Overview

overview

10

Static

static

10

Zoldyck Aim Panel.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    98s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-01-2025 00:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Zoldyck Aim Panel.exe

  • Size

    603KB

  • MD5

    5f700673234d7c2c647cd8ae6ebe5045

  • SHA1

    a9b7049c82e5792e3fd4a4851fadad843a2f0e44

  • SHA256

    3a8ef99162bb2270442db05882f33ea7d7eee7510252fb332213cedced257864

  • SHA512

    86d639cb621ff7aa5b5283b38a94056a157525c005d71790ced1b27cc90f88357b228d82c43af6d13caec6aa0ff49930605e901e0e2c621560029f9824669995

  • SSDEEP

    6144:CLV6Bta6dtJmakIM5vOpOJcHxIFAyUWlv3PAr:CLV6BtpmkucHxIFlU63or

Score
10/10
nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

127.0.0.1:54984

Mutex

22faf9f6-da53-4d7e-955a-ff115234d347

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2024-10-18T02:12:14.481920736Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    54984

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    22faf9f6-da53-4d7e-955a-ff115234d347

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Nanocore family
    nanocore
  • Executes dropped EXE 8 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in Program Files directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Zoldyck Aim Panel.exe
    "C:\Users\Admin\AppData\Local\Temp\Zoldyck Aim Panel.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:3016
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3224
    • C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe
      "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:2668
    • C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe
      "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:1576
    • C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe
      "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:2416
    • C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe
      "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:2448
    • C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe
      "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:5108
    • C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe
      "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:1740
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      1⤵
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:388
    • C:\Program Files (x86)\PCI Subsystem\pciss.exe
      "C:\Program Files (x86)\PCI Subsystem\pciss.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3808
    • C:\Program Files (x86)\PCI Subsystem\pciss.exe
      "C:\Program Files (x86)\PCI Subsystem\pciss.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2296
    • C:\Program Files (x86)\PCI Subsystem\pciss.exe
      "C:\Program Files (x86)\PCI Subsystem\pciss.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3096
    • C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe
      "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:1372
    • C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe
      "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:2944
    • C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe
      "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:4400
    • C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe
      "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:4520
    • C:\Program Files (x86)\PCI Subsystem\pciss.exe
      "C:\Program Files (x86)\PCI Subsystem\pciss.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2940
    • C:\Program Files (x86)\PCI Subsystem\pciss.exe
      "C:\Program Files (x86)\PCI Subsystem\pciss.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4076
    • C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe
      "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:3452
    • C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe
      "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:4132
    • C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe
      "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:2508
    • C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe
      "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:1492
    • C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe
      "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:3336
    • C:\Program Files (x86)\PCI Subsystem\pciss.exe
      "C:\Program Files (x86)\PCI Subsystem\pciss.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3176
    • C:\Program Files (x86)\PCI Subsystem\pciss.exe
      "C:\Program Files (x86)\PCI Subsystem\pciss.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4072
    • C:\Program Files (x86)\PCI Subsystem\pciss.exe
      "C:\Program Files (x86)\PCI Subsystem\pciss.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2688

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\PCI Subsystem\pciss.exe
      Filesize

      603KB

      MD5

      5f700673234d7c2c647cd8ae6ebe5045

      SHA1

      a9b7049c82e5792e3fd4a4851fadad843a2f0e44

      SHA256

      3a8ef99162bb2270442db05882f33ea7d7eee7510252fb332213cedced257864

      SHA512

      86d639cb621ff7aa5b5283b38a94056a157525c005d71790ced1b27cc90f88357b228d82c43af6d13caec6aa0ff49930605e901e0e2c621560029f9824669995

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Zoldyck Aim Panel.exe.log
      Filesize

      496B

      MD5

      5b4789d01bb4d7483b71e1a35bce6a8b

      SHA1

      de083f2131c9a763c0d1810c97a38732146cffbf

      SHA256

      e248cef9500ed6e0c9f99d72a2a6a36955a5f0cfc0725748ef25a733cc8282f6

      SHA512

      357e18ef30430e4b9cc4f2569b9735b1cd12f934c83162e4de78ac29ba9703b63ddb624ccc22afd5a5868f6e9d91a3c64581846abac22e9625f5b2e3d80b3ede

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log
      Filesize

      1KB

      MD5

      677df0ae415fa6e9e31a8425f239f695

      SHA1

      de4d1030640ee2b1d85b6b82383a10837462fbcb

      SHA256

      656ea6b8c9b5fdd525d8b066e82288c5add179a768595a6457c738e698d06f5f

      SHA512

      89c001ccdd4165c38f2792382d0cfc8a18276337580efbe121856ece288a76276d93e9778bd595ba360c24386e5282aaa80c84262f5688a64fe274b0d4e82ed5

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log
      Filesize

      13KB

      MD5

      d70d88c40cd301a44b7f88158d74f609

      SHA1

      3ce69017da15fa005f06b5dbffa8161ce0007721

      SHA256

      b69499367643a4d6ac142a1c3597a53066fd05ac9e14a6acc4aea4beae4c3e63

      SHA512

      8daed166d2a62bd8b49b3d07990e65a010aa0d24af2af2a09154d7f1ab929adb9d9125d9777817787544154ded8844d6f8a7ee4c080f189cc8c346d447296d0d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20241007_091147539.html
      Filesize

      93KB

      MD5

      64aeab55014213c7a0a0171f339327fc

      SHA1

      daa1c2b2d6086d10d56948ea671ea60d8bd98579

      SHA256

      0f4cfde837de3f3831b75c93c9817dcf9718d0c06bc9171c1a8e2a22932912f6

      SHA512

      425dee998870d61aac3042b247bf725b632010dcb666164236237ca75ae4d560eebb56b3ae2b35607d5e85319343aa14dfcda0d117736f8d0f64df449d9dffed

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091226.log
      Filesize

      15KB

      MD5

      1ac5c3c52ffe3169a6ffa546487e482d

      SHA1

      0704cf79641e78ae010ee7f5e20b00c084446431

      SHA256

      9eaeb8e7575bd234abec39d0b4c8122fe70d52ec5629b59cd6766a88d077f700

      SHA512

      bb80e9099d501c4be0e15ee9bec4657a03697cf5093ddb1db76155e3f71d60687a49be3adc1271746a8967d2e4e518e9037fd81efbe87d335e61046bb83ce803

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091226_000_dotnet_runtime_6.0.27_win_x64.msi.log
      Filesize

      551KB

      MD5

      fcd76ac5ff99b168b02c8c76eb75b558

      SHA1

      8937223649977b1027aec4164fd03ee818d2d029

      SHA256

      ccb07124c233d05bafe4b429d3ae897dbc8f6ecf45c0f8f326db7df47a4f8a7c

      SHA512

      57826afcc02dec1865adae2902cd37cf4970b590d21c1fe3813946e512d59bc7dcd97f4540155857b5fad4c7088609c11b5e89b90df92ee56e6606f64db36e5a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091226_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
      Filesize

      95KB

      MD5

      b4a63ea7a306c46a141a216a301f0604

      SHA1

      0e24a23be4dc9c27f32c8f296061a187ec915061

      SHA256

      2f18a3ad2c0ad046e8928a5aef80e52d2ba8a9ab20b747f8099838f7221a7772

      SHA512

      85261af40f9b26d79cb0ac5d3745df15a2427fe55234ab341e98241d8a6e5db851320c1ee9dcc61366cc21d31f2361bf6fbbab79c9b92228c1de64db673b2be8

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091226_002_dotnet_host_6.0.27_win_x64.msi.log
      Filesize

      105KB

      MD5

      c2e38b459378bb60b802d7c54ce96ab8

      SHA1

      50d1383e6a21bf02f4052f56967b9512595d3f83

      SHA256

      e7c706f33e786ed9d64a1fbef40c38c9d482b11553b323f07f518fb7c3bf4e75

      SHA512

      db10622dc2bec952472f462fcc933421764a15927cb7651db602f33ff568faa54caf4cb1342335661ea65181e5aff51a63f7ac14683980e7ebc02b497f39f0c4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091226_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log
      Filesize

      847KB

      MD5

      141deff9caed7466877a955b5e843091

      SHA1

      85ce504d18b20f3c7d02148298dba6ae3ff375bb

      SHA256

      69afaffd92b7dd237b336b77bcb46e9afbfb6e2d6e56d034518c4150f116e623

      SHA512

      78f81e598feb68b9e39e8c17a1e310b5a423a5f33d3c7af5213e7e27f3f6eedc594b0eb877e78037762e1574179eff2126b7c463b365cbc561400f284ed38c2f

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091305.log
      Filesize

      15KB

      MD5

      dccc080e22d52466410e24be620e4fdc

      SHA1

      00041ee56ac83082fb38a0f8b87cf8c431f5b458

      SHA256

      27fd48cd86c87fd581dbc911bbea8a16ece1a16093192dcd359c35708886ee98

      SHA512

      c77284b97c894dd9482afdfe53d31d39153d6da9cbe9b60b2b3f5c4e65c30191cd09b75dc4562f786cd28ba8c57a09010c15db3e18ecb0daf7d488864b43c5e7

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091305_000_dotnet_runtime_7.0.16_win_x64.msi.log
      Filesize

      470KB

      MD5

      57ce13ea1346d5e6d56eac828dbb1b66

      SHA1

      ad0677513891a02839a6fdc03d30ecbecc0b2f88

      SHA256

      c5a951a24dc642aa9401b914ad9467edf48c47b935d1a6d93435141d0409bf7d

      SHA512

      2ce4c99d7d9b7f0d57fff3b967fa85f74d679d31cb1c17c176fa1208b754ee07469720770ca5319eb797b0f280f5b8df760af89a0d63bc68a3dee226b43f7611

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091305_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
      Filesize

      95KB

      MD5

      eebe095a94085dbc2ea2950f195e08ce

      SHA1

      05bc02d0993b075f1debdd213e1b7e6f01431044

      SHA256

      1dcf0eee6d62c106ccff2fe394c2e30e1e491bd87556f225b34a68d1e5a2005e

      SHA512

      885ed7af73d743e9591d8c03ca353d3524b5b6c62d1a1cf179c88bbf627d2281ebe71d761fa1a6bcdd6437ec30fabdb8d99772c98c4e4c69af1fcceeade2ae9b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091305_002_dotnet_host_7.0.16_win_x64.msi.log
      Filesize

      109KB

      MD5

      4fb986bdee6c300c8b95bd69d05325f1

      SHA1

      9ee0abce96640b1bef43ca25d03a7e6a39dddf1b

      SHA256

      8cb728d947dd9d6811812cdb6ab5e7eaf31289d4275810f9acc2586d990b877f

      SHA512

      39bb80077070103999d9ae13f763d15f2db778a0bbd355d173036172cc17b8a571c8136872daa020b42f568bbecafaa589c86c48da312f37f2b768f25557dbcc

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091305_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log
      Filesize

      852KB

      MD5

      dd5e1189ffdf7a9ed6b74ca58f0731f5

      SHA1

      db389da04acd03c74d785a7a8c205a7243704ac9

      SHA256

      b1e383dceeeaeebbcfe37beb8166892cabcce3fedae7feba1a3e3dc57e116e2b

      SHA512

      081ed39a2da5097d58ca56102a94fcff64ab1a0223ddf43d4f16f3ce10b8537c78870fcafafd70faf53155c470be9c05021b3cc58d9555062af5f6d84ee48215

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091327.log
      Filesize

      15KB

      MD5

      73d82748eede2c0884a07f6277704e8c

      SHA1

      9405ef66f2ff88dce7c1ce66e33b0eb8baa62d76

      SHA256

      336f85b30d0143af3333d40bf47fe37909b64f3a8e10a2d53eea1d5e3c9c6f70

      SHA512

      4b32d9627516157c2c50dca969f679e5b2b76ddd5bbd6f6f737aef6a46b7c1d866d82eeb88e16f3244dd95ef549e324e6ddbb7964b3d05c20ef0a5900066251b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091327_000_dotnet_runtime_8.0.2_win_x64.msi.log
      Filesize

      469KB

      MD5

      32c3e4071afed5b93676a4aafa287e62

      SHA1

      63f572279a543ead5fb95cd6c3a726e5240c5c1b

      SHA256

      f8a77fdc8b2b52866283845397f6993a3b37a925c711dc161f567a24b5bf53ff

      SHA512

      bba589591338b0e73e3c0ef3f8cad4fe3ce01ff26573aba2908e02bb9523ecd8e16be25441e794fc84ee6e9c143237070f299e46e65528d87b8cc5f27c2d82af

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091327_001_dotnet_hostfxr_8.0.2_win_x64.msi.log
      Filesize

      95KB

      MD5

      a11cad1af52f09778a0c5a673c2bac94

      SHA1

      0eb6e73cf7833a58865276e38b65a7e2dc723fc6

      SHA256

      a111f3cef2ea6bd8d97628d078b24b3d6b67bfef2353eb0582849cd3399df6fd

      SHA512

      52dd0e311501e7fd2c365eef0a983033962980a462e038a82378228287b041af7e9449925ca8bba9b6dcf39cca218e7591cd50b772ac4c9e83677e108c8a1a62

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091327_002_dotnet_host_8.0.2_win_x64.msi.log
      Filesize

      109KB

      MD5

      62860fdaaf4f9d743be2b709949c41ce

      SHA1

      5c2583ce734747ded48c061201dd1e2342d645b2

      SHA256

      95c662b74cae14b5d2d493b5b2a5086cff468a133e5db27eee8c3dd33e87fe2e

      SHA512

      f7d17ab99faf6b93dc45b533cd7d6e6784b2d518f56e17e5c4fc071e3330f7ff55e1b84f086f870111da179f421f5ae65b46a25e651ccd5a032ad0666d802669

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091327_003_windowsdesktop_runtime_8.0.2_win_x64.msi.log
      Filesize

      846KB

      MD5

      01395d0f5e394b6f3c249634389cd17c

      SHA1

      25adc3a24a8394b1d70a92c045915caf1f4b1ef9

      SHA256

      e3d5c07f3917a16bbd4c804a6e86deadb3c2d75949ee619b3daf5d229cc9edbf

      SHA512

      0c5ffd33b3c4d4d3d0e3b8ee7513f814fda74978aeb7f595fd3b37393ffb5ea42b68467c1ea19b2fe4cf831b89329ad0db78b580fedc60b791c06faa8974499b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\ZTSLLRFH-20241007-0917.log
      Filesize

      57KB

      MD5

      ebd7d25dffa817645ba8dba0226648ca

      SHA1

      fbff2838951b7a96d6aafd839ed1bc69173a7f4f

      SHA256

      6b2066e29f8ffd6c6ddbe5f0801bc5ac2908cafbab4396b89987f89a7287a2e0

      SHA512

      d29e65ec2f27e23f7aac488cd5661258c09718224f4e159c2d85a51a117ce78b95fa19c2a0827a8c906b7e3e1009be7c59d0012d5390612d98237e013d6b55bd

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\ZTSLLRFH-20241007-0917a.log
      Filesize

      181KB

      MD5

      8ba60424576139d753bb70dfa9a691c2

      SHA1

      8db1d6d3f228c2f0dd01aed3773ddc2b37abf39b

      SHA256

      9969d3c44dbfff120b0b2d5d74721736aba9f284bc74ad22c03fd726b65df83f

      SHA512

      c1f9f544cfd18a113f86c156e8401e63d3fb64b9a07f15215fb335391274cfb6c2052f5f4df34e86bd567d5a3e6d65f47df46a5a0660e0cf92626aeb7621cb43

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\aria-debug-3468.log
      Filesize

      470B

      MD5

      acdfdb9b0a20221a90d27667db26515f

      SHA1

      8dfa0ae92540a49863e4c864f86fffa9c4e093b4

      SHA256

      1363a4eded7893860e5cdaa0af14f9d5b4ca1bca0cff9c31e5bb49fa1395399e

      SHA512

      8ebef976f559417818051fa70de70ae8f2155bf39f93a2a9c4ac9bdb760781facd263a79bbededd702c141ed5d69e9be76b129e48a08ded9d4326ce24254b4de

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
      Filesize

      6KB

      MD5

      cb39cba660d67cbc8c25b42afab3d5a1

      SHA1

      1186bdbac7b2d90e458db1b731f7275e6691d534

      SHA256

      f7ffb1155712afacf3e40d5c278a9342194ae81e9e95873c83cae21f51fb516c

      SHA512

      2ea9102f74e4ac73a704cf3f78cadc52e8098bcbbd7586cb8fddc3601554c7a827170d4ae7bc551402027037083c901d8f04d78e5f16bd8bb4f3c51f62f77eae

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
      Filesize

      1KB

      MD5

      c4e7096305f2e57db83929f53bc9674c

      SHA1

      a03fdd937cdc3cf6beb3eb4f83fd6923f1097667

      SHA256

      cf2f8e18c90e16808ed07bc772e960d8c8dfa412665e3e7632ff2e2c0dbc5d53

      SHA512

      0f33e084e4252fa4895ae8c5483a50124e32aa85de8a4a1226299379ccbbccf44cfbbca16a4d7826d479cf1255cc9576e7cc34047d56998982e97efe91d5e45c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI33AF.txt
      Filesize

      426KB

      MD5

      dc381adbf3bcfbdeb0aa7e621a994e28

      SHA1

      b31192dde8104591a12273e06c7f4515b7728646

      SHA256

      6ed33f9dc491c2cb341423d729268b64206cada7826f78ec5b3a6967f0e32825

      SHA512

      ae2dfd2e779493629f93cd6a0af52353b2ae719166ed8577ff257ce1f1c35c653871f930308c7d875219e2f37c2bccf935235895b95114f7bd2505631b987807

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI33CC.txt
      Filesize

      413KB

      MD5

      91ae4b33d08d5f3c35c634f470e58a6a

      SHA1

      0cd7e4bbd44131f8061145ce1375646117709179

      SHA256

      4939dba81172a6e03401455324dc0617680e5d64fc6300cf53920900ce78451c

      SHA512

      4145d1b0c6ad6e106b7ec952b240b9b849626380f0036e61ab2fa12a916138fb70b5bfab780c7be9d6dbb52d8c66a76cd420736adc0cfdc47880e8792ff618b2

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI33AF.txt
      Filesize

      11KB

      MD5

      09ec2f8d0beab3fb5ae8880fc9704265

      SHA1

      508c4e12d2371a60adeaa2a837e19806eef3f823

      SHA256

      28a6898cc9ba20e32b36b1566e09457887e3b2d73f9f9c0981137609f9c7c878

      SHA512

      f08b7612d969eaa3c739ff587dcdf7aef565e6c3821968757c18294998222384ad1d347913f6188cb31bd20c124718ad31fd5cbfee0a139f23f65c5e528f04aa

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI33CC.txt
      Filesize

      11KB

      MD5

      76cd864d8261275f3632993195ebd7f0

      SHA1

      f8e82793993b303630b377111ffaf19eb76aa124

      SHA256

      dc734473f137784f3cc7dc19958a43fb0ebe2b65aff0e4bd12bcc8906df5b808

      SHA512

      36bca0071f5d6d0828865ca5c19fd0fad25eee2667c4cdec8a98998f0b1df21a4745a3bb654f13d9552f9a2695239c2c3d34ea1659f1c63479071e6ed1cb3be3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\jawshtml.html
      Filesize

      13B

      MD5

      b2a4bc176e9f29b0c439ef9a53a62a1a

      SHA1

      1ae520cbbf7e14af867232784194366b3d1c3f34

      SHA256

      7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73

      SHA512

      e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\jusched.log
      Filesize

      163KB

      MD5

      b54190304225158c2b6bfddd4689b980

      SHA1

      7722b0981bdd24dd67d1caa3477ec36e5d8c80a1

      SHA256

      aa0db256c22277a6bdf09fbb444d5507538f9f7c2742966212b2bcbbfd07d126

      SHA512

      aa11c62d0353006781af306e006505b786180a53043318c4efc49faf1ae4ab87c4340db9b74d7f7f69ce16e64762b1fc11ecc03b4bfa4ab9981ff5a87119604c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\mapping.csv
      Filesize

      120KB

      MD5

      d3186aada63877a1fe1c2ed4b2e2b77d

      SHA1

      f66d9307be6cbbb22941c724d2cf6954b41d7bb0

      SHA256

      2684d360ec473113d922a2738c5c6f6702975e6ac7ee4023258a12ed26c9fefe

      SHA512

      c94e8aa368a44f1df9f0318ca266f5a6a9140945d55a579dee2fd10aff3d4704a72a216718b35e44429012d68c2bb30a92d5179fbc9fb4b222456a017d8981c0

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\msedge_installer.log
      Filesize

      3KB

      MD5

      bdd7ffd9f75b222ae1f495c5f485ac00

      SHA1

      b2fed1145fbeb9885569585dcecad390c4707453

      SHA256

      f4ff627d89051d208c504b74b310595fdc6d4e2ac1aa057b0570c88f28352ee9

      SHA512

      207c87b6552fc0d78af824cc041f4e15864a886a08eb8033c51cd03fd27f3395cfbb319c3c47514fd75fe849beda5a1f168632cfe6c1cbdc2cdc56d6f687e53f

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\wct22D.tmp
      Filesize

      63KB

      MD5

      e516a60bc980095e8d156b1a99ab5eee

      SHA1

      238e243ffc12d4e012fd020c9822703109b987f6

      SHA256

      543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7

      SHA512

      9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\wctCBEB.tmp
      Filesize

      40.2MB

      MD5

      fb4aa59c92c9b3263eb07e07b91568b5

      SHA1

      6071a3e3c4338b90d892a8416b6a92fbfe25bb67

      SHA256

      e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9

      SHA512

      60aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\wmsetup.log
      Filesize

      697B

      MD5

      0aac7761fa893d3ebb7cbbe8d88aacbd

      SHA1

      fdf1b0eacd978d405f2a1ac68fbbda5532b88f99

      SHA256

      68fdd73e0c267620e4901e532540f5b3633171013e3409e83d892d478eb3a39c

      SHA512

      f345b140d9dc8fe95f99df57990b866859bb96f9288d3a59dbf03c0ab8f662b6065e9d4516a4f77626a3cdda716ae54712de108ffdb270d1cc920ab31d0e42c8

      Download Submit

    • memory/388-32-0x0000014C74520000-0x0000014C74521000-memory.dmp

      Filesize

      4KB

      Download

    • memory/388-31-0x0000014C74520000-0x0000014C74521000-memory.dmp

      Filesize

      4KB

      Download

    • memory/388-30-0x0000014C74520000-0x0000014C74521000-memory.dmp

      Filesize

      4KB

      Download

    • memory/388-29-0x0000014C74520000-0x0000014C74521000-memory.dmp

      Filesize

      4KB

      Download

    • memory/388-26-0x0000014C74520000-0x0000014C74521000-memory.dmp

      Filesize

      4KB

      Download

    • memory/388-20-0x0000014C74520000-0x0000014C74521000-memory.dmp

      Filesize

      4KB

      Download

    • memory/388-21-0x0000014C74520000-0x0000014C74521000-memory.dmp

      Filesize

      4KB

      Download

    • memory/388-22-0x0000014C74520000-0x0000014C74521000-memory.dmp

      Filesize

      4KB

      Download

    • memory/388-28-0x0000014C74520000-0x0000014C74521000-memory.dmp

      Filesize

      4KB

      Download

    • memory/388-27-0x0000014C74520000-0x0000014C74521000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1576-19-0x0000000074C90000-0x0000000075241000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/1576-13-0x0000000074C90000-0x0000000075241000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/1576-15-0x0000000074C90000-0x0000000075241000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/1576-14-0x0000000074C90000-0x0000000075241000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/2668-10-0x0000000074C90000-0x0000000075241000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/2668-12-0x0000000074C90000-0x0000000075241000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/2668-11-0x0000000074C90000-0x0000000075241000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/2668-17-0x0000000074C90000-0x0000000075241000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/3016-9-0x0000000074C90000-0x0000000075241000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/3016-8-0x0000000074C90000-0x0000000075241000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/3016-7-0x0000000074C90000-0x0000000075241000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/3016-6-0x0000000074C92000-0x0000000074C93000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3016-4-0x0000000074C90000-0x0000000075241000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/3016-2-0x0000000074C90000-0x0000000075241000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/3016-1-0x0000000074C90000-0x0000000075241000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/3016-0-0x0000000074C92000-0x0000000074C93000-memory.dmp

      Filesize

      4KB

      Download