Italic (TrueType)" /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\Lato-SemiboldItalic.ttf /f
        5⤵
        
        PID:868
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Thin (TrueType)" /f
        5⤵
        
        PID:1892
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Thin (TrueType)" /f
        5⤵
        
        PID:1972
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Thin (TrueType)" /t REG_SZ /d Lato-Thin.ttf /f
        5⤵
        
        PID:1388
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Thin (TrueType)" /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\Lato-Thin.ttf /f
        5⤵
        
        PID:824
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Thin Italic (TrueType)" /f
        5⤵
        
        PID:1948
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Thin Italic (TrueType)" /f
        5⤵
        
        PID:620
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Thin Italic (TrueType)" /t REG_SZ /d Lato-ThinItalic.ttf /f
        5⤵
        
        PID:1664
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /v "Lato Thin Italic (TrueType)" /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\Lato-ThinItalic.ttf /f
        5⤵
        
        PID:1376

C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\UBNT-M-TOOLKIT2.exe
"C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\UBNT-M-TOOLKIT2.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\UBNT-M-TOOLKIT2.exe

Filesize
1.9MB

MD5
259bac0f25904bb5a64d8b4de4e9fdaf

SHA1
cf1dcd453f2d16c6d36c7e9127601efcda7c3ab0

SHA256
b3d21b62242c0dffb2b61360cdaceaa2115195c1ad455c1a348491ff07b5c024

SHA512
966f2f87623428217ea44a0630560b5fdaaa5d749b647afc00d0e1eb5ac6843ddb0a5757ed2ee4ebd3e277c3deb28931a18ac11d10a53cad40dab42e27a7cc53

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\UBNT-M-TOOLKIT2.exe

Filesize
1.9MB

MD5
259bac0f25904bb5a64d8b4de4e9fdaf

SHA1
cf1dcd453f2d16c6d36c7e9127601efcda7c3ab0

SHA256
b3d21b62242c0dffb2b61360cdaceaa2115195c1ad455c1a348491ff07b5c024

SHA512
966f2f87623428217ea44a0630560b5fdaaa5d749b647afc00d0e1eb5ac6843ddb0a5757ed2ee4ebd3e277c3deb28931a18ac11d10a53cad40dab42e27a7cc53

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\UBNT-M-TOOLKIT2.exe.config

Filesize
1KB

MD5
16f99702e9e8aa7f092248e9032b10e0

SHA1
ed48adc90f13edb6174e2c1eb847f179fe768a26

SHA256
cec8cc38ebc14fca87009ec31700cb453a1fa409a4587da465492d2fca06661d

SHA512
f6e0e9e12a5a4ca5434e858c57cd110f7e87867e95dd8c56ed9e5bb6a10fc275ce22d0cf91f673076aaceccb036eebe3be8ffe66e1d915ca3bb25767dd229873

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\en\UBNT-M-TOOLKIT2.resources.dll

Filesize
368KB

MD5
3907fe1f966516223cd3d8937fd35a14

SHA1
f0d372c9ba132807c8f62117c89d4e8f41ab3559

SHA256
feb398766184ad2b0fbf017b5545238a0a612e4e150d567c064e993baebce094

SHA512
91be3b5111c9b05b521566b1fc3f2a39963ecfd0ee844c8bb9c0e95f79e010e6cdaa8499d4114aae2ac5b7d08af661bbfcb49e9fb42ac9710e0c548b26df7f47

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\FontsInstaller.exe

Filesize
225KB

MD5
3f1f544ae6ebd67aea99497b158112c0

SHA1
8952308d272668a6a245d7cfb0dc5373af58c57c

SHA256
127bff14e7db4fe31a32ae872746d91a4983a679abf4254eb99165ba6dc7de2a

SHA512
6c66549d81be713af6eb99d0410a927d6763a563558ce9e8bb126d0bfe2bca5a547cfc2cc22c6ab60f5db806ae38d5d434a0d3c6e40b149d1b35504c48822d57

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\FontsInstaller.exe

Filesize
225KB

MD5
3f1f544ae6ebd67aea99497b158112c0

SHA1
8952308d272668a6a245d7cfb0dc5373af58c57c

SHA256
127bff14e7db4fe31a32ae872746d91a4983a679abf4254eb99165ba6dc7de2a

SHA512
6c66549d81be713af6eb99d0410a927d6763a563558ce9e8bb126d0bfe2bca5a547cfc2cc22c6ab60f5db806ae38d5d434a0d3c6e40b149d1b35504c48822d57

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\FontsInstaller.exe.config

Filesize
183B

MD5
66f09a3993dcae94acfe39d45b553f58

SHA1
9d09f8e22d464f7021d7f713269b8169aed98682

SHA256
7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7

SHA512
c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\Lato-Black.ttf

Filesize
600KB

MD5
1233fdf19c04333c7f58af4eb8698452

SHA1
b9c952639741f5b7479e1ff6d1561a3df7e8f83a

SHA256
4ed66fa3928ae769205635c916b4f9e6a63f6a77f5d9693ac31a83d0d96ae1ef

SHA512
acbb19196f38df2ec4745428a03234b10e2a23ef3741ccd7eb0bb0fb8a709c5a8dd94fa6100148e82b6e6fce1a40ae173f14f8fb5ff518298ba3b1b76a18492e

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\Lato-BlackItalic.ttf

Filesize
656KB

MD5
e0d428e2113a119814da366401ad3362

SHA1
4bde1231ff7afccfdf4f77f086c0e9a93a4f3e46

SHA256
0ae5310fe1ed156ab6af26a8c0be61aee44c166896765d5a9473670ad9c28dbc

SHA512
827af8c2a8a6690f958353c12927d45e2882d1220ede2a3457ac454b08296379ef8034f45feeca42be8f830048f912c1f5c3a8bb27f7a2471d479e571b8d0804

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\Lato-Bold.ttf

Filesize
641KB

MD5
eb9532033c2adf99b1314611b5e9cd0e

SHA1
6b2c7b124cbf0aaeba48d57fb0fa19f2c6c69683

SHA256
bf1b8130069b44b9148eeece35e5423bedac49777ba746615b826b8276574a7b

SHA512
1eee7abf873a5d343250f324f8c176fd30ee3d5ea5fa840e0c9b275f15d314bb9d31eb8852a91e9970c1d9daa53d74ceff045f9d1397af9f401699b104fcce79

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\Lato-BoldItalic.ttf

Filesize
682KB

MD5
01577cc25f44d5cd3451a5e0da715917

SHA1
bf9e7d4a6185b53a256272869e66762c1e5d503b

SHA256
e2f9244fdcd20840f2480f91370cea885bf99230c49d153199fa64853ad74b69

SHA512
b7eb2d6988aecd4570b8505dd30db4a8da3d830d11d99d7bd1270f88589ec0a9b854bffadb795c4cb1365a1d8e46f9cd65ae44876cd71035e1aded7087fe6af9

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\Lato-Hairline.ttf

Filesize
571KB

MD5
a2e8f8eef2ec2047a32e2d6a152a0311

SHA1
79c1dd6a9c740ef36272a9742504864a6f912be7

SHA256
80dc280e8a05b80d7a566a15b379bba422a776e5bc58b92a9b8f3a9bbea7eb03

SHA512
5b8a1d54dad17ec3925b674acad1cbf18a572f806371c24993f0a347312bd21fa7c11b6804974f6dee44c440de43241e39b474c5848bb488a50fb5fc5b213555

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\Lato-HairlineItalic.ttf

Filesize
595KB

MD5
2bbb788763716d2d716cfcb5bc3e92f1

SHA1
ea271649cc2f58a61fc819c9ca82eb8724717a2f

SHA256
9e469d156b0471556f202358939cc7fd2cab421659e3a3638136431d3c46ec8b

SHA512
5e5fb7cb98ba0a2397a88e214e05d121039d8b2e6a239037062d058e4d33a5ddb01cf7b8f0a78ec8c583c5f36994e6eb274c7b78108fdf951c927fbc6d6d9e08

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\Lato-Heavy.ttf

Filesize
649KB

MD5
093466c99afdd5e38cfe3062dbcbba6b

SHA1
068af974d1346b61d9ee1e097374f2f3cac6c442

SHA256
4ce7ec20cd9c391b271b4149ad8cf5a71301d98965403f14fc5530d017146dbb

SHA512
4aabee3daf68e45090b5b16ce455ac22cca54af890ce38ff9a45b05f428a79255d1771c7f21ebce426ad0b8dd0aade16bc8aff3c7d6c61ef5622ba6705f34fe5

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\Lato-HeavyItalic.ttf

Filesize
682KB

MD5
bafcb4e83847db36fa96602c4abca98d

SHA1
f2d4047e1f5efd405b850abe23ccfdc2ceb1b3f8

SHA256
4c9af8df580f1b7a2e3336d69b225a38364a636dc014d8fd9c2b72adea68dd2d

SHA512
1edf4f70d291b146c7d81f74b4893f3b8d76213441fd305a16a3432de0d005ea03ef449d7adb8690a43c43356a9e3151beef251d1adfd21acde016aa8f986f14

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\Lato-Light.ttf

Filesize
629KB

MD5
90e1d3559ac52f7f0f77a86e1bfd632d

SHA1
a405c8288a8a90881407f93b6ee02b29e26a8735

SHA256
e9d59afb6d9cb9cf6e8d8159d4639d5b577e29efc64a15182f228659cfc1e818

SHA512
8c999f1b9fc238d925d87df4374f2c4cb4f57bd85a59fad82761f36d1e74cf65b85e64936d2a133e300e615d3f64535f50154dca94b3f80744f6d8cf70e18ba9

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\Lato-LightItalic.ttf

Filesize
642KB

MD5
7e9668b13f86893fb0a4a6e35965c107

SHA1
f05f3b58c5abd991036a1b43bd601556244ffe9e

SHA256
8926c41622b7400d7f6f7dbf31cea50495f31230cf40904b8b83e634bf3cf6c6

SHA512
48bc02e6bf3e50426bdca9b227ceef0ff530f3ee6113b4ed6edf3b3814238b93c8157d7016917aeed01e2d32f7c03a9702382e582d353bc13b36b9dea8b57958

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\Lato-Medium.ttf

Filesize
622KB

MD5
863b7dcd5ec2c3923122af25ce0f7e4c

SHA1
c78e94b7cc0b782eef4f9f2be371c3cf9c3f6eaf

SHA256
be8bbf7105500e8fc1f9429307fb396905a0e6cff63fe1eb751bb319d0f1b0db

SHA512
482964c6fe3f3f6ad35dcc6366fb1ef811087bc5af71f221e8f139749ecaced72a1377cfe483e2d049aaf266f3c2301ac899de126e3fb0a00150d1808dbc6cd6

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\Lato-MediumItalic.ttf

Filesize
679KB

MD5
ba4dbd0809f13b78b621a042efaed7d5

SHA1
df1a7160502d9e90c41b92b7243270a769904786

SHA256
0739be048a122e3abb0cb731b49f6c07ac212a54eb182ebaa25a65829d5ac0cf

SHA512
7695d4639518e4b55458daa850d82f64e409a4540be3a39211e620f1076a5651dc4d106b4ec8fde64e7eed9a1056de2701a3472ac89513d707bcfe61cfcf3633

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\Lato-Regular.ttf

Filesize
641KB

MD5
3b9b99039cc0a98dd50c3cbfac57ccb2

SHA1
f59f9e4f3cbee981a5e6f58a279f9b9613f22599

SHA256
6f6940be0835c3ddec9199e5fc42be4cbc61ebcfd58c623fdf719366253f1780

SHA512
2e81cb0ed1f26ded89d9756ec98a42581759d29bf605f964ea384c55112e7ad04a12e6d945310dde0098cea5459de5530e4f900d550b4605ec2762ce2a61d4ec

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\Lato-Semibold.ttf

Filesize
653KB

MD5
3c6cfb1aebd888a0eb4c8fba94140fa6

SHA1
96569e2cfcc3a298bb1aea21103d0d1e3c7e2ed4

SHA256
2dc5d31e2cf1e29f3430eb2dfa1ba9911e08ee401b61dd12f40e0acb047a17a3

SHA512
509abb792c29cf9433e46d087f005cf1358f5496faa9769f0c3dd3372428e465b9a12bc59ce61b8eafbca3e5f92724bd1d5692df24d51c154e247e57b9e0f985

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\Lato-SemiboldItalic.ttf

Filesize
681KB

MD5
c969278938eaacc998eab23bce2a1d0c

SHA1
8a34fbb379a096d4c5914a962a6f71e1721b40a7

SHA256
0aa594079c213d1dba417a2fc34b8170445d0f03af02a3b35f16b9b775eef398

SHA512
37aaca5c2fb2e4b4b7a4be98176f4b498cae41af534407e16eeba71d7cacd214a3f48d64c69ee002cef35e2abb027d0de49564c1d7e939018b790ada3537a208

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\Lato-Thin.ttf

Filesize
612KB

MD5
eb1635403cd764912ca1e0af78735797

SHA1
dbe1f622faef3ea3f286d848da6b10f104405060

SHA256
11b51a8bb6361be3e4642de40b49c210ecb4a19b8bf630f3335ff07813726f3b

SHA512
aa04eaf80d89487f12358cef8eeef0487b7924eb1aa735840416b9188f2f2b40e01184e5bbbe2fe9efd7d29cff3cd5cb85d39076166b5ccf30738a2a26bd14d0

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\Lato-ThinItalic.ttf

Filesize
638KB

MD5
29f53f3450c6691e4195d082647aa8ca

SHA1
8ce23025cf59e58b9bafdd8526d685d8347267c7

SHA256
c8ad5351e800f8286890a4c8a57d849207cb930287caeb40c4ffbe538f2f3e0e

SHA512
a94f32cbfa36d2d736800946cb255ad0e3877f15542e18d23dfc523aa208e1384d7cad861941878153945d2b0e8505fe7c1567dd03f35d254ddf297daa2d38d4

Download Submit
C:\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\install-fonts-min.cmd

Filesize
1KB

MD5
57d30f158ca81ba77a0139e8962f1433

SHA1
238f9d16ee62f6ccba07f6d17e108437172118e3

SHA256
d5eb6f9d626192cf9a9c7d5ffba6af0d1833072dec826baeaa540f09115b2313

SHA512
c1ced109ffcc70f7e0d4cb7e55b951a7a0b2996867a5e32884ae57042047bd5f3a9f6650570bd91d9d5753045e657a0ade24b13e6c22ae161d35d7ac9997dc09

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-G8VBC.tmp\setup_UAM-4.3.tmp

Filesize
3.0MB

MD5
dfd0a541b0c2006286f294753b291ed6

SHA1
3ae5729ab7d85e233da3c97eca391a4c2f9a4cdc

SHA256
9cb1d766c6e2a6a839e898b27ffd8b072ba92db02477a36b06bc9e826ec1511e

SHA512
b0e63c85ee357f21a25a074ee220b3e697a8a4fa750f22febf8dd5e415d5a080281be711b22776205d8c7cb733f398bd5462e66f3f7fa7f3880024393436d8a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-G8VBC.tmp\setup_UAM-4.3.tmp

Filesize
3.0MB

MD5
dfd0a541b0c2006286f294753b291ed6

SHA1
3ae5729ab7d85e233da3c97eca391a4c2f9a4cdc

SHA256
9cb1d766c6e2a6a839e898b27ffd8b072ba92db02477a36b06bc9e826ec1511e

SHA512
b0e63c85ee357f21a25a074ee220b3e697a8a4fa750f22febf8dd5e415d5a080281be711b22776205d8c7cb733f398bd5462e66f3f7fa7f3880024393436d8a7

Download Submit
C:\WINDOWS\FONTS\LATO-BLACK.TTF

Filesize
600KB

MD5
1233fdf19c04333c7f58af4eb8698452

SHA1
b9c952639741f5b7479e1ff6d1561a3df7e8f83a

SHA256
4ed66fa3928ae769205635c916b4f9e6a63f6a77f5d9693ac31a83d0d96ae1ef

SHA512
acbb19196f38df2ec4745428a03234b10e2a23ef3741ccd7eb0bb0fb8a709c5a8dd94fa6100148e82b6e6fce1a40ae173f14f8fb5ff518298ba3b1b76a18492e

Download Submit
C:\WINDOWS\FONTS\LATO-BLACKITALIC.TTF

Filesize
656KB

MD5
e0d428e2113a119814da366401ad3362

SHA1
4bde1231ff7afccfdf4f77f086c0e9a93a4f3e46

SHA256
0ae5310fe1ed156ab6af26a8c0be61aee44c166896765d5a9473670ad9c28dbc

SHA512
827af8c2a8a6690f958353c12927d45e2882d1220ede2a3457ac454b08296379ef8034f45feeca42be8f830048f912c1f5c3a8bb27f7a2471d479e571b8d0804

Download Submit
C:\WINDOWS\FONTS\LATO-BOLD.TTF

Filesize
641KB

MD5
eb9532033c2adf99b1314611b5e9cd0e

SHA1
6b2c7b124cbf0aaeba48d57fb0fa19f2c6c69683

SHA256
bf1b8130069b44b9148eeece35e5423bedac49777ba746615b826b8276574a7b

SHA512
1eee7abf873a5d343250f324f8c176fd30ee3d5ea5fa840e0c9b275f15d314bb9d31eb8852a91e9970c1d9daa53d74ceff045f9d1397af9f401699b104fcce79

Download Submit
C:\WINDOWS\FONTS\LATO-BOLDITALIC.TTF

Filesize
682KB

MD5
01577cc25f44d5cd3451a5e0da715917

SHA1
bf9e7d4a6185b53a256272869e66762c1e5d503b

SHA256
e2f9244fdcd20840f2480f91370cea885bf99230c49d153199fa64853ad74b69

SHA512
b7eb2d6988aecd4570b8505dd30db4a8da3d830d11d99d7bd1270f88589ec0a9b854bffadb795c4cb1365a1d8e46f9cd65ae44876cd71035e1aded7087fe6af9

Download Submit
C:\WINDOWS\FONTS\LATO-HAIRLINE.TTF

Filesize
571KB

MD5
a2e8f8eef2ec2047a32e2d6a152a0311

SHA1
79c1dd6a9c740ef36272a9742504864a6f912be7

SHA256
80dc280e8a05b80d7a566a15b379bba422a776e5bc58b92a9b8f3a9bbea7eb03

SHA512
5b8a1d54dad17ec3925b674acad1cbf18a572f806371c24993f0a347312bd21fa7c11b6804974f6dee44c440de43241e39b474c5848bb488a50fb5fc5b213555

Download Submit
C:\WINDOWS\FONTS\LATO-HAIRLINEITALIC.TTF

Filesize
595KB

MD5
2bbb788763716d2d716cfcb5bc3e92f1

SHA1
ea271649cc2f58a61fc819c9ca82eb8724717a2f

SHA256
9e469d156b0471556f202358939cc7fd2cab421659e3a3638136431d3c46ec8b

SHA512
5e5fb7cb98ba0a2397a88e214e05d121039d8b2e6a239037062d058e4d33a5ddb01cf7b8f0a78ec8c583c5f36994e6eb274c7b78108fdf951c927fbc6d6d9e08

Download Submit
C:\WINDOWS\FONTS\LATO-HEAVY.TTF

Filesize
649KB

MD5
093466c99afdd5e38cfe3062dbcbba6b

SHA1
068af974d1346b61d9ee1e097374f2f3cac6c442

SHA256
4ce7ec20cd9c391b271b4149ad8cf5a71301d98965403f14fc5530d017146dbb

SHA512
4aabee3daf68e45090b5b16ce455ac22cca54af890ce38ff9a45b05f428a79255d1771c7f21ebce426ad0b8dd0aade16bc8aff3c7d6c61ef5622ba6705f34fe5

Download Submit
C:\WINDOWS\FONTS\LATO-HEAVYITALIC.TTF

Filesize
682KB

MD5
bafcb4e83847db36fa96602c4abca98d

SHA1
f2d4047e1f5efd405b850abe23ccfdc2ceb1b3f8

SHA256
4c9af8df580f1b7a2e3336d69b225a38364a636dc014d8fd9c2b72adea68dd2d

SHA512
1edf4f70d291b146c7d81f74b4893f3b8d76213441fd305a16a3432de0d005ea03ef449d7adb8690a43c43356a9e3151beef251d1adfd21acde016aa8f986f14

Download Submit
C:\WINDOWS\FONTS\LATO-LIGHT.TTF

Filesize
629KB

MD5
90e1d3559ac52f7f0f77a86e1bfd632d

SHA1
a405c8288a8a90881407f93b6ee02b29e26a8735

SHA256
e9d59afb6d9cb9cf6e8d8159d4639d5b577e29efc64a15182f228659cfc1e818

SHA512
8c999f1b9fc238d925d87df4374f2c4cb4f57bd85a59fad82761f36d1e74cf65b85e64936d2a133e300e615d3f64535f50154dca94b3f80744f6d8cf70e18ba9

Download Submit
C:\WINDOWS\FONTS\LATO-LIGHTITALIC.TTF

Filesize
642KB

MD5
7e9668b13f86893fb0a4a6e35965c107

SHA1
f05f3b58c5abd991036a1b43bd601556244ffe9e

SHA256
8926c41622b7400d7f6f7dbf31cea50495f31230cf40904b8b83e634bf3cf6c6

SHA512
48bc02e6bf3e50426bdca9b227ceef0ff530f3ee6113b4ed6edf3b3814238b93c8157d7016917aeed01e2d32f7c03a9702382e582d353bc13b36b9dea8b57958

Download Submit
C:\WINDOWS\FONTS\LATO-MEDIUM.TTF

Filesize
622KB

MD5
863b7dcd5ec2c3923122af25ce0f7e4c

SHA1
c78e94b7cc0b782eef4f9f2be371c3cf9c3f6eaf

SHA256
be8bbf7105500e8fc1f9429307fb396905a0e6cff63fe1eb751bb319d0f1b0db

SHA512
482964c6fe3f3f6ad35dcc6366fb1ef811087bc5af71f221e8f139749ecaced72a1377cfe483e2d049aaf266f3c2301ac899de126e3fb0a00150d1808dbc6cd6

Download Submit
C:\WINDOWS\FONTS\LATO-MEDIUMITALIC.TTF

Filesize
679KB

MD5
ba4dbd0809f13b78b621a042efaed7d5

SHA1
df1a7160502d9e90c41b92b7243270a769904786

SHA256
0739be048a122e3abb0cb731b49f6c07ac212a54eb182ebaa25a65829d5ac0cf

SHA512
7695d4639518e4b55458daa850d82f64e409a4540be3a39211e620f1076a5651dc4d106b4ec8fde64e7eed9a1056de2701a3472ac89513d707bcfe61cfcf3633

Download Submit
C:\WINDOWS\FONTS\LATO-REGULAR.TTF

Filesize
641KB

MD5
3b9b99039cc0a98dd50c3cbfac57ccb2

SHA1
f59f9e4f3cbee981a5e6f58a279f9b9613f22599

SHA256
6f6940be0835c3ddec9199e5fc42be4cbc61ebcfd58c623fdf719366253f1780

SHA512
2e81cb0ed1f26ded89d9756ec98a42581759d29bf605f964ea384c55112e7ad04a12e6d945310dde0098cea5459de5530e4f900d550b4605ec2762ce2a61d4ec

Download Submit
C:\WINDOWS\FONTS\LATO-SEMIBOLD.TTF

Filesize
653KB

MD5
3c6cfb1aebd888a0eb4c8fba94140fa6

SHA1
96569e2cfcc3a298bb1aea21103d0d1e3c7e2ed4

SHA256
2dc5d31e2cf1e29f3430eb2dfa1ba9911e08ee401b61dd12f40e0acb047a17a3

SHA512
509abb792c29cf9433e46d087f005cf1358f5496faa9769f0c3dd3372428e465b9a12bc59ce61b8eafbca3e5f92724bd1d5692df24d51c154e247e57b9e0f985

Download Submit
C:\WINDOWS\FONTS\LATO-SEMIBOLDITALIC.TTF

Filesize
681KB

MD5
c969278938eaacc998eab23bce2a1d0c

SHA1
8a34fbb379a096d4c5914a962a6f71e1721b40a7

SHA256
0aa594079c213d1dba417a2fc34b8170445d0f03af02a3b35f16b9b775eef398

SHA512
37aaca5c2fb2e4b4b7a4be98176f4b498cae41af534407e16eeba71d7cacd214a3f48d64c69ee002cef35e2abb027d0de49564c1d7e939018b790ada3537a208

Download Submit
C:\WINDOWS\FONTS\LATO-THIN.TTF

Filesize
612KB

MD5
eb1635403cd764912ca1e0af78735797

SHA1
dbe1f622faef3ea3f286d848da6b10f104405060

SHA256
11b51a8bb6361be3e4642de40b49c210ecb4a19b8bf630f3335ff07813726f3b

SHA512
aa04eaf80d89487f12358cef8eeef0487b7924eb1aa735840416b9188f2f2b40e01184e5bbbe2fe9efd7d29cff3cd5cb85d39076166b5ccf30738a2a26bd14d0

Download Submit
C:\WINDOWS\FONTS\LATO-THINITALIC.TTF

Filesize
638KB

MD5
29f53f3450c6691e4195d082647aa8ca

SHA1
8ce23025cf59e58b9bafdd8526d685d8347267c7

SHA256
c8ad5351e800f8286890a4c8a57d849207cb930287caeb40c4ffbe538f2f3e0e

SHA512
a94f32cbfa36d2d736800946cb255ad0e3877f15542e18d23dfc523aa208e1384d7cad861941878153945d2b0e8505fe7c1567dd03f35d254ddf297daa2d38d4

Download Submit
\Program Files (x86)\Ubiquiti airMAX® M Toolkit\UBNT-M-TOOLKIT2.exe

Filesize
1.9MB

MD5
259bac0f25904bb5a64d8b4de4e9fdaf

SHA1
cf1dcd453f2d16c6d36c7e9127601efcda7c3ab0

SHA256
b3d21b62242c0dffb2b61360cdaceaa2115195c1ad455c1a348491ff07b5c024

SHA512
966f2f87623428217ea44a0630560b5fdaaa5d749b647afc00d0e1eb5ac6843ddb0a5757ed2ee4ebd3e277c3deb28931a18ac11d10a53cad40dab42e27a7cc53

Download Submit
\Program Files (x86)\Ubiquiti airMAX® M Toolkit\en\UBNT-M-TOOLKIT2.resources.dll

Filesize
368KB

MD5
3907fe1f966516223cd3d8937fd35a14

SHA1
f0d372c9ba132807c8f62117c89d4e8f41ab3559

SHA256
feb398766184ad2b0fbf017b5545238a0a612e4e150d567c064e993baebce094

SHA512
91be3b5111c9b05b521566b1fc3f2a39963ecfd0ee844c8bb9c0e95f79e010e6cdaa8499d4114aae2ac5b7d08af661bbfcb49e9fb42ac9710e0c548b26df7f47

Download Submit
\Program Files (x86)\Ubiquiti airMAX® M Toolkit\en\UBNT-M-TOOLKIT2.resources.dll

Filesize
368KB

MD5
3907fe1f966516223cd3d8937fd35a14

SHA1
f0d372c9ba132807c8f62117c89d4e8f41ab3559

SHA256
feb398766184ad2b0fbf017b5545238a0a612e4e150d567c064e993baebce094

SHA512
91be3b5111c9b05b521566b1fc3f2a39963ecfd0ee844c8bb9c0e95f79e010e6cdaa8499d4114aae2ac5b7d08af661bbfcb49e9fb42ac9710e0c548b26df7f47

Download Submit
\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\FontsInstaller.exe

Filesize
225KB

MD5
3f1f544ae6ebd67aea99497b158112c0

SHA1
8952308d272668a6a245d7cfb0dc5373af58c57c

SHA256
127bff14e7db4fe31a32ae872746d91a4983a679abf4254eb99165ba6dc7de2a

SHA512
6c66549d81be713af6eb99d0410a927d6763a563558ce9e8bb126d0bfe2bca5a547cfc2cc22c6ab60f5db806ae38d5d434a0d3c6e40b149d1b35504c48822d57

Download Submit
\Program Files (x86)\Ubiquiti airMAX® M Toolkit\fonts\FontsInstaller.exe

Filesize
225KB

MD5
3f1f544ae6ebd67aea99497b158112c0

SHA1
8952308d272668a6a245d7cfb0dc5373af58c57c

SHA256
127bff14e7db4fe31a32ae872746d91a4983a679abf4254eb99165ba6dc7de2a

SHA512
6c66549d81be713af6eb99d0410a927d6763a563558ce9e8bb126d0bfe2bca5a547cfc2cc22c6ab60f5db806ae38d5d434a0d3c6e40b149d1b35504c48822d57

Download Submit
\Users\Admin\AppData\Local\Temp\is-G8VBC.tmp\setup_UAM-4.3.tmp

Filesize
3.0MB

MD5
dfd0a541b0c2006286f294753b291ed6

SHA1
3ae5729ab7d85e233da3c97eca391a4c2f9a4cdc

SHA256
9cb1d766c6e2a6a839e898b27ffd8b072ba92db02477a36b06bc9e826ec1511e

SHA512
b0e63c85ee357f21a25a074ee220b3e697a8a4fa750f22febf8dd5e415d5a080281be711b22776205d8c7cb733f398bd5462e66f3f7fa7f3880024393436d8a7

Download Submit
memory/520-78-0x0000000004DA5000-0x0000000004DB6000-memory.dmp

Filesize
68KB

Download
memory/520-71-0x00000000001E0000-0x000000000021E000-memory.dmp

Filesize
248KB

Download
memory/1284-61-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/1284-54-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download
memory/1284-55-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/1284-73-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/1336-182-0x0000000000725000-0x0000000000736000-memory.dmp

Filesize
68KB

Download
memory/1336-158-0x0000000000120000-0x000000000030C000-memory.dmp

Filesize
1.9MB

Download
memory/1336-177-0x0000000005BE0000-0x000000000616E000-memory.dmp

Filesize
5.6MB

Download
memory/1336-181-0x0000000000870000-0x00000000008D2000-memory.dmp

Filesize
392KB

Download
memory/2012-62-0x0000000074131000-0x0000000074133000-memory.dmp

Filesize
8KB

Download