Overview

overview

8

Static

static

3

das.exe

windows10-2004-x64

7

das.exe

windows11-ltsc_2024-x64

8

Resubmissions

04/11/2026, 16:20

261104-ts6kzssyhz7

04/11/2026, 16:04

261104-th5wpssyet8

Analysis

  • user interaction
    yes
  • max time kernel
    811s
  • max time network
    803s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/11/2026, 16:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    das.exe
  • Size 87.9MB
  • Sample261104-th5wpssyet
  • SHA256 61df1146baef57a59f602e67c3dcbf074da630a3d6c473e1290e7c76dda3e8b6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoveryexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 64 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\das.exe
    "C:\Users\Admin\AppData\Local\Temp\das.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Users\Admin\AppData\Local\Temp\das.exe
      "C:\Users\Admin\AppData\Local\Temp\das.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2332
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic os get name"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4340
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic os get name
          4⤵
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3704
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x0000000000000500 0x00000000000004FC
    1⤵
      PID:5204
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:4140
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:5104
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:4116
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:6056
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1292
      • C:\Windows\System32\SecurityHealthHost.exe
        \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
        1⤵
          PID:5588

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 603B
              • SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 599B
              • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              _imaging.cp313-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\PIL\_imaging.cp313-win_amd64.pyd
              • Size 2.5MB
              • SHA256 832167d2ecd950dc2382a9866e346d5886262bc8790bbf24613f56ad19d52f82
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCRUNTIME140.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\VCRUNTIME140.dll
              • Size 117KB
              • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCRUNTIME140_1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\VCRUNTIME140_1.dll
              • Size 48KB
              • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _bz2.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\_bz2.pyd
              • Size 84KB
              • SHA256 76a33e2baa3880aa46290cc7d5810b3155c5e2f5a1cc7d3f7b751f6434144ada
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _cffi_backend.cp313-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\_cffi_backend.cp313-win_amd64.pyd
              • Size 176KB
              • SHA256 21b7160d4a6da9590794fdb38718982060b5c92d56fb0e441fc8b62ee789be8d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ctypes.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\_ctypes.pyd
              • Size 131KB
              • SHA256 75687620596877b0dde462e74ae12140d695b3c78df3c6c099d55717768dde42
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _hashlib.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\_hashlib.pyd
              • Size 67KB
              • SHA256 5eb4a2aa9e28b49cb2a4f6ecee21f3c2b629b43a0709bad1d7e6204bac74eac2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _lzma.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\_lzma.pyd
              • Size 155KB
              • SHA256 f221ed5f1c2789aa357f3c2dc4cd22af134b4b91acb3fb78f9fa5f7f9a7b62e4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _queue.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\_queue.pyd
              • Size 34KB
              • SHA256 6d77d15d668cb5ddff53cff1479dffc97db5858451d4b98f6e60a23cfb529e01
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _socket.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\_socket.pyd
              • Size 84KB
              • SHA256 ba944001aa6b53350f8c64e93643742abf1a08dd07c7dbbc13996e7d4d8a9efa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libportaudio64bit.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\_sounddevice_data\portaudio-binaries\libportaudio64bit.dll
              • Size 300KB
              • SHA256 ec080194f01e4095c7fb43dbd7ed05af922c5b34295056a9ff56782741d65481
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ssl.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\_ssl.pyd
              • Size 177KB
              • SHA256 1cf939510359f5aa3c5f51a0ad994d9b819f5603dd100872cd30a1e25cd83f05
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _tkinter.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\_tkinter.pyd
              • Size 68KB
              • SHA256 fc9d4feb5f7e802f57cdf139c06b230c1a1aff28809bbcdb2e6da3adaba7d0ca
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _wmi.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\_wmi.pyd
              • Size 38KB
              • SHA256 ca38a50c27413a5acfd14b30b0433fcf80a64ad0020e41aceeb3666f8439aba4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              base_library.zip
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\base_library.zip
              • Size 1.3MB
              • SHA256 838a6fe0ddf8c48983d28b260ce6d50e18b103c394539ec8b231dc39f9cb59dd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              __init__.py
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\cv2\__init__.py
              • Size 6KB
              • SHA256 674817e87409bc589608ef9f4dd4c1a49f600b5e85ca8b106b3b0a9eab5c46cc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              config-3.py
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\cv2\config-3.py
              • Size 748B
              • SHA256 de28c7b5213cca148f09469916584611b3d66c1c8c432880259d6a3a92380213
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              config.py
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\cv2\config.py
              • Size 123B
              • SHA256 6c6367abce55995ae4a8d3c199420ec53afab287cb17dfc2f430378af75dd301
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              __init__.py
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\cv2\data\__init__.py
              • Size 73B
              • SHA256 f4ce16721ed7f623a4dcc443ba600d1856db610cb2c3d53c13a8ca028cc68f6d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              load_config_py3.py
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\cv2\load_config_py3.py
              • Size 253B
              • SHA256 074dfaf20ac94f2ca3815393de3a394944470334c51a85b9521f452e0e17bb85
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              __init__.py
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\cv2\mat_wrapper\__init__.py
              • Size 1KB
              • SHA256 c44707ea1c76f35518ae572b6c1989d76c2ada7e850432e41805dfe112d4e306
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              __init__.py
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\cv2\misc\__init__.py
              • Size 38B
              • SHA256 495bd79594cce174673e372c85c4dd8f4ffdf2b3a73fd4623955b0d55de0d462
              • MD5 SHA1 SHA512
              Submit Download

              version.py
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\cv2\misc\version.py
              • Size 95B
              • SHA256 c93a418793fcb15b9b4316c0741b8336740e490e94f3b7d1ebe8cd5f6f23815c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              __init__.py
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\cv2\typing\__init__.py
              • Size 4KB
              • SHA256 f8a066f22a98b56641a69200f0aaf9c3b5832b2f59f57862e56289cced8d9179
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              __init__.py
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\cv2\utils\__init__.py
              • Size 344B
              • SHA256 2b16990b35b569af1ca7239dc10f7b24ec62f27a46626b1e2f1271d2e1aa3554
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              version.py
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\cv2\version.py
              • Size 96B
              • SHA256 fc17efee9203c23cac641981068621e80d3b0bbabe459f4133c9b2b4d91957fb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              libcrypto-3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\libcrypto-3.dll
              • Size 5.0MB
              • SHA256 09499e186cf0e434ffa17ad153aa9a66d6048c54a2c03b823e2a06c49d9affe4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libffi-8.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\libffi-8.dll
              • Size 38KB
              • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libssl-3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\libssl-3.dll
              • Size 776KB
              • SHA256 28c395290279fa4f4f54a57b85cd66d853895f925fefb8f6fdebc0d8b1cdd07c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\numpy.libs\libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll
              • Size 19.6MB
              • SHA256 ed4f167a5330424524f45258e7ca2c8d7f03c0cba1f30ee4985553ac1f88ecf8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
              • Size 561KB
              • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _multiarray_umath.cp313-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\numpy\_core\_multiarray_umath.cp313-win_amd64.pyd
              • Size 3.7MB
              • SHA256 f37332834048e3aef93a33ff53f558a319cad12009defb2231ee1ba4aa6105d8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _umath_linalg.cp313-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\numpy\linalg\_umath_linalg.cp313-win_amd64.pyd
              • Size 110KB
              • SHA256 2989647fd7df9ce56a0709542f3578d0ca0a5e4f7d83f81b033506c9fec6adc5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              INSTALLER
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\pydantic-2.14.2.dist-info\INSTALLER
              • Size 4B
              • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
              • MD5 SHA1 SHA512
              Submit Download

              python3.DLL
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\python3.DLL
              • Size 70KB
              • SHA256 16f109e8411bc08341497c87704b7cf0d22a2678f1e3a7dca416ea7bff995469
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              python313.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\python313.dll
              • Size 5.8MB
              • SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              select.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\select.pyd
              • Size 32KB
              • SHA256 a208997eb871b5c7785eb9bcc6a22ba8c43262255b59a3394fbe9912f38b4692
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Lorem ipsum.txt
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
              • Size 1KB
              • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Banjul
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Africa\Banjul
              • Size 130B
              • SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Dar_es_Salaam
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Africa\Dar_es_Salaam
              • Size 191B
              • SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Harare
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Africa\Harare
              • Size 131B
              • SHA256 910c97c091cd34ae7427c83226234ce7b4f2f425c5822d6669c24be62010a792
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Kinshasa
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Africa\Kinshasa
              • Size 180B
              • SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Blanc-Sablon
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\America\Blanc-Sablon
              • Size 177B
              • SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Panama
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\America\Panama
              • Size 149B
              • SHA256 a78d73067ba3cbd94f8a23dfdd6aa8b68cb33b18484bc17b4e20ea1aec2f0a81
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Thunder_Bay
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\America\Thunder_Bay
              • Size 1KB
              • SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Riyadh
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Asia\Riyadh
              • Size 133B
              • SHA256 46853e94276af2eea8e86c2f152a871c092df195dc51273b8fc7091faa4b461c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Shanghai
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Asia\Shanghai
              • Size 393B
              • SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Sydney
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Australia\Sydney
              • Size 904B
              • SHA256 820d45a868a88f81c731d5b2c758b4ed000039b6260a80433f8e0f094a604b59
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              GMT0
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Etc\GMT0
              • Size 111B
              • SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
              • MD5 SHA1 SHA512
              Submit Download

              Zulu
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Etc\Zulu
              • Size 111B
              • SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
              • MD5 SHA1 SHA512
              Submit Download

              Copenhagen
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Europe\Copenhagen
              • Size 705B
              • SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Jersey
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Europe\Jersey
              • Size 1KB
              • SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Luxembourg
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Europe\Luxembourg
              • Size 1KB
              • SHA256 b10f9542a8509f0a63ebca78e3d80432dd86b8ea296400280febd9cfa76e8288
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Sarajevo
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Europe\Sarajevo
              • Size 478B
              • SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Zaporozhye
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Europe\Zaporozhye
              • Size 558B
              • SHA256 0589e80ddecebf9d3077898c12975d2be7393df2856ee9926c534763e1e26bf2
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Christmas
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Indian\Christmas
              • Size 152B
              • SHA256 cdc8e2c282d8bc9a5e9c3caf2fc45ff4e9e5cd18f5dec8cb873340ad7c584d64
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Reunion
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Indian\Reunion
              • Size 133B
              • SHA256 0d9ea5053e83188032a6fb4d301d5db688f43011e5b6b1f917a11b71a0da7b16
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              BajaNorte
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Mexico\BajaNorte
              • Size 1KB
              • SHA256 af9aea4aee505143fa5e847643c0ffe164190c38411010ac7f0b170f4098a6c8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Auckland
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Pacific\Auckland
              • Size 1KB
              • SHA256 0e06e7e55aedbc92ef5b3d106e7c392ab1628cfd8a428b20e92e99028a0bfbb9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Truk
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Pacific\Truk
              • Size 154B
              • SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Wake
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\Pacific\Wake
              • Size 134B
              • SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Arizona
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\US\Arizona
              • Size 240B
              • SHA256 ae11453c21d08984de75f2efec04dc93178a7b4e23c5e52f2098b8bd45ccb547
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              East-Indiana
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\US\East-Indiana
              • Size 531B
              • SHA256 e678f42a13efbd7be0f26a9ce53e04b1c28a582eab05611cb01c16836432f07b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Hawaii
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\US\Hawaii
              • Size 221B
              • SHA256 1daa5729aa1e0f32cd44be112d01ad4cc567a9fe76d87dcbb9182be8d2c88ff0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Mountain
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\US\Mountain
              • Size 1KB
              • SHA256 9bb703920eca4b6119e81a105583a4f6ca220651f13b418479ab7cd56c413f3e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Samoa
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b5c2\tzdata\zoneinfo\US\Samoa
              • Size 146B
              • SHA256 650d918751366590553063cd681592fdca8a09957e0ce2c18d6697ec385ef796
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/4116-2029-0x000000000DC30000-0x000000000E4AB000-memory.dmp
              Download

              memory/4116-2059-0x000000000DC30000-0x000000000E4AB000-memory.dmp
              Download

              memory/6056-1860-0x00000136801E0000-0x00000136802E0000-memory.dmp
              Download

              memory/6056-1861-0x00000136801E0000-0x00000136802E0000-memory.dmp
              Download

              memory/6056-1905-0x0000013695210000-0x0000013695230000-memory.dmp
              Download

              memory/6056-1879-0x0000013683E10000-0x0000013683E30000-memory.dmp
              Download

              memory/6056-1867-0x0000013683A50000-0x0000013683A70000-memory.dmp
              Download

              memory/6056-1871-0x0000013683E70000-0x0000013683F70000-memory.dmp
              Download

              memory/6056-1859-0x00000136801E0000-0x00000136802E0000-memory.dmp
              Download