hxxps://www[.]mediafire[.]com/file/7lfw1oeva0ewkhb/pyla[.]rar/file

Analysis

max time kernel
1023s
max time network
966s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/7lfw1oeva0ewkhb/pyla.rar/file

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5048	7zG.exe
6088	production3.exe

Loads dropped DLL 64 IoCs

pid	Process
3436	Process not Found
3436	Process not Found
5048	7zG.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2404-x64.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2404-x64.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1181767204-2009306918-3718769404-1000\{587DBDC1-1C04-470D-A025-BEEBDA0AB8AC}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2404-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\鰀䆟縀䆁\ = "json_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\json_auto_file\shell\edit	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2404-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\json_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\json_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\json_auto_file\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2404-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\.json\ = "json_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\鰀䆟縀䆁	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2404-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\.json	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2404-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\json_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\json_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2404-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\json_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\json_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5628	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2744	mspaint.exe
2744	mspaint.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3368	OpenWith.exe
5868	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	5048	7zG.exe
Token: 35	5048	7zG.exe
Token: SeSecurityPrivilege	5048	7zG.exe
Token: SeSecurityPrivilege	5048	7zG.exe
Token: SeDebugPrivilege	6088	production3.exe
Token: SeDebugPrivilege	5868	taskmgr.exe
Token: SeSystemProfilePrivilege	5868	taskmgr.exe
Token: SeCreateGlobalPrivilege	5868	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5048	7zG.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
3788	7z2404-x64.exe
5112	OpenWith.exe
5112	OpenWith.exe
5112	OpenWith.exe
6088	production3.exe
6088	production3.exe
6088	production3.exe
2744	mspaint.exe
3368	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe
2496	OpenWith.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 6088 wrote to memory of 4716	6088	production3.exe	150
PID 6088 wrote to memory of 4716	6088	production3.exe	150
PID 2496 wrote to memory of 5628	2496	OpenWith.exe	156
PID 2496 wrote to memory of 5628	2496	OpenWith.exe	156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/7lfw1oeva0ewkhb/pyla.rar/file
1⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=3652,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
1⤵
PID:3172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=3836,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
1⤵
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5260,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
1⤵
PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5268,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
1⤵
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5932,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
1⤵
PID:704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5880,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
1⤵
PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=6032,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
1⤵
PID:468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=6188,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
1⤵
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=6520,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
1⤵
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=6664,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
1⤵
PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=6800,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:1
1⤵
PID:3300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=6732,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
1⤵
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --field-trial-handle=7088,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:1
1⤵
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --field-trial-handle=7496,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:1
1⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --field-trial-handle=7800,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:8
1⤵
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --field-trial-handle=7440,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:1
1⤵
PID:692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --field-trial-handle=7688,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:1
1⤵
PID:5192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --field-trial-handle=7592,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:1
1⤵
PID:5296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --field-trial-handle=8432,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=8452 /prefetch:1
1⤵
PID:5372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --field-trial-handle=8096,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=8464 /prefetch:1
1⤵
PID:5380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7556,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
1⤵
PID:5500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --field-trial-handle=7184,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:1
1⤵
PID:5540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --field-trial-handle=7100,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:1
1⤵
PID:5640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=8208,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:8
1⤵
PID:5724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7816,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=8624 /prefetch:8
1⤵
- Modifies registry class
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --field-trial-handle=8724,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=8576 /prefetch:1
1⤵
PID:5812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --field-trial-handle=8928,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:1
1⤵
PID:5924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --field-trial-handle=9052,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=9044 /prefetch:1
1⤵
PID:5944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --field-trial-handle=9092,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=8588 /prefetch:1
1⤵
PID:6072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=8012,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:8
1⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=9080,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=8592 /prefetch:8
1⤵
PID:1168

C:\Users\Admin\Downloads\7z2404-x64.exe
"C:\Users\Admin\Downloads\7z2404-x64.exe"
1⤵
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=7824,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=8084 /prefetch:8
1⤵
PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --field-trial-handle=8008,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=9088 /prefetch:1
1⤵
PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1000,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:8
1⤵
PID:3676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --field-trial-handle=8484,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:1
1⤵
PID:820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=7560,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=8104 /prefetch:8
1⤵
PID:180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7452,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:8
1⤵
PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7612,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
1⤵
PID:3028

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5112

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4360

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\pyla\" -ad -an -ai#7zMap25281:70:7zEvent4276
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5048

C:\Users\Admin\Downloads\pyla\pyla\production3.exe
"C:\Users\Admin\Downloads\pyla\pyla\production3.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:4716

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\pyla\pyla\output.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:5552

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3368

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\pyla\pyla\json\login_data.json
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5628

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\pyla\pyla\bat\emulator.bat" "
1⤵
PID:5564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
fe487725998a00de2ecd41b1357ca0bc

SHA1
cffe7d83767b3334533f9525bea67e34dcb2b632

SHA256
e0625e017c02038cf25b60d03f3c46da44b4232bf9c664cf30bcf67af81229b1

SHA512
173191f2678a4e73457ce4a4008c432080e050004fe034f93cf05281be6be670c54e0c37f23b90d4f9f6cce4de82fbff71cec817bf301d4d84405ea238f1c730

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
29f6d49053de1408586f48681864ca5f

SHA1
1071e887849cb92776f4a6d4cb6d0dd1ec264b65

SHA256
84d2bcf774aba77e938d3f36bfe020e0d49cfb3074ad9de69b5af78054602b7e

SHA512
dcdb5252e660b0d186c8db508db3fdaab22d33bc20dcaca2b41d5d5e64d5780b25f2242389227ddefff96978f373f89942389673c737b3102778982b91ca6f32

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
691KB

MD5
4a8614832d2512e1b1cf73051f083185

SHA1
da8b5fbc538cfc186dde7292dc17f4580b789c4a

SHA256
2f4f3768ca8f50f9a8882a7ac99aa95513f26fda7a41ce8c7971735d9b7ce920

SHA512
4846340d1726f14b9a932e032d914e15d7122dc5b24c12f63ac4b9b04ada46fe7a83551870509720be39e67abc6e7d27499fb853b4df5871253b26901c2d6e55

Download Submit
C:\Users\Admin\DOWNLO~1\pyla\pyla\numpy\core\_multiarray_tests.pyd

Filesize
63KB

MD5
54192025aa4449a24e8c84ae0f25b164

SHA1
381f50a8354c4abb12b76fa6e74fd526fbce2da9

SHA256
c31d1abe635e9006caa9fedda260dd4e4fdba31fbdcc8ac0969ab0396a0c6c4e

SHA512
1a3210c5c24a86d6cd6e3f2c19ba211611d5054cf04f6f5d22268a99f9ce6a8f61cab41d0d636e6163605180a94e90f0cf2b3832b2c3f731371fe4fd3d96a5c7

Download Submit
C:\Users\Admin\DOWNLO~1\pyla\pyla\numpy\core\_multiarray_umath.pyd

Filesize
2.7MB

MD5
ea2e696dd221290a44fc7f095c4f185b

SHA1
dd5ae42ae6d2678d65b003ba4ca8286a80586869

SHA256
c76d812fa5131fe21c8bf9ffbd910f27df80856f910fa61698f23f60cfd9d13e

SHA512
7a811681652fb53d2da2ec0042b73a6b75b95defc9b47422df0148832a71079832a10d45ac6e457d26a708a30544ad45f08a87e61426c1f3c8252e48c6374b27

Download Submit
C:\Users\Admin\DOWNLO~1\pyla\pyla\numpy\fft\_pocketfft_internal.pyd

Filesize
107KB

MD5
79f63fa108140ba54d5aea030df4be95

SHA1
1ae3b933106095928c54e1dba66f0966f98ce48b

SHA256
207c894d4a97d5eac328a87936b1c5a160cf1163d8b3f59b3c43792d9b5224a4

SHA512
8bef8bcc947c6d7b07a6b9d40eac134c4190abbc302a175e1e7b8d70a2eea8f2f7a9aaa0a0ff6b1fb74f6d7153cf6d63f8fb9d822bc58e98621f54c94c45bd81

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\_bz2.pyd

Filesize
82KB

MD5
a62207fc33140de460444e191ae19b74

SHA1
9327d3d4f9d56f1846781bcb0a05719dea462d74

SHA256
ebcac51449f323ae3ae961a33843029c34b6a82138ccd9214cf99f98dd2148c2

SHA512
90f9db9ee225958cb3e872b79f2c70cb1fd2248ebaa8f3282afff9250285852156bf668f5cfec49a4591b416ce7ebaaac62d2d887152f5356512f2347e3762b7

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\_ctypes.pyd

Filesize
120KB

MD5
9b344f8d7ce5b57e397a475847cc5f66

SHA1
aff1ccc2608da022ecc8d0aba65d304fe74cdf71

SHA256
b1214d7b7efd9d4b0f465ec3463512a1cbc5f59686267030f072e6ce4b2a95cf

SHA512
2b0d9e1b550bf108fa842324ab26555f2a224aefff517fdb16df85693e05adaf0d77ebe49382848f1ec68dc9b5ae75027a62c33721e42a1566274d1a2b1baa41

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\_hashlib.pyd

Filesize
63KB

MD5
787b82d4466f393366657b8f1bc5f1a9

SHA1
658639cddda55ac3bfc452db4ec9cf88851e606b

SHA256
241322647ba9f94bdc3ae387413ffb57ae14c8cf88bd564a31fe193c6ca43e37

SHA512
afcf66962958f38eec8b591aa30d380eb0e1b41028836058ff91b4d1472658de9fba3262f5c27ba688bd73da018e938f398e45911cd37584f623073067f575b6

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\_lzma.pyd

Filesize
155KB

MD5
0c7ea68ca88c07ae6b0a725497067891

SHA1
c2b61a3e230b30416bc283d1f3ea25678670eb74

SHA256
f74aaf0aa08cf90eb1eb23a474ccb7cb706b1ede7f911daf7ae68480765bdf11

SHA512
fd52f20496a12e6b20279646663d880b1354cffea10793506fe4560ed7da53e4efba900ae65c9996fbb3179c83844a9674051385e6e3c26fb2622917351846b9

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\emulator.lnk

Filesize
813B

MD5
f14d7af55d38a33d06e5172c93d370a5

SHA1
cc6a3eee3e2a165b217e428e351a1eea5477b509

SHA256
e8b65857f4451177bb70d6df8e7d7320076650e49880dfe68e469881956fc64d

SHA512
1c7753d1368f8c88d05866b0973790eb9208ab4c4f476033179310a42cd9cdd5a00ee4fb0112a3618799661cb8dcad50055174a36c776ce32c1b38ff3d82cf0f

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\libcrypto-1_1.dll

Filesize
3.3MB

MD5
9d7a0c99256c50afd5b0560ba2548930

SHA1
76bd9f13597a46f5283aa35c30b53c21976d0824

SHA256
9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939

SHA512
cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\mfc140u.dll

Filesize
5.4MB

MD5
03a161718f1d5e41897236d48c91ae3c

SHA1
32b10eb46bafb9f81a402cb7eff4767418956bd4

SHA256
e06c4bd078f4690aa8874a3deb38e802b2a16ccb602a7edc2e077e98c05b5807

SHA512
7abcc90e845b43d264ee18c9565c7d0cbb383bfd72b9cebb198ba60c4a46f56da5480da51c90ff82957ad4c84a4799fa3eb0cedffaa6195f1315b3ff3da1be47

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\numpy.libs\libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll

Filesize
36.4MB

MD5
5e46c3d334c90c3029eb6ae2a3fe58f2

SHA1
ad3d806f720289ccb90ce8bfd0da49fa99e7777b

SHA256
57b87772bf676b5c2d718c79dddc9f039d79ec3319fee1398cc305adff7b69e5

SHA512
4bd29d19b619076a64a928f3871edcce8416bcf100c1aa1250932479d6536d9497f2f9a2668c90b3479d0d4ab4234ffa06f81bc6b107fad1be5097fa2b60ab28

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\numpy\linalg\_umath_linalg.pyd

Filesize
104KB

MD5
c38f96f75d504fa0c2df82327beeca31

SHA1
d059816e107302a43b60c0081b91a667327ddc13

SHA256
05922a2be823ec2e4d2378a73b05bb37f2816aeea86b613a9c80e25764ac8736

SHA512
a0609881d8d7335fc4dfa79584494b56dd1875e10564035a432bae2bfe206a0f9ddad500bb4d84e3b68a1bea0c698d5b04b19b30e02fe36410451c2a7d2147ba

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\numpy\random\_bounded_integers.pyd

Filesize
251KB

MD5
f380b1902f06ed89554a6a7f76fef247

SHA1
48bc984fe47823eab6d59db171cee6f7ce33bbf6

SHA256
05d5fe8a5a79b1d5836e58307afdd0c8570a7c4e1ed0b6a6294f3978db0dc6c4

SHA512
a4b7f5405836c746148c14145b76e898228ba29d67ed122adfe68007e4ecc8893825f0a6c7e706035d112874894d588533a715a6aea33d3c83a1dfe7161d0ca4

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\numpy\random\_common.pyd

Filesize
171KB

MD5
9859d240504af306b9e130b1ae0a28d3

SHA1
9f87f3badce2c4f02d8780c35acca16c67c44917

SHA256
f41809c03d13487fa8940cc30f5ff2125143ebf071bca10e081d026028c435fd

SHA512
16ff6686f7f058c061e4e5d9f411b195c064c3c4871613957d30b50055e428bb9b51c22558267e4ae1089a33a21fabd4de00b525906aba9aae7325b7ae1d2920

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\numpy\random\_generator.pyd

Filesize
679KB

MD5
6de59567e3c76ab31b85ae334e173721

SHA1
03a81c8a9636e5623b7c98c117b1aaf6d34bfef3

SHA256
003c7af2699a370efc1a90bf42ac3b449c27ff9c24b11136dd245bf50ed2240f

SHA512
b89e2222bc1f6c13145bd13c404bcff7af304565293d36e0fff619687e65c3909cc94f6adb01447a1bef523a5db5009520a1867aa76045a46f99368201a2f3f5

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\numpy\random\_mt19937.pyd

Filesize
73KB

MD5
046eea12f5582cfc5b4dd95c95f3568e

SHA1
27fd4be133ca784bd8f15ec65234069d7a427325

SHA256
36bbd3767a4efc1e5ddd4f96b7b705fc664e95a629abbe7e3b5e5951cdead3f0

SHA512
85570a0dc3200387763570a474089e80ab5e61dc3d271fa01f5d0e7ed9bc61954bd2fe92a7a20f6ab5ca5ff47a6047f6f80551b4dcdac13ba962d790b36d91ed

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\numpy\random\_pcg64.pyd

Filesize
81KB

MD5
6fdbf3346994c777608f0ad5cbaca3cd

SHA1
79e08ae5c2ee684537c73f58feff25a3deef0bc7

SHA256
e09a53b33a1908aa4eb58a07166d5beaffe2072ceded2f80df59831adf7fb8df

SHA512
cef969246e8dbc8809ca21b7fc691c6d52eca977f433331ff05a491689dc4ded79a53c390aefa645834fd395477e428b151a91acf9037943279288a261f46403

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\numpy\random\_philox.pyd

Filesize
68KB

MD5
7ad1efc0a62a692722b5eef7b6f8414a

SHA1
5a0d5f305b149c460e7f720efe5ea168643f0177

SHA256
9a777f3f9a59f3d88de84dc3e499138335c3a6cf3bee1b875d9626d6cdf6e098

SHA512
59bdf9723854683a6955dcd07d99b05a8f11f2a708171e3cd9ed6cde17ce739c27a4cabe13f1997967f9e87672a9bab36591dc530fdca1df5886ab4b5710468e

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\numpy\random\_sfc64.pyd

Filesize
49KB

MD5
441f1537e70a2eea00f4369e46a26be0

SHA1
aff994dd60f33c2aaac480c959351f1684349c39

SHA256
180453afefeff645f9fdb2de54a3cb72d8becb87936ea82e2d7a56592aca3068

SHA512
124034b67b0a1abe0e2b3ea8605f25970e224c7b9f72cd7ba2fdd63396afc94bf981224f2fbdc2d45fce3bad299a04238f52a147f0cf8519c26360e55e4359ab

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\numpy\random\bit_generator.pyd

Filesize
160KB

MD5
4f9e45169d349a4922a251df4af06b12

SHA1
eb4c248b9b5fecc0518d5fbc77652bc8509cc8e3

SHA256
9ad713f6a93c26bb733a90f877b50d51d7f22eef161aa58e40735a5cec149501

SHA512
90dcd6f1e35dde8a37690a2c70036f6903ce868e0bfdce930941ea71dc58de5748dcd4fd1af8745d85aca7d643199512ddc628615382f26340eda3fb229113b5

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\numpy\random\mtrand.pyd

Filesize
583KB

MD5
fe1f1ca966c6041483a00d4940380c95

SHA1
a7c273ccca6bccb4cd709104d02c6e9af01eb49b

SHA256
7dda3c60d25791c53c2eca99eab696347b6a8ee20f3f8307d7efbf086cbbc5bf

SHA512
42476929a8307eb088728fb3cabe971239aefd2ca60785f4141b4a215d7a360b256bb8060dbdbcd08b68430719d4ea05214cbd48e25336492909d1378ea29c27

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\python3.dll

Filesize
65KB

MD5
7442c154565f1956d409092ede9cc310

SHA1
c72f9c99ea56c8fb269b4d6b3507b67e80269c2d

SHA256
95086ac060ffe6933ac04a6aa289b1c7d321f14380315e24ba0d6c4adfa0842b

SHA512
2bf96828534bcdf71e48d1948b989011d8e3ba757c38cc17905a13d3021ea5deb57e2c68d79507a6acbb62be009cfc85b24d14543958dba1d3bc3e4ca7d4f844

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\python311.dll

Filesize
5.5MB

MD5
e2bd5ae53427f193b42d64b8e9bf1943

SHA1
7c317aad8e2b24c08d3b8b3fba16dd537411727f

SHA256
c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400

SHA512
ae23a6707e539c619fd5c5b4fc6e4734edc91f89ebe024d25ff2a70168da6105ac0bd47cf6bf3715af6411963caf0acbb4632464e1619ca6361abf53adfe7036

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Africa\Asmera

Filesize
265B

MD5
86dcc322e421bc8bdd14925e9d61cd6c

SHA1
289d1fb5a419107bc1d23a84a9e06ad3f9ee8403

SHA256
c89b2e253a8926a6cecf7eff34e4bfcdb7fe24daff22d84718c30deec0ea4968

SHA512
d32771be8629fb3186723c8971f06c3803d31389438b29bf6baa958b3f9db9a38971019583ba272c7a8f5eb4a633dfc467bfcb6f76faa8e290bad4fd7366bb2b

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Africa\Bamako

Filesize
148B

MD5
09a9397080948b96d97819d636775e33

SHA1
5cc9b028b5bd2222200e20091a18868ea62c4f18

SHA256
d2efac4e5f23d88c95d72c1db42807170f52f43dd98a205af5a92a91b9f2d997

SHA512
2eccf2515599ed261e96da3fbcfbab0b6a2dfc86a1d87e3814091709f0bfe2f600c3044c8555ed027978a8ae9045666ee639a8c249f48d665d8e5c60f0597799

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Africa\Douala

Filesize
235B

MD5
8244c4cc8508425b6612fa24df71e603

SHA1
30ba925b4670235915dddfa1dd824dd9d7295eac

SHA256
cffeb0282ccbd7fba0e493ff8677a1e5a6dd5197885042e437f95a773f844846

SHA512
560c7581dcb2c800eae779005e41406beaf15d24efc763304e3111b9bb6074fe0ba59c48b5a2c5511245551b94418bbc35934d9bd46313fcc6e383323056668c

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Africa\Gaborone

Filesize
149B

MD5
b77fb20b4917d76b65c3450a7117023c

SHA1
b99f3115100292d9884a22ed9aef9a9c43b31ccd

SHA256
93f19e9551d58868ae5820752d2c93a486124c364463dc9c9489d0458f8bc682

SHA512
a088c2a4c7d72717257c3125c7c2aca28463d68306ea452afaad75b8a0f9e5730a8d9c430d14668809717a672dc63c4816762acb046b339da662da421a6d65df

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Africa\Mbabane

Filesize
246B

MD5
049a2b9b24bbd0cfad59a06f8e813e13

SHA1
65c0d4ab314cb72b8d8c768e3d0c3218848b61f1

SHA256
6c1bcc752668e77585a308ae8543bd0bccd8e813865626e809bf94f3fe3d977e

SHA512
fc9b86e23d12a6d013d98b8be6146317d9267732d87560fd175758c12e4606da662474bbd801ec14dc99213552d5ba00053952d6529fa34712fa0819ad0364bd

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\America\Aruba

Filesize
246B

MD5
adf95d436701b9774205f9315ec6e4a4

SHA1
fcf8be5296496a5dd3a7a97ed331b0bb5c861450

SHA256
8491e557ff801a8306516b8ca5946ff5f2e6821af31477eb47d7d191cc5a6497

SHA512
f8fceff3c346224d693315af1ab12433eb046415200abaa6cdd65fd0ad40673fdddf67b83563d351e4aa520565881a4226fb37d578d3ba88a135e596ebb9b348

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\America\Catamarca

Filesize
1KB

MD5
de64d178f88872240d02e9b7b0b0b479

SHA1
8c0ab8c1684ecbb2b92ed2d37273ee9eced805d7

SHA256
b8c0895d719898d1121d5be3e5160167431cace744d788709b5ee5db9320456d

SHA512
a6745d42e59f8edb3b3cf43ef4fd7b0f480787e38e54d1350801480c87b98ed8926d9df6466c89ae46177ffed3c5a0611c74c60cda7d1f780ade08c43de35db7

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\America\Coral_Harbour

Filesize
182B

MD5
0972a9c4c28bf71eeab5f0bac573cdbc

SHA1
a94fbc2d567e41723f03629b6c9a864260108a17

SHA256
91ac80fe976931c490d058c8ce8b5d71ffa6d4961f6ca13ea9c153f0b0bccea0

SHA512
ece548f7d840a588523aacddc93891e0dd300390f79de063e60074e00a92ae33a8201642b841ff868387f1ac2188c485cce941d83c7a3617d27ac286dbcc0c17

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\America\Indianapolis

Filesize
1KB

MD5
8ab9f9cfbb576566eabf9ef0c2835169

SHA1
ad1a26bddb9304a620b2c6f7ec9f3a5226622906

SHA256
90d2b2f4a8fd202b226187c209b020833300edec5ff86a463ccc685e8707532c

SHA512
f4417b003513c8a58cbc033dce7944be97573b4b2300493720f8b674a136b006b8b5a14f532ba7a9ec1fbf97c6fed1a67580718da4e7871e3b8106f8899ed398

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\America\Nipigon

Filesize
3KB

MD5
8dabdbbb4e33dcb0683c8a2db78fedc4

SHA1
a6d038ecff7126ee19ebb08a40d157c9a79964cd

SHA256
a587a1a1607439f7bac283e1815f2bdbafb9649a453d18e06c2e44e6996d888f

SHA512
35bfd5182535f5257d7ee693eb6827751993915129d7f3cc276783926b1f4db7a00d8f0b44a95ac80c294a9cc1b84bda6418134c2a5c10ba6c89946bd8ef97a3

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\America\Rosario

Filesize
1KB

MD5
9273846f7bca0d02d0ff118e3bbce0aa

SHA1
839495859f8144c95a8900b3f966957c4a6fa589

SHA256
ba788d8a184c1e7af85cae16a7088f527ac04f460f9afcea07a7f48512ed5ef6

SHA512
655a01ff1a6f2a8083131088fd2549fd8e9599adf69721856dbbe6b809a78325f5041de2dd17e671a98c13d7cc0f6c44d5648743c2ce04f4508533707204c2e3

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\America\Tijuana

Filesize
2KB

MD5
5a49efbf954e9747e68b1bb88e52a771

SHA1
b636eadf9fda46ca28076666594453f47c9b0efd

SHA256
e7bf90f4b49336e4e2773fa5393c03cac9a50a878551749e72f555a8d59bbab4

SHA512
9aa9198f53e14ea4f7e288c77e23e827e2d2d9aa893972ceae2882ae9cecdea1c3c74b3707a0bbbb14421e43eeaef6d4f0cc62b8b416919de8800faecb0542f3

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Asia\Harbin

Filesize
561B

MD5
09dd479d2f22832ce98c27c4db7ab97c

SHA1
79360e38e040eaa15b6e880296c1d1531f537b6f

SHA256
64ffc2e43a94435a043c040d1d3af7e92d031adc78e7737af1861baa4eeef3e6

SHA512
f88ae25f3f04c7d5d5f98aafecc03cc7e4e56f1cd4c8deba6afd043f0fb7fe67b4d50e4df5493e77c6b34ba183e019442e736a13f784ba8c2847c06fd74ff200

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Asia\Kuwait

Filesize
151B

MD5
66cc1bf4ff133faa5e1a4205403ed874

SHA1
1294daffe7ba6c5b2e7624128fe453685be1ab02

SHA256
a02287eee69f37c475a3e8a35c6a13e54d49671c2fa0bcc9bbfd82ab28b68543

SHA512
3d313bc2926196c772f3d8aeca62c0816c109f2246792d1f923b5a1185f34888f185e0bb5d1f45208b93b6a47e36ebd1826da760d7c1a651b5311fb9686bbd7a

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Asia\Vientiane

Filesize
185B

MD5
5f71fdbfc6dd733eb433ccd24d687308

SHA1
9d2f3654d198fa02fed46579cf57bb2adbe09ed8

SHA256
85fff93d57a041c1524bad028d2f340bb87e4c63ab7d0e27726f3737c5666649

SHA512
241915b9c948badad655407fd03cba154634a897356cbd9b6e5df081c92d07727ce3fbcfb180bd5f02b9989239b083d66168b629cfa09a9632469a5a8a3ccd3c

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Australia\NSW

Filesize
2KB

MD5
44cc3e944fdd50314de398d0aed2bd8e

SHA1
ca9f55088c536a5cb6993b1a5fe361c0617bc4fd

SHA256
42c3857585b16db2f8ffd47ba19faa60f473340de8d4fe9320ea7be861605906

SHA512
33f9b04997fc4d3a207e7905029886110f455934f87d6820d7ec8f901f6b65700f69f667991d909d09d73acfd3bdeca9d077e3fa74f1f3a0d0edf9bcf871dfb3

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Australia\Tasmania

Filesize
2KB

MD5
8b19c5bc1dc3b7baee99a3528d2bf3b6

SHA1
db8884f4beb55ae0c292403cdb8ffc47c18effcd

SHA256
18b412ce021fb16c4ebe628eae1a5fa1f5aa20d41fea1dfa358cb799caba81c8

SHA512
3b6ca88f06374f4c0f95b3cb9c62720a1a71491280b2d1f39938fe37e999e4685865070dc4b4c941a65ecd0f61c3c2e1bec15c153ce43a682f81134e4dc9b60c

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Brazil\Acre

Filesize
614B

MD5
2d8be42f2392ac1227568eb08a7b2a9b

SHA1
4b4db121d39b9cbede3e78f144ee0bffa743e8ab

SHA256
d20a49525e3a8506e9d0fe978f54b4340ac859e02bcaeb835e3b2576f0791871

SHA512
082de6b7a7788f5da3f64a0cc3fb3371b44478feea80b67c8e430fd26646fb72b350c799252b9ec07da4833f31b8d07c61124c4aead1829811cedb2abd178db2

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Canada\Central

Filesize
2KB

MD5
1cf382061df64010265f0869903fb6d8

SHA1
684c62d80d16a9256c9123074466cc5d0288daea

SHA256
ecffbf610ae77857289fb40a4933a79221a3129a450e7dd9e3c309d6aabc541c

SHA512
04548845e8086e5c223b912d183314b4e0b9fe5a938659d2cf5bb9ca22deaeea90ad3567210913ff6767aa752d5c21209de45ef4b37aad4df5dcbf004fa027ef

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Canada\Mountain

Filesize
2KB

MD5
1f23503189b8ce70677b2dcbb4a57e8c

SHA1
4f441f7a62122e43a963260550efb1a1ff3100c2

SHA256
f939087dcdd096f6827f4a7c08e678dd8d47441025fa7011522f8975778ad6f1

SHA512
bfaa266bba2c68205553455278e17632e984f24e8b6985932e202a3e2598a0f9ea6a61bda77dfd9d7208ff86272080ba4a665e66d24fe4af59206e6c13825c75

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Etc\GMT-0

Filesize
114B

MD5
9cd2aef183c064f630dfcf6018551374

SHA1
2a8483df5c2809f1dfe0c595102c474874338379

SHA256
6d9f378883c079f86c0387a5547a92c449869d806e07de10084ab04f0249018d

SHA512
dafa0cb9d0a8e0ff75a19be499751ad85372aafa856ff06dd68ecf2b1c5578bb98a040becaecf0aed2c3e4ff7372ff200fe7614334756d19fe79dd61c01d4e92

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Etc\UTC

Filesize
114B

MD5
38bb24ba4d742dd6f50c1cba29cd966a

SHA1
d0b8991654116e9395714102c41d858c1454b3bd

SHA256
8b85846791ab2c8a5463c83a5be3c043e2570d7448434d41398969ed47e3e6f2

SHA512
194867d0cf66c2de4969dbfeb58c775964ecb2132acdc1b000b5ef0998cefde4a2979ffc04ec8b7dcb430e43326a79d9cedb28ecea184345aa7d742eaf9234ac

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Europe\Berlin

Filesize
2KB

MD5
7db6c3e5031eaf69e6d1e5583ab2e870

SHA1
918341ad71f9d3acd28997326e42d5b00fba41e0

SHA256
5ee475f71a0fc1a32faeb849f8c39c6e7aa66d6d41ec742b97b3a7436b3b0701

SHA512
688eaa6d3001192addaa49d4e15f57aa59f3dd9dc511c063aa2687f36ffd28ffef01d937547926be6477bba8352a8006e8295ee77690be935f76d977c3ea12fe

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Europe\Isle_of_Man

Filesize
3KB

MD5
a40006ee580ef0a4b6a7b925fee2e11f

SHA1
1beba7108ea93c7111dabc9d7f4e4bfdea383992

SHA256
c85495070dca42687df6a1c3ee780a27cbcb82f1844750ea6f642833a44d29b4

SHA512
316ecacc34136294ce11dcb6d0f292570ad0515f799fd59fbff5e7121799860b1347d802b6439a291f029573a3715e043009e2c1d5275f38957be9e04f92e62e

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Europe\Luxembourg

Filesize
2KB

MD5
355f0d3e2a3ee15ea78526f5eeb0cf7d

SHA1
d90f3247c4716c2e1068d5ad9c88ca2091bec4e8

SHA256
812f55aeb6e8cde9ddf4786e15eb4256b21e82cf5f5d28da1bad17d94570cac0

SHA512
96a5fa48a15167e55ffad5b0241c90caeb7f0433ad62dd43463a4c52c25c59f7357681cb586fc52e812e8173adc12cec9eff66d27d5f41e19d55f6c1fce12937

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Europe\Podgorica

Filesize
1KB

MD5
6213fc0a706f93af6ff6a831fecbc095

SHA1
961a2223fd1573ab344930109fbd905336175c5f

SHA256
3a95adb06156044fd2fa662841c0268c2b5af47c1b19000d9d299563d387093a

SHA512
8149de3fd09f8e0f5a388f546ffe8823bdcda662d3e285b5cebc92738f0c6548ccb6ed2a5d086fd738cb3edc8e9e1f81c5e2e48edb0571e7ea7f131675b99327

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Europe\Uzhgorod

Filesize
2KB

MD5
114c4219e41d9cf8eaa77e13f87fabb6

SHA1
946d9ae0ff7ee36e2d8809629da945ae868f4d65

SHA256
fb0ae91bd8cfb882853f5360055be7c6c3117fd2ff879cf727a4378e3d40c0d3

SHA512
e353e9bd9d33921ac09decb3964c5065c88db29bd16a37e2cb9746bc1aca060c263c8bceb069134c933ad0b7ab2748a1db54f6cbad670b959895262afd749c6d

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Europe\Vatican

Filesize
2KB

MD5
de64f32dd64c6b15a78bbd84384827fb

SHA1
2ef35f507ab176828a5c751f702144ede463e385

SHA256
d5ade82cc4a232949b87d43157c84b2c355b66a6ac87cf6250ed6ead80b5018f

SHA512
1114ac9f1aec20a3db5736b795de71c7745e96377588d617003a7c1da07e0fd408b4bbe711aca3fb5e591058fa6b422106db0dfdc01320af41dca1e1eace7cea

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Europe\Zurich

Filesize
1KB

MD5
2da42297275a23b4a6b99702cf995583

SHA1
782d7d6812933a263ebfff012a0120d480071b1b

SHA256
2b9418ed48e3d9551c84a4786e185bd2181d009866c040fbd729170d038629ef

SHA512
68837833426fe905b74a9364496c572e3157c0c7cf179688e7facb7370fab3f01edf08421998dade9023c6bc17ab9b84eef2154a0ec83a8f7b85992bc9b88d1b

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Indian\Cocos

Filesize
254B

MD5
7248ff08276bcb74384e75af8450fd0b

SHA1
10c4f4d196227070b7b896fe50429cc6db268d37

SHA256
fd81c04aae19e5871420b21d844ce0dbb0862f36ab5073c31ecd438f44203463

SHA512
537131af968708fdda913e12285c8fdfe99f95330d830377bc63c3e6d8c25c573575096068a27b0773117d62978775c1da5ad5b56345b22f6d6ea9906ac77976

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Indian\Mahe

Filesize
151B

MD5
839bfcfd8ef482f11433df7633056fb9

SHA1
06f88ab61b092bff63b9507aff7d0e947814449a

SHA256
a667613e16894702b038dbf18993467854880a3956cf263d265147bfe1fdba96

SHA512
e9125cc5be8b748cddd1c0a0914c6b284b1cfc54ffa6dead8d5ebd2c03fc7009330a5e14dbf5e87d7c185be0c2e51620a0c4c0efb7fcc2ffa3d9c3b0936ed423

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Israel

Filesize
2KB

MD5
570f4cd5d0ee9ebe57259c7ded62de1d

SHA1
89e42d27cfb78255ae18ee02f5a4c8e3ba57dde0

SHA256
254b964265b94e16b4a498f0eb543968dec25f4cf80fba29b3d38e4a775ae837

SHA512
6b89b8e78404ba60b8cb2c4bf1b22482968cf07e1d87c43f10205f915fa56d1a1bfc67ce89a84e625d625766fd1fe001d96070c74654e58c420eb3ae3ed07406

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\NZ

Filesize
2KB

MD5
77332ae81e8f657034dd1e92e77716f1

SHA1
78d4d3a481c49ab7ff31722bced30e1c31e8bc98

SHA256
8000e3a323e8fd0212414e9426b020707a771c368ca0e151747f9ddb7b814b27

SHA512
ddfc24fd77bba175c9365bc4683260fe5d66c03c4f6035d9c74273a19ccc4e1733af4ead7cb9927bb2b6406cd2efabfb4457c2d2d12027600f0938b989fbf2a0

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Navajo

Filesize
2KB

MD5
648f67a7744849f2ca07f4d5871e9021

SHA1
faa7d6cf4178d032d8ba8a4d77eac0fd47f8a718

SHA256
32e819c00a43b3c348f539d700d425504f20b8d068c16418d26fa9b693e775c9

SHA512
3dab6d6a04a4856cba78ef499f1a436f1f71b1dea494ee098b76c1702531108ae0a1d7b6de05e9d9315027624b790e084d69b25507738099f6026cd2a9559f31

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Pacific\Ponape

Filesize
152B

MD5
a9ccb2437e66d134253b658fb7d37dc6

SHA1
6d2aeb6f99fbb109cc8f8dc33e85607c95071865

SHA256
3389135aa69241a57500c8722d2be6c2804917b5fd89cac82dbbd0270a7de348

SHA512
603fa4d5cff8af47b19b0c46bdae3db501a811f0d952288fe1d2e6e5ce1bad22da10b13bc531fa83ab147a1c76c8d8e5c9c9c651ede6400127fdf069144e20a2

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Pacific\Port_Moresby

Filesize
172B

MD5
ec972f59902432836f93737f75c5116f

SHA1
331542d6faf6ab15ffd364d57fbaa62629b52b94

SHA256
9c1dfa1c15994dd8774e53f40cb14dcf529143468721f1dba7b2c2e14ae9f5f0

SHA512
e8e8c8f6d096c352d1244280254e4c6ecf93f7c2ff69ecc6fa4363a6be8a2daf6cfcd7f0d96bc2669268ced5565532fa06be348a139b0742ccccb83953c6324d

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Pacific\Samoa

Filesize
175B

MD5
c14f2b93f0df81c20caa20bb4cac3773

SHA1
4c388c7f9a7700517fc6577943f3efe3bdddd3eb

SHA256
7c262b62985863aad47f13b0ef5db2e5cc917b5d38002de9a2ea83ddb0883458

SHA512
de7fad8c156a159afc0422e2622096182c8e0f284e0971963f9793042983764de331e3eca316ce9d2f30c6adc9e65ac99178cea62ba7f119f2a99c8318e7be4e

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Pacific\Tarawa

Filesize
152B

MD5
5bdd7374e21e3df324a5b3d178179715

SHA1
244ed7d52bc39d915e1f860727ecfe3f4b1ae121

SHA256
53268a8a6b11f0b8e02fc67683ae48d074efaf7b4c66e036c1478107afd9a7d7

SHA512
9c76f39e8795c50e6c5b384a7ff1f308a1c5173f42f810759b36cdeae7d33d1dac4934efeed580c59d988c152e2d7f8d9b8eb2073ab1fc15e4b9c10900c7b383

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Singapore

Filesize
401B

MD5
66cc16c6ede92b57c939b9354fd223d4

SHA1
67497848634496fcba203626ea34b123c4021aa9

SHA256
5e67952267aa709f212739bb4e302d8b59d6240c5ac0eaaaee32330e71d7da12

SHA512
30c2af799f00f1e4e0d4b5a29b58da616e17432792c22e428b5755ab15d4c6ab914877d32b4bd4a6fa90a83f64bfa8fbfc5de507b8535732973bf3ce0a31ea11

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\Turkey

Filesize
1KB

MD5
af3d9edd5f254a93254e2966cd0c9a79

SHA1
f8e94d99f4b59c4e819fdc581b1fd596d443cbbc

SHA256
264e308e7743b5afee2d673c5b57567636dabc925bb0be513939996e856718a5

SHA512
9c12658836c6532382e824bf98c207d291e244d751e880f9191b361cfdcdf0d11f4ecf30c760a17e9b5067add0338990b607dfea35154b35371dae77de6819a3

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\US\Aleutian

Filesize
2KB

MD5
f43102c06ca5450a97e9467f49bed36a

SHA1
be58a7c839146fa675eeb6dad748c08d0647542c

SHA256
201d4387025000a6e13c9f631cb7fccd6e4369dec7224052f9d86feb81353a53

SHA512
ba8cdb793975054121eb8284fdf41336428778e4b856d176ed8e55f16eab6b520a6bb42db2e36b81684589a46b3363e41681916c5c5a27a3c56b675fdf9b635b

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\US\Arizona

Filesize
360B

MD5
1df060a4c94a0ebf762fcb59b7d80f36

SHA1
a3f54df3a017c38626f04bd9576a0a11663303fd

SHA256
8a5973d2c62e2cbf2520f2b44e4a2ee9d2f455c93f0f45bfdeb4533af1584664

SHA512
6e23af75e75ada3590b01aad555efad958e1454201daf3480e28d8a1e4e4ae68a5e8546ad42ec5569e7e3afab902d804d9f85f03d9059dbd7eb2a6b02bde9490

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\US\Hawaii

Filesize
329B

MD5
4e7fd88341bd37b660769d4583914ac2

SHA1
5d5313bee3a467f7b5311b263c7d38b52f182164

SHA256
7f03d1bf5264e7ab023a2ef9b997ddfc8cb6936692407c770762b9c549523f33

SHA512
0d7a0a3aab195c1b8c5b58793f78182fe9340193434b95541c93caf0b9860e2e1c07bc77cb62424657feb8f193a5da55df77fdc52e730638dc7d4cc673eb6a82

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pytz\zoneinfo\US\Indiana-Starke

Filesize
2KB

MD5
6222edd349522509c7fb2b88c572b8d6

SHA1
41fdfe70a9789d427dc4be468f559a97ee9fcf54

SHA256
0acbd9e412b0daa55abf7c7f17c094f6d68974393b8d7e3509fb2a9acea35d5f

SHA512
c77ee10b4426714ddda394e4d487b4369109e62fb8869f801c06d44a36a73887c9d9a02d0e669ef71f2851647a480e994bf18d9d5c45bcfb4670fb7cf6f8ea71

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\pywintypes311.dll

Filesize
131KB

MD5
90b786dc6795d8ad0870e290349b5b52

SHA1
592c54e67cf5d2d884339e7a8d7a21e003e6482f

SHA256
89f2a5c6be1e70b3d895318fdd618506b8c0e9a63b6a1a4055dff4abdc89f18a

SHA512
c6e1dbf25d260c723a26c88ec027d40d47f5e28fc9eb2dbc72a88813a1d05c7f75616b31836b68b87df45c65eef6f3eaed2a9f9767f9e2f12c45f672c2116e72

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\vcruntime140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\vcruntime140_1.dll

Filesize
48KB

MD5
7e668ab8a78bd0118b94978d154c85bc

SHA1
dbac42a02a8d50639805174afd21d45f3c56e3a0

SHA256
e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f

SHA512
72bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032

Download Submit
C:\Users\Admin\Downloads\pyla\pyla\win32ui.pyd

Filesize
1.1MB

MD5
0e96b5724c2213300864ceb36363097a

SHA1
151931d9162f9e63e8951fc44a9b6d89af7af446

SHA256
85cf3081b0f1adafdbdcf164d7788a7f00e52bacdf02d1505812de4facfc962f

SHA512
46e8fee7b12f061ea8a7ab0cd4a8e683946684388498d6117afc404847b9fbb0a16dc0e5480609b1352df8f61457dcdbda317248ca81082cc4f30e29a3242d3b

Download Submit
memory/5552-21209-0x000001E85AA50000-0x000001E85AA51000-memory.dmp

Filesize
4KB

Download
memory/5552-21215-0x000001E85AAF0000-0x000001E85AAF1000-memory.dmp

Filesize
4KB

Download
memory/5552-21200-0x000001E851D80000-0x000001E851D90000-memory.dmp

Filesize
64KB

Download
memory/5552-21207-0x000001E85A9D0000-0x000001E85A9D1000-memory.dmp

Filesize
4KB

Download
memory/5552-21196-0x000001E851D40000-0x000001E851D50000-memory.dmp

Filesize
64KB

Download
memory/5552-21211-0x000001E85AA50000-0x000001E85AA51000-memory.dmp

Filesize
4KB

Download
memory/5552-21212-0x000001E85AAE0000-0x000001E85AAE1000-memory.dmp

Filesize
4KB

Download
memory/5552-21213-0x000001E85AAE0000-0x000001E85AAE1000-memory.dmp

Filesize
4KB

Download
memory/5552-21214-0x000001E85AAF0000-0x000001E85AAF1000-memory.dmp

Filesize
4KB

Download
memory/5868-21223-0x0000027E3E700000-0x0000027E3E701000-memory.dmp

Filesize
4KB

Download
memory/5868-21224-0x0000027E3E700000-0x0000027E3E701000-memory.dmp

Filesize
4KB

Download
memory/5868-21225-0x0000027E3E700000-0x0000027E3E701000-memory.dmp

Filesize
4KB

Download
memory/5868-21229-0x0000027E3E700000-0x0000027E3E701000-memory.dmp

Filesize
4KB

Download
memory/5868-21235-0x0000027E3E700000-0x0000027E3E701000-memory.dmp

Filesize
4KB

Download
memory/5868-21234-0x0000027E3E700000-0x0000027E3E701000-memory.dmp

Filesize
4KB

Download
memory/5868-21233-0x0000027E3E700000-0x0000027E3E701000-memory.dmp

Filesize
4KB

Download
memory/5868-21232-0x0000027E3E700000-0x0000027E3E701000-memory.dmp

Filesize
4KB

Download
memory/5868-21231-0x0000027E3E700000-0x0000027E3E701000-memory.dmp

Filesize
4KB

Download
memory/5868-21230-0x0000027E3E700000-0x0000027E3E701000-memory.dmp

Filesize
4KB

Download
memory/6088-21180-0x00007FF948970000-0x00007FF94AA26000-memory.dmp

Filesize
32.7MB

Download