325420b49220c37a246835f3696672b280de383baf49a7d790c2bbfeae6a3923

Analysis

max time kernel
91s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nightlight-v.1.6.zip
Size 34.0MB
Sample241110-behynawejd
SHA256 325420b49220c37a246835f3696672b280de383baf49a7d790c2bbfeae6a3923
MD5 3be558bc5eec26670a00303ae63af6dc
SHA1 b06795688d2552516c7c47c9fca8e84ab08db46b
SHA512 3ad04f698f7d426669e992e74fd31525d8c6ede1093637a1d6fec73ef4c0ef7c1b5b2ca96f4f8bd0d4199e09dc515d3d1d7ef2662ca9beb0971bfa83025694d6
SSDEEP 786432:f2juf4wsijiSLfvNqOqJISVq2S91BRrK2eCEijVI6JdgEkGaN4z:fGuf46ZLnNqHJISlS9heCEMiA5kRSz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

credential_access defense_evasion discovery persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\‍ ‌ .scr	nightlight.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\‍ ‌ .scr	nightlight.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\‍ ‌ .scr	attrib.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ‏.scr	nightlight.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ‏.scr	nightlight.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ‏.scr	attrib.exe

Executes dropped EXE 4 IoCs

pid	Process
1724	nightlight.exe
4748	nightlight.exe
2888	nightlight.exe
2608	nightlight.exe

Loads dropped DLL 64 IoCs

pid	Process
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
2608	nightlight.exe
2608	nightlight.exe
2608	nightlight.exe
2608	nightlight.exe
2608	nightlight.exe
2608	nightlight.exe
2608	nightlight.exe
2608	nightlight.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
45	discord.com
49	discord.com
57	raw.githubusercontent.com
61	discord.com
38	raw.githubusercontent.com
39	raw.githubusercontent.com
44	discord.com
50	discord.com
58	discord.com
60	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
47	ip-api.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
916	cmd.exe
4796	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000024070-768.dat	upx
behavioral1/memory/4748-772-0x00007FFC718B0000-0x00007FFC71E98000-memory.dmp	upx
behavioral1/files/0x0007000000023c87-774.dat	upx
behavioral1/memory/4748-782-0x00007FFC82CA0000-0x00007FFC82CAF000-memory.dmp	upx
behavioral1/files/0x0008000000023ca2-781.dat	upx
behavioral1/memory/4748-780-0x00007FFC825C0000-0x00007FFC825E4000-memory.dmp	upx
behavioral1/files/0x0007000000023c85-783.dat	upx
behavioral1/files/0x0007000000023c8a-786.dat	upx
behavioral1/memory/4748-787-0x00007FFC81CC0000-0x00007FFC81CD9000-memory.dmp	upx
behavioral1/files/0x0007000000023c91-807.dat	upx
behavioral1/files/0x000700000002406e-808.dat	upx
behavioral1/memory/4748-809-0x00007FFC73ED0000-0x00007FFC73F05000-memory.dmp	upx
behavioral1/files/0x0007000000023c90-806.dat	upx
behavioral1/files/0x0007000000023c8f-805.dat	upx
behavioral1/files/0x0007000000023c8e-804.dat	upx
behavioral1/files/0x0007000000023c8d-803.dat	upx
behavioral1/files/0x0007000000023c8c-802.dat	upx
behavioral1/files/0x0007000000023c8b-801.dat	upx
behavioral1/files/0x0007000000023c89-800.dat	upx
behavioral1/files/0x0007000000023c88-799.dat	upx
behavioral1/files/0x0007000000023c86-798.dat	upx
behavioral1/files/0x0007000000023c84-797.dat	upx
behavioral1/files/0x000700000002407f-795.dat	upx
behavioral1/files/0x000700000002407e-794.dat	upx
behavioral1/files/0x0007000000024074-793.dat	upx
behavioral1/files/0x0007000000023caa-790.dat	upx
behavioral1/files/0x0007000000023ca9-789.dat	upx
behavioral1/memory/4748-788-0x00007FFC7DFA0000-0x00007FFC7DFCD000-memory.dmp	upx
behavioral1/memory/4748-813-0x00007FFC82B60000-0x00007FFC82B6D000-memory.dmp	upx
behavioral1/memory/4748-812-0x00007FFC7EFE0000-0x00007FFC7EFF9000-memory.dmp	upx
behavioral1/memory/4748-816-0x00007FFC82A00000-0x00007FFC82A0D000-memory.dmp	upx
behavioral1/files/0x0007000000024073-815.dat	upx
behavioral1/files/0x0007000000024072-819.dat	upx
behavioral1/files/0x0007000000024082-822.dat	upx
behavioral1/memory/4748-826-0x00007FFC717F0000-0x00007FFC718AC000-memory.dmp	upx
behavioral1/memory/4748-825-0x00007FFC72500000-0x00007FFC7252B000-memory.dmp	upx
behavioral1/memory/4748-824-0x00007FFC72530000-0x00007FFC7255E000-memory.dmp	upx
behavioral1/memory/4748-823-0x00007FFC718B0000-0x00007FFC71E98000-memory.dmp	upx
behavioral1/memory/4748-827-0x00007FFC825C0000-0x00007FFC825E4000-memory.dmp	upx
behavioral1/memory/4748-830-0x00007FFC716D0000-0x00007FFC717EC000-memory.dmp	upx
behavioral1/memory/4748-829-0x00007FFC82CA0000-0x00007FFC82CAF000-memory.dmp	upx
behavioral1/memory/4748-833-0x00007FFC716A0000-0x00007FFC716CE000-memory.dmp	upx
behavioral1/memory/4748-832-0x00007FFC7DFA0000-0x00007FFC7DFCD000-memory.dmp	upx
behavioral1/memory/4748-838-0x00007FFC71260000-0x00007FFC715D5000-memory.dmp	upx
behavioral1/memory/4748-840-0x00007FFC7EFE0000-0x00007FFC7EFF9000-memory.dmp	upx
behavioral1/memory/4748-835-0x00007FFC715E0000-0x00007FFC71698000-memory.dmp	upx
behavioral1/files/0x000700000002408b-841.dat	upx
behavioral1/memory/4748-843-0x00007FFC711D0000-0x00007FFC71257000-memory.dmp	upx
behavioral1/memory/4748-845-0x00007FFC7E730000-0x00007FFC7E744000-memory.dmp	upx
behavioral1/files/0x0007000000023c98-846.dat	upx
behavioral1/memory/4748-851-0x00007FFC711A0000-0x00007FFC711C6000-memory.dmp	upx
behavioral1/memory/4748-850-0x00007FFC81E70000-0x00007FFC81E7B000-memory.dmp	upx
behavioral1/files/0x0007000000023c99-849.dat	upx
behavioral1/memory/4748-856-0x00007FFC73E30000-0x00007FFC73E48000-memory.dmp	upx
behavioral1/memory/4748-857-0x00007FFC716D0000-0x00007FFC717EC000-memory.dmp	upx
behavioral1/memory/4748-855-0x00007FFC7DF90000-0x00007FFC7DF9A000-memory.dmp	upx
behavioral1/files/0x0007000000023ccd-854.dat	upx
behavioral1/memory/4748-859-0x00007FFC71170000-0x00007FFC71193000-memory.dmp	upx
behavioral1/memory/4748-861-0x00007FFC70FF0000-0x00007FFC71163000-memory.dmp	upx
behavioral1/memory/4748-860-0x00007FFC715E0000-0x00007FFC71698000-memory.dmp	upx
behavioral1/memory/4748-858-0x00007FFC716A0000-0x00007FFC716CE000-memory.dmp	upx
behavioral1/memory/4748-870-0x00007FFC70FA0000-0x00007FFC70FAB000-memory.dmp	upx
behavioral1/memory/4748-881-0x00007FFC70EE0000-0x00007FFC70EEC000-memory.dmp	upx
behavioral1/memory/4748-880-0x00007FFC70EF0000-0x00007FFC70F02000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1860	netsh.exe
2088	netsh.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1840	WMIC.exe
4516	WMIC.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
4748	nightlight.exe
2608	nightlight.exe
2608	nightlight.exe
2608	nightlight.exe
2608	nightlight.exe
2608	nightlight.exe
2608	nightlight.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2224	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2224	7zFM.exe
Token: 35	2224	7zFM.exe
Token: SeSecurityPrivilege	2224	7zFM.exe
Token: SeSecurityPrivilege	2224	7zFM.exe
Token: SeDebugPrivilege	4748	nightlight.exe
Token: SeIncreaseQuotaPrivilege	2932	WMIC.exe
Token: SeSecurityPrivilege	2932	WMIC.exe
Token: SeTakeOwnershipPrivilege	2932	WMIC.exe
Token: SeLoadDriverPrivilege	2932	WMIC.exe
Token: SeSystemProfilePrivilege	2932	WMIC.exe
Token: SeSystemtimePrivilege	2932	WMIC.exe
Token: SeProfSingleProcessPrivilege	2932	WMIC.exe
Token: SeIncBasePriorityPrivilege	2932	WMIC.exe
Token: SeCreatePagefilePrivilege	2932	WMIC.exe
Token: SeBackupPrivilege	2932	WMIC.exe
Token: SeRestorePrivilege	2932	WMIC.exe
Token: SeShutdownPrivilege	2932	WMIC.exe
Token: SeDebugPrivilege	2932	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2932	WMIC.exe
Token: SeRemoteShutdownPrivilege	2932	WMIC.exe
Token: SeUndockPrivilege	2932	WMIC.exe
Token: SeManageVolumePrivilege	2932	WMIC.exe
Token: 33	2932	WMIC.exe
Token: 34	2932	WMIC.exe
Token: 35	2932	WMIC.exe
Token: 36	2932	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2932	WMIC.exe
Token: SeSecurityPrivilege	2932	WMIC.exe
Token: SeTakeOwnershipPrivilege	2932	WMIC.exe
Token: SeLoadDriverPrivilege	2932	WMIC.exe
Token: SeSystemProfilePrivilege	2932	WMIC.exe
Token: SeSystemtimePrivilege	2932	WMIC.exe
Token: SeProfSingleProcessPrivilege	2932	WMIC.exe
Token: SeIncBasePriorityPrivilege	2932	WMIC.exe
Token: SeCreatePagefilePrivilege	2932	WMIC.exe
Token: SeBackupPrivilege	2932	WMIC.exe
Token: SeRestorePrivilege	2932	WMIC.exe
Token: SeShutdownPrivilege	2932	WMIC.exe
Token: SeDebugPrivilege	2932	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2932	WMIC.exe
Token: SeRemoteShutdownPrivilege	2932	WMIC.exe
Token: SeUndockPrivilege	2932	WMIC.exe
Token: SeManageVolumePrivilege	2932	WMIC.exe
Token: 33	2932	WMIC.exe
Token: 34	2932	WMIC.exe
Token: 35	2932	WMIC.exe
Token: 36	2932	WMIC.exe
Token: SeIncreaseQuotaPrivilege	876	wmic.exe
Token: SeSecurityPrivilege	876	wmic.exe
Token: SeTakeOwnershipPrivilege	876	wmic.exe
Token: SeLoadDriverPrivilege	876	wmic.exe
Token: SeSystemProfilePrivilege	876	wmic.exe
Token: SeSystemtimePrivilege	876	wmic.exe
Token: SeProfSingleProcessPrivilege	876	wmic.exe
Token: SeIncBasePriorityPrivilege	876	wmic.exe
Token: SeCreatePagefilePrivilege	876	wmic.exe
Token: SeBackupPrivilege	876	wmic.exe
Token: SeRestorePrivilege	876	wmic.exe
Token: SeShutdownPrivilege	876	wmic.exe
Token: SeDebugPrivilege	876	wmic.exe
Token: SeSystemEnvironmentPrivilege	876	wmic.exe
Token: SeRemoteShutdownPrivilege	876	wmic.exe
Token: SeUndockPrivilege	876	wmic.exe
Token: SeManageVolumePrivilege	876	wmic.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2224	7zFM.exe
2224	7zFM.exe
2224	7zFM.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 4748	1724	nightlight.exe	108
PID 1724 wrote to memory of 4748	1724	nightlight.exe	108
PID 4748 wrote to memory of 1372	4748	nightlight.exe	109
PID 4748 wrote to memory of 1372	4748	nightlight.exe	109
PID 4748 wrote to memory of 4796	4748	nightlight.exe	113
PID 4748 wrote to memory of 4796	4748	nightlight.exe	113
PID 4796 wrote to memory of 3476	4796	cmd.exe	115
PID 4796 wrote to memory of 3476	4796	cmd.exe	115
PID 4748 wrote to memory of 1860	4748	nightlight.exe	118
PID 4748 wrote to memory of 1860	4748	nightlight.exe	118
PID 4748 wrote to memory of 2120	4748	nightlight.exe	122
PID 4748 wrote to memory of 2120	4748	nightlight.exe	122
PID 2120 wrote to memory of 2932	2120	cmd.exe	124
PID 2120 wrote to memory of 2932	2120	cmd.exe	124
PID 4748 wrote to memory of 876	4748	nightlight.exe	125
PID 4748 wrote to memory of 876	4748	nightlight.exe	125
PID 4748 wrote to memory of 4960	4748	nightlight.exe	127
PID 4748 wrote to memory of 4960	4748	nightlight.exe	127
PID 4960 wrote to memory of 1840	4960	cmd.exe	129
PID 4960 wrote to memory of 1840	4960	cmd.exe	129
PID 4748 wrote to memory of 4424	4748	nightlight.exe	130
PID 4748 wrote to memory of 4424	4748	nightlight.exe	130
PID 4424 wrote to memory of 2784	4424	cmd.exe	132
PID 4424 wrote to memory of 2784	4424	cmd.exe	132
PID 4748 wrote to memory of 4452	4748	nightlight.exe	133
PID 4748 wrote to memory of 4452	4748	nightlight.exe	133
PID 4452 wrote to memory of 2336	4452	cmd.exe	135
PID 4452 wrote to memory of 2336	4452	cmd.exe	135
PID 4748 wrote to memory of 3972	4748	nightlight.exe	136
PID 4748 wrote to memory of 3972	4748	nightlight.exe	136
PID 3972 wrote to memory of 4364	3972	cmd.exe	138
PID 3972 wrote to memory of 4364	3972	cmd.exe	138
PID 4748 wrote to memory of 1772	4748	nightlight.exe	140
PID 4748 wrote to memory of 1772	4748	nightlight.exe	140
PID 2888 wrote to memory of 2608	2888	nightlight.exe	149
PID 2888 wrote to memory of 2608	2888	nightlight.exe	149
PID 2608 wrote to memory of 428	2608	nightlight.exe	150
PID 2608 wrote to memory of 428	2608	nightlight.exe	150
PID 2608 wrote to memory of 916	2608	nightlight.exe	153
PID 2608 wrote to memory of 916	2608	nightlight.exe	153
PID 916 wrote to memory of 2832	916	cmd.exe	155
PID 916 wrote to memory of 2832	916	cmd.exe	155
PID 2608 wrote to memory of 2088	2608	nightlight.exe	156
PID 2608 wrote to memory of 2088	2608	nightlight.exe	156
PID 2608 wrote to memory of 4408	2608	nightlight.exe	158
PID 2608 wrote to memory of 4408	2608	nightlight.exe	158
PID 4408 wrote to memory of 608	4408	cmd.exe	160
PID 4408 wrote to memory of 608	4408	cmd.exe	160
PID 2608 wrote to memory of 4852	2608	nightlight.exe	161
PID 2608 wrote to memory of 4852	2608	nightlight.exe	161
PID 2608 wrote to memory of 2256	2608	nightlight.exe	163
PID 2608 wrote to memory of 2256	2608	nightlight.exe	163
PID 2256 wrote to memory of 4516	2256	cmd.exe	165
PID 2256 wrote to memory of 4516	2256	cmd.exe	165
PID 2608 wrote to memory of 2308	2608	nightlight.exe	166
PID 2608 wrote to memory of 2308	2608	nightlight.exe	166
PID 2308 wrote to memory of 2252	2308	cmd.exe	168
PID 2308 wrote to memory of 2252	2308	cmd.exe	168
PID 2608 wrote to memory of 1476	2608	nightlight.exe	169
PID 2608 wrote to memory of 1476	2608	nightlight.exe	169
PID 1476 wrote to memory of 4020	1476	cmd.exe	171
PID 1476 wrote to memory of 4020	1476	cmd.exe	171
PID 2608 wrote to memory of 5080	2608	nightlight.exe	172
PID 2608 wrote to memory of 5080	2608	nightlight.exe	172

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3476	attrib.exe
2832	attrib.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Nightlight-v.1.6.zip"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4748

C:\Users\Admin\Desktop\Nightlight-v.1.6\nightlight.exe
"C:\Users\Admin\Desktop\Nightlight-v.1.6\nightlight.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\Desktop\Nightlight-v.1.6\nightlight.exe
  "C:\Users\Admin\Desktop\Nightlight-v.1.6\nightlight.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ‏.scr"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ‏.scr"
      4⤵
      Drops startup file
      Views/modifies file attributes
      PID:3476
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2932
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:2784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
      4⤵
      PID:2336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path softwarelicensingservice get OA3xOriginalProductKey
      4⤵
      PID:4364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:1772
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:3200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Nightlight-v.1.6\setup.bat" "
1⤵
PID:3404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Nightlight-v.1.6\setup.bat" "
1⤵
PID:4144

C:\Users\Admin\Desktop\Nightlight-v.1.6\nightlight.exe
"C:\Users\Admin\Desktop\Nightlight-v.1.6\nightlight.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\Desktop\Nightlight-v.1.6\nightlight.exe
  "C:\Users\Admin\Desktop\Nightlight-v.1.6\nightlight.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\‍ ‌ .scr"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:916
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\‍ ‌ .scr"
      4⤵
      Drops startup file
      Views/modifies file attributes
      PID:2832
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:608
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:4852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:2252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
      4⤵
      PID:4020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
    3⤵
    PID:5080
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path softwarelicensingservice get OA3xOriginalProductKey
      4⤵
      PID:1316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:4752
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cc's.txt

Path C:\Users\Admin\AppData\Local\Temp\UibpbNHi23\Browser\cc's.txt
Size 91B
SHA256 c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c
MD5 5aa796b6950a92a226cc5c98ed1c47e8
SHA1 6706a4082fc2c141272122f1ca424a446506c44d
SHA512 976f403257671e8f652bf988f4047202e1a0fd368fdb2bab2e79ece1c20c7eb775c4b3a8853c223d4f750f4192cd09455ff024918276dc1dd1442fa3b36623ad
MD5 SHA1 SHA512

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\UibpbNHi23\Browser\history.txt
Size 23B
SHA256 4db7f6559c454d34d9c2d557524603c3f52649c2d69b26b6e8384a3d179aeae6
MD5 5638715e9aaa8d3f45999ec395e18e77
SHA1 4e3dc4a1123edddf06d92575a033b42a662fe4ad
SHA512 78c96efab1d941e34d3137eae32cef041e2db5b0ebbf883e6a2effa79a323f66e00cfb7c45eb3398b3cbd0469a2be513c3ff63e5622261857eefc1685f77f76b
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\VCRUNTIME140.dll
Size 96KB
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
SSDEEP 1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\VCRUNTIME140_1.dll
Size 37KB
SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
MD5 75e78e4bf561031d39f86143753400ff
SHA1 324c2a99e39f8992459495182677e91656a05206
SHA512 ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756
SSDEEP 768:Xhh4pTUUtmUwqiu8oSRjez6SD7GkxZYj/9zLUr:xJ9x70GkxuZz2
MD5 SHA1 SHA512 SSDEEP

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\_asyncio.pyd
Size 34KB
SHA256 11f1062fafb4fbca92e3b2cef97ab66ec011142f5b0312e74815decd93be458b
MD5 936e44a303a5957709434a0c6bf4532e
SHA1 e35f0b78f61797d9277741a1ee577b5fe7af3d62
SHA512 cebe905b718825c1841e9c0e83dfdac95d0ff50b116ab3b91b05ca21f86f1482f5b1e13988c969244c644d17bd378792ac4967caa721f0b0e858cd92859af154
SSDEEP 768:PnHYfVmoLOfek+D29R73mq5QQKsapN0ID5nuXYiSyvvNPxWETS:PnHsIfeRD2jaqK/X0ID5nuX7SytPxE
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\_bz2.pyd
Size 46KB
SHA256 47af0730824f96865b5e20f8bba34b0d5f3a330087411adba71269312bf7ccec
MD5 af3d45698d379c97a90cca9625bc5926
SHA1 0783866af330c1029253859574c369901969208e
SHA512 117e95d2ba0432f5ece882ad67a3fbf2e2cd251b4327a0d66b3fffd444e2d1813ddb568321bde1636b4180d19607db6103df145153e4ff84e9be601fd2dd5691
SSDEEP 768:5wAGUM8GBetg87It88blNUL6yfsFtHrrhhto+MQw5aZ/hLYpUHIDtVzR3YiSyvLk:uAG/k9MjCDErhhmQXfTHIDtVzV7SyD85
MD5 SHA1 SHA512 SSDEEP

Submit Download

_cffi_backend.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\_cffi_backend.cp311-win_amd64.pyd
Size 71KB
SHA256 34dff4546abf4cd9d1e605f215339e6816c3aa4ef3c6028afcf00cb6241dbccf
MD5 f5a0e3f73ad4002839a85ec9b5285cc0
SHA1 2657e49964491d8b0784ab6ae157c767cf809673
SHA512 81d683f45b6ea1b48d0e377779c9b87ddff5b8549f00ae375ebe617fbd00d0149639a2b5c1b42ea536bde786aea50025646311b3de243c48ed192014dcc9974b
SSDEEP 1536:Evgk4m5SIc455nfx3a1fH/MIaSEZgKrZxERWNbT:SwErnfx32jlvI4WN
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\_ctypes.pyd
Size 57KB
SHA256 490a11d03dd3aeb05a410eb0d285e3da788e73b643ea9914fffd5a2c102dc1df
MD5 2346cf6a1ad336f3ee23c4ec3ff7871c
SHA1 e36b759c0b78d2def431aa11bcbb7d7cf02f1eea
SHA512 7a92de4937b23952e2a31bb09a58b2ad81c06da23704e4b4f964eb42948adad1a1e57920c021283da1b7154e7ac19e46031ffee6b69a73acbc85d95ef45bf8ff
SSDEEP 1536:kbWq49sE7fzlG5lNXdrYMP0MkeBvGhd0LYXIDQPTl7Syw0Pxv:kbWqKT1GLZdrDkHhOEXIDQPTl6Exv
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\_decimal.pyd
Size 104KB
SHA256 15668e03f9c55f07184ec9c048a8569f7d7ebd9ea6dbef145f1f3b581f8623f3
MD5 9b801838394e97e30c99dcf5f9fcc8fa
SHA1 33fb049b2f98bcb2f2cb9508be2408a6698243be
SHA512 5f074c82f344ca43a07a59132fab59e3504e314a2f7673bfec906782b947daf8fe45a1b956f72502eae72f01369a3bb1fbb73b10dc605d43b889a6700bd98a28
SSDEEP 3072:0zsRxWJXVyOgbHffu+MLtWH/WSWXb01KQiID5q1CAt6xN:jU/gbHfW6WSWLplCuG
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\_hashlib.pyd
Size 33KB
SHA256 689f0ac1d44481688cd4ae90b6f801176a52ff4bb4170c62575ea58f44452e15
MD5 7fd141630dfa2500f5bf4c61e2c2d034
SHA1 0f8d1dfae2cbce1ad714c93216f01bf7001aabda
SHA512 c6b7b1aefb7280f38d63f4ab84a349ebb696ca7300b7a451e7a994baff7e0a83fb4488c43ed3160b94dec74e0d27417d68913056b3006c8c6da11e39681f512e
SSDEEP 768:0A1cXZ83zNDKJ/KDQI5zbp61ypRcTID5IubYiSyvaPxWEw:0wnzKUQ+p6mcTID5Iub7SyiPx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\_lzma.pyd
Size 84KB
SHA256 0ebdf15c1c6d59e49716dfb4601f0abe6383449c70db1a349c6ad486742144a8
MD5 ab6a735ad62592c7c8ea0b06cb57317a
SHA1 e27a0506800b5bbc2b350e39899d260164af2cd1
SHA512 9a285593cd8cc29844688723d8907e55a9f8a3109f9538cc4140912cc973f495de32779a4cd4a48dc62d680fdf81a5797e4e9c33f236a803082dfc3c00d02060
SSDEEP 1536:nImFQO4KV4FqKFztYJgYFlXeppHFEtnp8bacIUmDIDe1Ye7SyOePx:oO4KV0qKTYhFlupdQ8WLvIDe1Yehx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\_multiprocessing.pyd
Size 25KB
SHA256 04e56f1c6919f2987f205e9e3afa16d945eeaffa415c746104ccb7763c067f9c
MD5 241a977372d63b46b6ae4f7227579cc3
SHA1 21c8fa02217ec69c5cc9a1cc9edaa5de6f8d9f91
SHA512 7aeaa94a5cd46d604370e430c72724b683e149af7e032c85708e33bfb94fb6a9ccc52c70bc701dfb94b4ae55d4e8acd8e394efb6cd81466fd9fa1a6addaa4ecc
SSDEEP 768:Ny6HNbpr+8C6DJbpwDnIDRtuyYiSyvg7PxWEwm:H9+8FDgDnIDRtuy7SyI7Px7
MD5 SHA1 SHA512 SSDEEP

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\_overlapped.pyd
Size 30KB
SHA256 b1b56328df4b19cf04586303f693979536253078fc7017b4ac4ae6d730296b1f
MD5 ef52dc3e7d12795745e23487026a5b5e
SHA1 6c9f488a9eaabdc6db11ed2c32231d518a8b8f42
SHA512 8b3c311bf4a54eaa21fa1db058037b274bd3b9e838e844537269f8e0102ad47ca7181e73bbb4f5269100cfe82499bb0787bc04943b02e36ea0ab26bfa8e65326
SSDEEP 768:X1y7nuEu7eOHtaqrSNHrp9LhIDstetYiSyvYPxWEwW:8ruEuiON7raHfLhIDstet7SywPx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\_queue.pyd
Size 24KB
SHA256 3df280391d7275e73aef70af228bb21c03434147ae9fe31e8c620ea151e08b30
MD5 71955beaf83aca364ed64285021781ca
SHA1 cac93d08f9085079fb32e6fc6d8e4fc8cd9115e6
SHA512 9b055a0273ace0f9b673e015a20c8867689090608fffaf85c54636f061cf595de1e6c9bfc2d8ea75fa4dd247b4af0493022f24d6a931b53e7f60009a85b45601
SSDEEP 384:cB0Psz9rLZgNhzHjlnwX1hZa7gJXjDID7UuNBIYiSy1pCQYIPxh8E9VF0Nyb9:cvihFn43pzDID7Uu4YiSyv7PxWER
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\_socket.pyd
Size 41KB
SHA256 26200892f616f859e82c167701ab866b8291eabbe808dd18c434cc80ebeedf19
MD5 53dc1aa457a1e3b4f6c8baed19a6ca0a
SHA1 290a572e981cc5ce896dc52a53f112d9eaaefc39
SHA512 460de92115288e0e95fd03837df775e5f34425784c18ab7e9ad0885511166371647a6f06d95ffa6c3437de69895d46cd4cddcda2841ccdb5ef268b1a857837e6
SSDEEP 768:6Q8MABQICeXD2rh0LklHwh20hpJ72IDQwzFDYiSyvGPxWERfsxi:6TieXEhow072IDQwzFD7Sy+Px3sxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\_sqlite3.pyd
Size 54KB
SHA256 56f74ec6490b916c513b618635edaa22cb2374a92e5f79549c1e2b7c5c37f31d
MD5 1c5e0718dce15682d32185f1e1f8df7d
SHA1 f59662db717663ed1589328c5749bb8b44a0d053
SHA512 702f8348d2fe08ec10e0120129e64c12368c971ea52852cd0c7d26fd159f5b34bc808b9b318168aaa81366ed4944909e305d4e9727f0374d921eddb54ea22cf3
SSDEEP 1536:+fDL703/MAe3F53jYTG3vy+1MNLjZVID5QjI7SyBPx:YD03/MHbH6+eL/ID5QjIXx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\_ssl.pyd
Size 60KB
SHA256 dea09b9750c26813130ca32db0b4455796e12a3d61bb52066d5a53302bcce0ce
MD5 df5a6f6c547300a7c87005eb0fafcfa0
SHA1 c792342e964a1c8a776e5203f3eee7908e6cad09
SHA512 018a79871faa2cf6a1644e96f10750ddccccd56436720faf760808b1997940f9bcd2866a4533b903058ab608629ff8ed46fadb788e4a6714b19775d557dd69b0
SSDEEP 1536:06ll/oOM5AGIyI1asq3YGDTgzOordBQkJIDt7o7/7Syi/Px:h/6AGLIcsq3YGn0ZQuIDt7ojEHx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\_uuid.pyd
Size 21KB
SHA256 caabfac7123e70906fafe3a34d11c0c87c62695b2716a5f95b032bb54982744e
MD5 cf378e1866edaa02db65a838f0e0ad8e
SHA1 cc66b98b3289a126fa4cf960d89cbbecff0f5aa8
SHA512 cdb6fb5861fee4eeee49dd79ba164ef8538235b0b41e505dd59f1b5a79256390a4bb920ade9ff58abdc41c738ec6f316d387df4f588b673d8f324e5c1c32a9c5
SSDEEP 384:M+bjUslT27KvpCuNZa7gJXTkIDewOYKIYiSy1pCQIJPxh8E9VF0NyYk:M0j3ltLNpDkIDewO6YiSyvWPxWEW
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\base_library.zip
Size 1.4MB
SHA256 3242ea7a6c4c712f10108a619bf5213878146547838f7e2c1e80d2778eb0aaa0
MD5 481da210e644d6b317cafb5ddf09e1a5
SHA1 00fe8e1656e065d5cf897986c12ffb683f3a2422
SHA512 74d177794f0d7e67f64a4f0c9da4c3fd25a4d90eb909e942e42e5651cc1930b8a99eef6d40107aa8756e75ffbcc93284b916862e24262df897aaac97c5072210
SSDEEP 24576:6QRqL5TPAxNWlUKdcubgAnjK0H0AWfh7dYMbP/Medfb:6QRqL2xNEer
MD5 SHA1 SHA512 SSDEEP

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\certifi\cacert.pem
Size 292KB
SHA256 94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47
MD5 50ea156b773e8803f6c1fe712f746cba
SHA1 2c68212e96605210eddf740291862bdf59398aef
SHA512 01ed2e7177a99e6cb3fbef815321b6fa036ad14a3f93499f2cb5b0dae5b713fd2e6955aa05f6bda11d80e9e0275040005e5b7d616959b28efc62abb43a3238f0
SSDEEP 6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5 SHA1 SHA512 SSDEEP

Submit Download

md.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\charset_normalizer\md.cp311-win_amd64.pyd
Size 9KB
SHA256 6864ce58854fc54853f557c218bddbb73fe457b704bee24da84579d82aee6509
MD5 542c223312c5dbe5d21fc216dfb8cb7e
SHA1 c2922363caf50c40ac079786af12141f69248d5d
SHA512 2eab599c5ca6eeb8b80bccce839b37ca42c949d45d12981a1efe43df980736ede7b4fd1a23d2dbba7895948a8dfa79136549dffb9fdbf7110430f53fea557c31
SSDEEP 96:KG6jp/QthczuG47NfGTJiWpmLeiRrRcfuljG2+wUiVzTkYBbPJBj34lVhXg246aw:O6tq4hfGNpeeiTJxTkYj273QJXpHI8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

md__mypyc.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
Size 39KB
SHA256 4609d4065b796165f71f15a17dc43307219acaac2248e48c15e8e0b3ae5685be
MD5 d28bf4b47504d9fa10214d284bf47bca
SHA1 8ab2d660f00d4b0db47da1d691cb27c044240940
SHA512 e6dc5e31047ae7fbe81e80d86d42c6d34faa36c4812d6c640610fb5a679acd0890e10eae3d142dfed0b2b9474b83daf162b2bceb2cadc06a70a7115dd831e074
SSDEEP 768:AJWJjbkBClgXZHm7SIwqvEz/u11zxms4bpqK:fADmvwvzYWLgK
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\libcrypto-1_1.dll
Size 1.1MB
SHA256 6242d2e13aef871c4b8cfd75fc0f8530e8dccfeaba8f1b66280e9345f52b833b
MD5 571796599d616a0d12aa34be09242c22
SHA1 0e0004ab828966f0c8a67b2f10311bb89b6b74ac
SHA512 7362a6c887600fafc1a45413823f006589bb95a76ac052b6c7022356a7a9a6e8cd3e76f59cecf152e189323791d9626a6fdb7a98bf3a5250d517b746c3e84e84
SSDEEP 24576:nffQrZJIe6/4gho5HE1F03fkOyUU/BtSIgA0ft+rBFOWRIQ6sCY51CPwDv3uFfJv:ff8JWwgho5HL3fknPSIKorCU1CPwDv3a
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\libffi-8.dll
Size 24KB
SHA256 18c097ef19f3e502a025c1d63cfec73a4fa30c5482286f4000d40d4784a0070a
MD5 24ea21ebcc3bef497d2bd208e7986f88
SHA1 d936f79431517b9687ee54d837e9e4be7afc082d
SHA512 1bdbeddd812ecc2cdfbbf3498b0a8ef551cc18ce73fc30eb40b415fab0cdd20b80057a25a33ca2f9247b08978838df3587a3caf6e1a8e108c5a9a4f67dd75a94
SSDEEP 384:CJvjb6KaBBu0wYkP2C0yZbMRpZa7gJXMrRCXPDG4y8c3UhH3:6vj+3BcMp8KDG4yshH
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\libssl-1_1.dll
Size 203KB
SHA256 84e4c37fb28b6cf79e2386163fe6bb094a50c1e8825a4bcdb4cb216f4236d831
MD5 aabafc5d0e409123ae5e4523d9b3dee2
SHA1 4d0a1834ed4e4ceecb04206e203d916eb22e981b
SHA512 163f29ad05e830367af3f2107e460a587f4710b8d9d909a01e04cd8cfee115d8f453515e089a727a6466ce0e2248a56f14815588f7df6d42fe1580e1b25369cd
SSDEEP 3072:RSI3oPlWLlPVVc5MpJa1pOjJnnioIZW8/Qf6bRXGKrs8qJjueW1LR/oSB6hetz:sIek5VC0FiHof6Z1rgJ63R/oS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

luna.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\luna.aes
Size 294KB
SHA256 b5405574857254bfaaf444da5d11e8fcc087261cd7f3bb6d77b5237cc769a9d8
MD5 073300e100dc8efd99efd3c781515e0d
SHA1 0d67d3f1261fa50929841f354093743c7d77678e
SHA512 09f03eaa2f25fe7aaad32c09d3bae4f182cbcf4aa35e5202e31a7922328df72e8a3e3605ed286912a7267ffcb10ba9ced66ed474c3b7cd8b4ae99263a4354113
SSDEEP 6144:CGfp8Ys8W9v2kiudouf3OkwYY2xJcAG6sjzJ+UimezdKJYm8/5rtt0R4y:RCv2kiXSwYnxczJ+UimemYm8/dv0R4y
MD5 SHA1 SHA512 SSDEEP

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\psutil\_psutil_windows.pyd
Size 31KB
SHA256 92202b877579b74a87be769d58f9d1e8aced8a97336ad70e97d09685a10afeb3
MD5 3adca2ff39adeb3567b73a4ca6d0253c
SHA1 ae35dde2348c8490f484d1afd0648380090e74fc
SHA512 358d109b23cf99eb7396c450660f193e9e16f85f13737ecf29f4369b44f8356041a08443d157b325ccb5125a5f10410659761eda55f24fcc03a082ac8acdd345
SSDEEP 768:MEQsXhsJVH50FvAnRNI2xEY3/oQudyp6i6:h4JVO9WRe2xEY3/oQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\pyexpat.pyd
Size 86KB
SHA256 297ec9e654500400ba5731101b65d29c14d0305ae9f6c05b9763f57ab150b07d
MD5 c498ed10d7245560412f9df527508b5c
SHA1 b84b57a54a1a9c5631f4d0b8ac31694786cc822b
SHA512 ab8bcf6e4a395944316e19aa7aa598e8bfeaa038f4ae086fcede6d01747b670896d640dbf4992630fcbd737d2be3ab627b7be8ad36437629671387f4aaf85957
SSDEEP 1536:md2ZG27LFRlz41ZjiW6lNaE+hCsoVZ268gtw9IV1upHqCnqEIDQhFh7SyDPxB:md2ZVLZs2W6lNatksmlBtIIV1oFIDQhF
MD5 SHA1 SHA512 SSDEEP

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\python3.DLL
Size 64KB
SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
MD5 34e49bb1dfddf6037f0001d9aefe7d61
SHA1 a25a39dca11cdc195c9ecd49e95657a3e4fe3215
SHA512 edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856
SSDEEP 768:Apw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJU:V/5k8cnzeJH9IDQ0K7SyOPx
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\python311.dll
Size 1.6MB
SHA256 a67df621a383f4ce5a408e0debe3ebc49ffc766d6a1d6d9a7942120b8ec054dc
MD5 4fcf14c7837f8b127156b8a558db0bb2
SHA1 8de2711d00bef7b5f2dcf8a2c6871fa1db67cf1f
SHA512 7a6195495b48f66c35b273a2c9d7ff59e96a4180ea8503f31c8b131167c6cdddd8d6fe77388a34096964a73c85eab504281a14ae3d05350cfee5c51d2491cec8
SSDEEP 49152:s0/71KAZkPw/a5lsjIa7hhXBOQSbMS5ffODwKh/Wc:7ziPwCvZalhXOMIzQd
MD5 SHA1 SHA512 SSDEEP

Submit Download

pythoncom311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\pywin32_system32\pythoncom311.dll
Size 193KB
SHA256 39f4e62d0366897e20eb849cdc78f4ea988605ba86a95c9c741f2797086a6788
MD5 471d17f08b66f1489516d271ebf831e3
SHA1 0296e3848de8e99c55bab82c7b181112fb30e840
SHA512 857a92588f3363ce9e139fe92222ece6d7d926fdcb2c5c1febfb6328389f3e5f8b82063aface5b61015de031e6bfda556067f49f9cc8103664749d8581da1587
SSDEEP 3072:rCTzJRyBPsxhaPueTqxVvMCeYp3FotYqL+KYw532+i/PygB3O6h7ZKkypdir:rCTzJRyfPuBE26r+Tv+iXyb6hlkpd
MD5 SHA1 SHA512 SSDEEP

Submit Download

pywintypes311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\pywin32_system32\pywintypes311.dll
Size 62KB
SHA256 e3be247830c23a1751e1bab98d02ba5da3721d2a85469eda3764fc583ca2a6ff
MD5 04ce7664658c9c18527594708550d59e
SHA1 1db7e6722aaea33d92fba441fca294600d904103
SHA512 e9744b2eee5fa848d5ac83622a6b1c1a1009d7ad8a944bda7a118dd75d8d24218fa2e4ef67718caabda0dd67efdd5be1497705afef8edec830f1b2402d0f0a8b
SSDEEP 768:xjPpDPKuASjw7XqXcK+yhDzC8mgnC6cD+g90EKiv53YF2a/npFUQLJ6uxQEZOVPi:RdASj2XeBz3m7Sg9xeUQLJhm8eq
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\select.pyd
Size 24KB
SHA256 818120c08358b6b4d1234b7456c7b5c777af8473e26314a6a6c0f37237d53208
MD5 0dc8f694b3e6a3682b3ff098bd2468f6
SHA1 737252620116c6ac5c527f99d3914e608a0e5a74
SHA512 d0e704d52b0c5e24c07447a60d71ccec490ec15ecb6b4532b2e93ac07036bda7f27051f80dac1ef3705b0186f35f9d6dfc05415412e483b68fd79f1098411123
SSDEEP 384:5odUAW1guHrhWgWLBNZa7gJXZjNID7Gu6OIYiSy1pCQlIJNPxh8E9VF0NyUT2:edjW1J2pJjNID7GuIYiSyvCPxWEC
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\sqlite3.dll
Size 608KB
SHA256 a61016520a3f228285e32e40d878fe449450136c55aa9d4d7b54006a8dc7f339
MD5 605b722497acc50ffb33ebdb6afaf1f0
SHA1 e24c55472c827d4b519e5b6f0a3cfc49e10d1fa9
SHA512 9611afc66cd1236cea1fce94e8ecf8e4d2168db3b51d8d9a799b574e8523ca0aea48da6b6c15fc863dd737b9c394ac6e56d2f3fa45e29792b630da389cb21dc1
SSDEEP 12288:W7dpDQ1L3zfmrtWF/azVC9oAnShBJl4cZ1pzgULOX110jt3:wHSzzaQl8VSSh2cZXgULq11y
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\unicodedata.pyd
Size 293KB
SHA256 89cbb2814a75a5bd53acbfb1fe090ca8395c4a7f559acd4fe0187758c172623a
MD5 2b1809546e4bc9d67ea69d24f75edce0
SHA1 9d076445dfa2f58964a6a1fd1844f6fe82645952
SHA512 5ae015add4697e8290eb881fa770bca2fa22ba8376b86b26f7880d4f92ad362e741042926a4c47cc3413c83f445e372ffda915bcf8567673d807bd2dac28fbbd
SSDEEP 6144:x2Fuue6iwoBLhgXM5kayIQJCEUcHQdBAFEzz9DxsXcY:x2/e6inLOoyVJ/LHQdgipxsMY
MD5 SHA1 SHA512 SSDEEP

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\win32\win32api.pyd
Size 48KB
SHA256 2c37610d165a3c3c0350b08a5d803928267aa69878f753d2e2b048de4f3a7413
MD5 d2668458d3a33de3fbe931eb029a3628
SHA1 258351db3b6ce6ae80a428c2b5dc0a3f7cfa112a
SHA512 440b760300043938c1a3130baf667426d1dabdb6dab24581054c9d5ef213997183b0a317b4f846f277eabb07f7bd4d2cc42d90158511c904b7a78672869c641d
SSDEEP 1536:K3ykyksFORBuqvb905yb8/z0lyUSxsur8kR2e:uykUeXZ2UK8k8e
MD5 SHA1 SHA512 SSDEEP

Submit Download

backend_c.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17242\zstandard\backend_c.cp311-win_amd64.pyd
Size 167KB
SHA256 cb400ea4c1949215aee3be519daca9d82c41e8f2ebfc7441d866326cf196fbe6
MD5 1604e9442e25b58376e370c33518cc80
SHA1 0bb8ff1cf47d5db3e413965a8964a391a7a19f9c
SHA512 2122b5db09351715a5b06f39d3870e3298905a2f6826a4a0f960268d116add200389b2add83f6c3d492c1cc792a895d813f2ca8eb8441e69c7a394cbffddfc72
SSDEEP 3072:+/MK4ScEY3A08E3okcUogHXqOJBTLkFSDy2x1jKm/nwRZXjCO:wsbEY3MEo9gXxJFMeyujVnwR9j
MD5 SHA1 SHA512 SSDEEP

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI28882\cryptography-43.0.1.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\brJ84V3ZBd\Browser\cookies.txt
Size 309B
SHA256 4884e621bfc4e32b27b8a1adaed5e2f55a3a083507d1d92549fa41dccf25113d
MD5 4352844d07d83413134d6e53e864f5d5
SHA1 b44c99d1231db3bff2d310a4db6454b89682d679
SHA512 52a4ee999d18b16f71262bf1c719f91c602a1e135a9e158628ae4215a8317e5a72a4d2d817ea1a88e731cec23495bf83e17efbe99a4dea850b02bcc932fb446f
MD5 SHA1 SHA512

Submit Download

clipboard.txt

Path C:\Users\Admin\AppData\Local\Temp\brJ84V3ZBd\Clipboard\clipboard.txt
Size 18B
SHA256 0d50f046634b25bcfc3ffb0a9feff8ab43e662c8872df933cb15b68050a5bb8c
MD5 3f86226eca1b8b351d9c5b11dcdbcdfa
SHA1 576f70164e26ad8dbdb346cd72c26323f10059ac
SHA512 150d95510e0f83ef0e416e1a18663a70f85ff4d09c620fcf355b18df3e939d232054a5be5bbb1b22e050167e61c243d7e89e13c0770cfedbae49b1b8e10d8753
MD5 SHA1 SHA512

Submit Download

No Wifi Networks Found.txt

Path C:\Users\Admin\AppData\Local\Temp\brJ84V3ZBd\Wifi\No Wifi Networks Found.txt
Size 23B
SHA256 008f085ba3eb767dfbba6996130381d46882f4f8845ac0facd32dec918b236a2
MD5 ee5aea0be15d3fbe09fde56c712d5478
SHA1 d26dcac8c96f9a2422012ef19d8539e449c13ed6
SHA512 69ab01956f085efdf79d48be9ba425b630049c997ccad3a6f9bd44fc0d2936c1a4360536e48dc3b15fd96b4aa693d86cdbdbb699ea5cd11d619cf2dabd8a3e9a
MD5 SHA1 SHA512

Submit Download

nightlight.exe

Path C:\Users\Admin\Desktop\Nightlight-v.1.6\nightlight.exe
Size 33.7MB
SHA256 816a5fd7a87c93dec2527139e8ed60f3fb108a3cff6cf8df9d2ddd13886a7b4a
MD5 a7769797c72b2fc4e620073505acbd2e
SHA1 6cadf4dc73da9edeaea5c28fe3ce7adf758953f4
SHA512 f7ff7d6f184f875fd8e28e01ffc3055c1eec22544255f945e588278f619cdcdd59beeecd9de53144e3819c63f277b5f1b1c2d169b5ab1d29c0bdd3be0bef3992
SSDEEP 786432:4f9AOQN72Q1JbTiumfSfz+EvbJESWqEp+0/pW/UyTov:4VAOQNR1xTivfSffvb6qrSaU4ov
MD5 SHA1 SHA512 SSDEEP

Submit Download

OTKN0aDpPicorM

Path C:\Users\Admin\tmp\OTKN0aDpPicorM
Size 20KB
SHA256 2eef1daf7969121f6fbd8edcb7f2ab8485c325eec47a9f7a377c64ee1f2f2f7f
MD5 f6246be42ff06d33a7c2ffecc87197ac
SHA1 5baaf8d19db2edf83b8a0b3e99ccbe652925a350
SHA512 0668f4882a1cf7104d8b2cfd27fe0941e5329a359d11c1f5eae038f5d52e997f026a5b6bb636b66317e14982e319aa66c557df4470e8c81a5ea1b892a34b5fab
SSDEEP 24:TL4P1kwIrnLbXYFpFNYd+6UwcQ8ri5fBod13TZbyFB4fBUe0Uj:T8PawkLLopFsU1+BorZeF0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2608-2422-0x00007FFC86320000-0x00007FFC86355000-memory.dmp

Download

memory/2608-2417-0x00007FFC718B0000-0x00007FFC71E98000-memory.dmp

Download

memory/2608-2419-0x00007FFC8A010000-0x00007FFC8A01F000-memory.dmp

Download

memory/2608-2418-0x00007FFC863F0000-0x00007FFC86414000-memory.dmp

Download

memory/2608-2420-0x00007FFC88590000-0x00007FFC885A9000-memory.dmp

Download

memory/2608-2421-0x00007FFC863C0000-0x00007FFC863ED000-memory.dmp

Download

memory/2608-2424-0x00007FFC862F0000-0x00007FFC862FD000-memory.dmp

Download

memory/2608-2423-0x00007FFC86300000-0x00007FFC86319000-memory.dmp

Download

memory/4748-873-0x00007FFC70F70000-0x00007FFC70F7E000-memory.dmp

Download

memory/4748-916-0x00007FFC82A00000-0x00007FFC82A0D000-memory.dmp

Download

memory/4748-839-0x0000026266980000-0x0000026266CF5000-memory.dmp

Download

memory/4748-843-0x00007FFC711D0000-0x00007FFC71257000-memory.dmp

Download

memory/4748-845-0x00007FFC7E730000-0x00007FFC7E744000-memory.dmp

Download

memory/4748-840-0x00007FFC7EFE0000-0x00007FFC7EFF9000-memory.dmp

Download

memory/4748-851-0x00007FFC711A0000-0x00007FFC711C6000-memory.dmp

Download

memory/4748-850-0x00007FFC81E70000-0x00007FFC81E7B000-memory.dmp

Download

memory/4748-838-0x00007FFC71260000-0x00007FFC715D5000-memory.dmp

Download

memory/4748-832-0x00007FFC7DFA0000-0x00007FFC7DFCD000-memory.dmp

Download

memory/4748-856-0x00007FFC73E30000-0x00007FFC73E48000-memory.dmp

Download

memory/4748-857-0x00007FFC716D0000-0x00007FFC717EC000-memory.dmp

Download

memory/4748-855-0x00007FFC7DF90000-0x00007FFC7DF9A000-memory.dmp

Download

memory/4748-833-0x00007FFC716A0000-0x00007FFC716CE000-memory.dmp

Download

memory/4748-859-0x00007FFC71170000-0x00007FFC71193000-memory.dmp

Download

memory/4748-861-0x00007FFC70FF0000-0x00007FFC71163000-memory.dmp

Download

memory/4748-860-0x00007FFC715E0000-0x00007FFC71698000-memory.dmp

Download

memory/4748-858-0x00007FFC716A0000-0x00007FFC716CE000-memory.dmp

Download

memory/4748-870-0x00007FFC70FA0000-0x00007FFC70FAB000-memory.dmp

Download

memory/4748-881-0x00007FFC70EE0000-0x00007FFC70EEC000-memory.dmp

Download

memory/4748-880-0x00007FFC70EF0000-0x00007FFC70F02000-memory.dmp

Download

memory/4748-879-0x00007FFC70F10000-0x00007FFC70F1D000-memory.dmp

Download

memory/4748-878-0x00007FFC70F20000-0x00007FFC70F2C000-memory.dmp

Download

memory/4748-877-0x00007FFC70F30000-0x00007FFC70F3C000-memory.dmp

Download

memory/4748-876-0x00007FFC70F40000-0x00007FFC70F4B000-memory.dmp

Download

memory/4748-875-0x00007FFC70F50000-0x00007FFC70F5B000-memory.dmp

Download

memory/4748-874-0x00007FFC70F60000-0x00007FFC70F6C000-memory.dmp

Download

memory/4748-829-0x00007FFC82CA0000-0x00007FFC82CAF000-memory.dmp

Download

memory/4748-872-0x00007FFC70F80000-0x00007FFC70F8C000-memory.dmp

Download

memory/4748-871-0x00007FFC70F90000-0x00007FFC70F9C000-memory.dmp

Download

memory/4748-869-0x00007FFC724E0000-0x00007FFC724EC000-memory.dmp

Download

memory/4748-868-0x00007FFC7D050000-0x00007FFC7D05B000-memory.dmp

Download

memory/4748-867-0x00007FFC724F0000-0x00007FFC724FB000-memory.dmp

Download

memory/4748-866-0x00007FFC79190000-0x00007FFC7919C000-memory.dmp

Download

memory/4748-865-0x00007FFC7B890000-0x00007FFC7B89B000-memory.dmp

Download

memory/4748-864-0x00007FFC70FB0000-0x00007FFC70FE7000-memory.dmp

Download

memory/4748-863-0x0000026266980000-0x0000026266CF5000-memory.dmp

Download

memory/4748-862-0x00007FFC71260000-0x00007FFC715D5000-memory.dmp

Download

memory/4748-882-0x00007FFC70EB0000-0x00007FFC70ED9000-memory.dmp

Download

memory/4748-884-0x00007FFC70E80000-0x00007FFC70E9C000-memory.dmp

Download

memory/4748-883-0x00007FFC70EA0000-0x00007FFC70EAB000-memory.dmp

Download

memory/4748-885-0x00007FFC70A50000-0x00007FFC70E72000-memory.dmp

Download

memory/4748-886-0x00007FFC6F6A0000-0x00007FFC70A47000-memory.dmp

Download

memory/4748-888-0x00007FFC6F5D0000-0x00007FFC6F5F2000-memory.dmp

Download

memory/4748-887-0x00007FFC71170000-0x00007FFC71193000-memory.dmp

Download

memory/4748-889-0x00007FFC70FF0000-0x00007FFC71163000-memory.dmp

Download

memory/4748-890-0x00007FFC70FB0000-0x00007FFC70FE7000-memory.dmp

Download

memory/4748-891-0x00007FFC6F380000-0x00007FFC6F5C8000-memory.dmp

Download

memory/4748-908-0x00007FFC718B0000-0x00007FFC71E98000-memory.dmp

Download

memory/4748-932-0x00007FFC70FB0000-0x00007FFC70FE7000-memory.dmp

Download

memory/4748-931-0x00007FFC70FF0000-0x00007FFC71163000-memory.dmp

Download

memory/4748-929-0x00007FFC73E30000-0x00007FFC73E48000-memory.dmp

Download

memory/4748-921-0x00007FFC716A0000-0x00007FFC716CE000-memory.dmp

Download

memory/4748-835-0x00007FFC715E0000-0x00007FFC71698000-memory.dmp

Download

memory/4748-914-0x00007FFC7EFE0000-0x00007FFC7EFF9000-memory.dmp

Download

memory/4748-909-0x00007FFC825C0000-0x00007FFC825E4000-memory.dmp

Download

memory/4748-936-0x00007FFC70A50000-0x00007FFC70E72000-memory.dmp

Download

memory/4748-937-0x00007FFC6F6A0000-0x00007FFC70A47000-memory.dmp

Download

memory/4748-830-0x00007FFC716D0000-0x00007FFC717EC000-memory.dmp

Download

memory/4748-827-0x00007FFC825C0000-0x00007FFC825E4000-memory.dmp

Download

memory/4748-955-0x00007FFC6F380000-0x00007FFC6F5C8000-memory.dmp

Download

memory/4748-961-0x00007FFC837F0000-0x00007FFC837FF000-memory.dmp

Download

memory/4748-981-0x00007FFC711D0000-0x00007FFC71257000-memory.dmp

Download

memory/4748-1001-0x00007FFC711A0000-0x00007FFC711C6000-memory.dmp

Download

memory/4748-1004-0x00007FFC715E0000-0x00007FFC71698000-memory.dmp

Download

memory/4748-1008-0x00007FFC70A50000-0x00007FFC70E72000-memory.dmp

Download

memory/4748-1007-0x00007FFC70E80000-0x00007FFC70E9C000-memory.dmp

Download

memory/4748-1006-0x00007FFC70EA0000-0x00007FFC70EAB000-memory.dmp

Download

memory/4748-1005-0x00007FFC70EB0000-0x00007FFC70ED9000-memory.dmp

Download

memory/4748-1003-0x00007FFC716A0000-0x00007FFC716CE000-memory.dmp

Download

memory/4748-1002-0x00007FFC716D0000-0x00007FFC717EC000-memory.dmp

Download

memory/4748-1000-0x00007FFC72530000-0x00007FFC7255E000-memory.dmp

Download

memory/4748-999-0x00007FFC82A00000-0x00007FFC82A0D000-memory.dmp

Download

memory/4748-998-0x00007FFC717F0000-0x00007FFC718AC000-memory.dmp

Download

memory/4748-997-0x00007FFC7EFE0000-0x00007FFC7EFF9000-memory.dmp

Download

memory/4748-996-0x00007FFC73ED0000-0x00007FFC73F05000-memory.dmp

Download

memory/4748-995-0x00007FFC7DFA0000-0x00007FFC7DFCD000-memory.dmp

Download

memory/4748-994-0x00007FFC81CC0000-0x00007FFC81CD9000-memory.dmp

Download

memory/4748-993-0x00007FFC82CA0000-0x00007FFC82CAF000-memory.dmp

Download

memory/4748-992-0x00007FFC825C0000-0x00007FFC825E4000-memory.dmp

Download

memory/4748-991-0x00007FFC82B60000-0x00007FFC82B6D000-memory.dmp

Download

memory/4748-990-0x00007FFC837F0000-0x00007FFC837FF000-memory.dmp

Download

memory/4748-989-0x00007FFC70FB0000-0x00007FFC70FE7000-memory.dmp

Download

memory/4748-988-0x00007FFC70FF0000-0x00007FFC71163000-memory.dmp

Download

memory/4748-987-0x00007FFC71170000-0x00007FFC71193000-memory.dmp

Download

memory/4748-986-0x00007FFC73E30000-0x00007FFC73E48000-memory.dmp

Download

memory/4748-985-0x00007FFC7DF90000-0x00007FFC7DF9A000-memory.dmp

Download

memory/4748-983-0x00007FFC81E70000-0x00007FFC81E7B000-memory.dmp

Download

memory/4748-982-0x00007FFC7E730000-0x00007FFC7E744000-memory.dmp

Download

memory/4748-980-0x00007FFC71260000-0x00007FFC715D5000-memory.dmp

Download

memory/4748-976-0x00007FFC72500000-0x00007FFC7252B000-memory.dmp

Download

memory/4748-965-0x00007FFC718B0000-0x00007FFC71E98000-memory.dmp

Download

memory/4748-1035-0x00007FFC6F6A0000-0x00007FFC70A47000-memory.dmp

Download

memory/4748-1037-0x00007FFC6F380000-0x00007FFC6F5C8000-memory.dmp

Download

memory/4748-1036-0x00007FFC6F5D0000-0x00007FFC6F5F2000-memory.dmp

Download

memory/4748-823-0x00007FFC718B0000-0x00007FFC71E98000-memory.dmp

Download

memory/4748-824-0x00007FFC72530000-0x00007FFC7255E000-memory.dmp

Download

memory/4748-825-0x00007FFC72500000-0x00007FFC7252B000-memory.dmp

Download

memory/4748-826-0x00007FFC717F0000-0x00007FFC718AC000-memory.dmp

Download

memory/4748-816-0x00007FFC82A00000-0x00007FFC82A0D000-memory.dmp

Download

memory/4748-812-0x00007FFC7EFE0000-0x00007FFC7EFF9000-memory.dmp

Download

memory/4748-813-0x00007FFC82B60000-0x00007FFC82B6D000-memory.dmp

Download

memory/4748-788-0x00007FFC7DFA0000-0x00007FFC7DFCD000-memory.dmp

Download

memory/4748-809-0x00007FFC73ED0000-0x00007FFC73F05000-memory.dmp

Download

memory/4748-787-0x00007FFC81CC0000-0x00007FFC81CD9000-memory.dmp

Download

memory/4748-780-0x00007FFC825C0000-0x00007FFC825E4000-memory.dmp

Download

memory/4748-782-0x00007FFC82CA0000-0x00007FFC82CAF000-memory.dmp

Download

memory/4748-772-0x00007FFC718B0000-0x00007FFC71E98000-memory.dmp

Download