Malware Analysis Report

2025-01-18 16:45

Sample ID 220701-r4b5eagfcq
Target 3db7b2974cb01c3cc9c32645c7ba55a6bfb202f20cf7518fce62559cf5652586
SHA256 3db7b2974cb01c3cc9c32645c7ba55a6bfb202f20cf7518fce62559cf5652586
Tags
isrstealer collection spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3db7b2974cb01c3cc9c32645c7ba55a6bfb202f20cf7518fce62559cf5652586

Threat Level: Known bad

The file 3db7b2974cb01c3cc9c32645c7ba55a6bfb202f20cf7518fce62559cf5652586 was found to be: Known bad.

Malicious Activity Summary

isrstealer collection spyware stealer trojan upx

ISR Stealer

ISR Stealer Payload

Nirsoft

NirSoft MailPassView

UPX packed file

Drops startup file

Reads user/profile data of web browsers

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

Suspicious use of SetWindowsHookEx

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-01 14:44

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-01 14:44

Reported

2022-07-01 15:42

Platform

win10v2004-20220414-en

Max time kernel

170s

Max time network

182s

Command Line

"C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe"

Signatures

ISR Stealer

trojan stealer isrstealer

ISR Stealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\...................vbs C:\Windows\SysWOW64\notepad.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1136 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Windows\SysWOW64\notepad.exe
PID 1136 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Windows\SysWOW64\notepad.exe
PID 1136 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Windows\SysWOW64\notepad.exe
PID 1136 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Windows\SysWOW64\notepad.exe
PID 1136 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Windows\SysWOW64\notepad.exe
PID 1136 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 1136 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 1136 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 4660 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 4660 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 4660 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 4660 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 4660 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 4660 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 4660 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 4660 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 4660 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 4660 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 4660 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 4660 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 4660 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 4660 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 4660 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 4660 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe

Processes

C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe

"C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe"

C:\Windows\SysWOW64\notepad.exe

"C:\Windows\system32\notepad.exe"

C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe

"C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe"

C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe

/scomma "C:\Users\Admin\AppData\Local\Temp\iTLiN1NuER.ini"

C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe

/scomma "C:\Users\Admin\AppData\Local\Temp\gA5BZoaj3E.ini"

Network

Country Destination Domain Proto
NL 104.110.191.133:80 tcp
US 20.189.173.6:443 tcp
US 8.8.8.8:53 www.weltonfield.co.uk udp
GB 185.199.220.35:80 www.weltonfield.co.uk tcp
US 8.8.8.8:53 97.97.242.52.in-addr.arpa udp
NL 104.110.191.133:80 tcp
NL 104.110.191.133:80 tcp

Files

memory/1136-131-0x0000000002490000-0x00000000024A5000-memory.dmp

memory/4976-132-0x0000000000000000-mapping.dmp

memory/4660-133-0x0000000000000000-mapping.dmp

memory/2872-136-0x0000000000000000-mapping.dmp

memory/2872-137-0x0000000000400000-0x0000000000453000-memory.dmp

memory/2872-139-0x0000000000400000-0x0000000000453000-memory.dmp

memory/2872-140-0x0000000000400000-0x0000000000453000-memory.dmp

memory/2872-141-0x0000000000400000-0x0000000000453000-memory.dmp

memory/4660-142-0x0000000000400000-0x0000000000442000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\iTLiN1NuER.ini

MD5 d1ea279fb5559c020a1b4137dc4de237
SHA1 db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256 fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512 720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

memory/4660-144-0x0000000000400000-0x0000000000442000-memory.dmp

memory/776-145-0x0000000000000000-mapping.dmp

memory/776-146-0x0000000000400000-0x000000000041F000-memory.dmp

memory/776-148-0x0000000000400000-0x000000000041F000-memory.dmp

memory/776-149-0x0000000000400000-0x000000000041F000-memory.dmp

memory/776-150-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4660-151-0x0000000000400000-0x0000000000442000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-01 14:44

Reported

2022-07-01 15:42

Platform

win7-20220414-en

Max time kernel

37s

Max time network

43s

Command Line

"C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe"

Signatures

ISR Stealer

trojan stealer isrstealer

ISR Stealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\...................vbs C:\Windows\SysWOW64\notepad.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1472 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Windows\SysWOW64\notepad.exe
PID 1472 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Windows\SysWOW64\notepad.exe
PID 1472 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Windows\SysWOW64\notepad.exe
PID 1472 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Windows\SysWOW64\notepad.exe
PID 1472 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Windows\SysWOW64\notepad.exe
PID 1472 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Windows\SysWOW64\notepad.exe
PID 1472 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 1472 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 1472 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 1472 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe
PID 952 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe

Processes

C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe

"C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe"

C:\Windows\SysWOW64\notepad.exe

"C:\Windows\system32\notepad.exe"

C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe

"C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe"

C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe

/scomma "C:\Users\Admin\AppData\Local\Temp\3xSlBr9gaM.ini"

C:\Users\Admin\AppData\Local\Temp\IMPORT-BOOKING DETAILS.xls.bit.exe

/scomma "C:\Users\Admin\AppData\Local\Temp\dIl1ToM0Oj.ini"

Network

N/A

Files

memory/1472-55-0x0000000000240000-0x0000000000255000-memory.dmp

memory/1472-56-0x0000000074F21000-0x0000000074F23000-memory.dmp

memory/1164-57-0x0000000000000000-mapping.dmp

memory/952-58-0x0000000000401180-mapping.dmp

memory/1692-63-0x00000000004512E0-mapping.dmp

memory/1692-62-0x0000000000400000-0x0000000000453000-memory.dmp

memory/1692-66-0x0000000000400000-0x0000000000453000-memory.dmp

memory/1692-67-0x0000000000400000-0x0000000000453000-memory.dmp

memory/952-68-0x0000000000400000-0x0000000000442000-memory.dmp

memory/1692-69-0x0000000000400000-0x0000000000453000-memory.dmp

memory/1692-70-0x0000000000400000-0x0000000000453000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3xSlBr9gaM.ini

MD5 d1ea279fb5559c020a1b4137dc4de237
SHA1 db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256 fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512 720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

memory/1824-72-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1824-73-0x000000000041C410-mapping.dmp

memory/1824-76-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1824-77-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1824-78-0x0000000000400000-0x000000000041F000-memory.dmp

memory/952-79-0x0000000000400000-0x0000000000442000-memory.dmp

memory/1824-80-0x0000000000400000-0x000000000041F000-memory.dmp