Malware Analysis Report

2024-11-13 15:06

Sample ID 231119-cyhmnshd6v
Target RipperScanner.zip
SHA256 2a84b9fbaee74a99c8063189d6b362bde2e18b8eb0c5e24e2ac0ed1de6dc31fb
Tags
pyinstaller pysilon persistence spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2a84b9fbaee74a99c8063189d6b362bde2e18b8eb0c5e24e2ac0ed1de6dc31fb

Threat Level: Known bad

The file RipperScanner.zip was found to be: Known bad.

Malicious Activity Summary

pyinstaller pysilon persistence spyware stealer upx

Pysilon family

Detect Pysilon

Enumerates VirtualBox DLL files

Loads dropped DLL

Reads user/profile data of web browsers

UPX packed file

Executes dropped EXE

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Unsigned PE

Detects Pyinstaller

Kills process with taskkill

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Gathers system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-11-19 02:29

Signatures

Detect Pysilon

Description Indicator Process Target
N/A N/A N/A N/A

Pysilon family

pysilon

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-19 02:28

Reported

2023-11-19 02:31

Platform

win10-20231020-en

Max time kernel

83s

Max time network

74s

Command Line

"C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe"

Signatures

Enumerates VirtualBox DLL files

Description Indicator Process Target
File opened (read-only) C:\windows\system32\vboxhook.dll C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
File opened (read-only) C:\windows\system32\vboxmrxnp.dll C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
File opened (read-only) C:\windows\system32\vboxhook.dll C:\Users\Admin\CacheScanner\OneDriveCache.exe N/A
File opened (read-only) C:\windows\system32\vboxmrxnp.dll C:\Users\Admin\CacheScanner\OneDriveCache.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\CacheScanner\OneDriveCache.exe N/A
N/A N/A C:\Users\Admin\CacheScanner\OneDriveCache.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Software\Microsoft\Windows\CurrentVersion\Run\CacheScanner = "C:\\Users\\Admin\\CacheScanner\\OneDriveCache.exe" C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Description Indicator Process Target
N/A ident.me N/A N/A
N/A ident.me N/A N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\CacheScanner\OneDriveCache.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\CacheScanner\OneDriveCache.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3468 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe
PID 3468 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe
PID 4936 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe C:\Windows\system32\cmd.exe
PID 4936 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe C:\Windows\system32\cmd.exe
PID 4936 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4936 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4936 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe C:\Windows\system32\cmd.exe
PID 4936 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe C:\Windows\system32\cmd.exe
PID 3320 wrote to memory of 4800 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\CacheScanner\OneDriveCache.exe
PID 3320 wrote to memory of 4800 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\CacheScanner\OneDriveCache.exe
PID 3320 wrote to memory of 3924 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3320 wrote to memory of 3924 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4800 wrote to memory of 1536 N/A C:\Users\Admin\CacheScanner\OneDriveCache.exe C:\Users\Admin\CacheScanner\OneDriveCache.exe
PID 4800 wrote to memory of 1536 N/A C:\Users\Admin\CacheScanner\OneDriveCache.exe C:\Users\Admin\CacheScanner\OneDriveCache.exe
PID 1536 wrote to memory of 2152 N/A C:\Users\Admin\CacheScanner\OneDriveCache.exe C:\Windows\system32\cmd.exe
PID 1536 wrote to memory of 2152 N/A C:\Users\Admin\CacheScanner\OneDriveCache.exe C:\Windows\system32\cmd.exe
PID 1536 wrote to memory of 4564 N/A C:\Users\Admin\CacheScanner\OneDriveCache.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1536 wrote to memory of 4564 N/A C:\Users\Admin\CacheScanner\OneDriveCache.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1536 wrote to memory of 3644 N/A C:\Users\Admin\CacheScanner\OneDriveCache.exe C:\Windows\system32\cmd.exe
PID 1536 wrote to memory of 3644 N/A C:\Users\Admin\CacheScanner\OneDriveCache.exe C:\Windows\system32\cmd.exe
PID 3644 wrote to memory of 2204 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3644 wrote to memory of 2204 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1536 wrote to memory of 3692 N/A C:\Users\Admin\CacheScanner\OneDriveCache.exe C:\Windows\system32\cmd.exe
PID 1536 wrote to memory of 3692 N/A C:\Users\Admin\CacheScanner\OneDriveCache.exe C:\Windows\system32\cmd.exe
PID 3692 wrote to memory of 2136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 3692 wrote to memory of 2136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe

Processes

C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe

"C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe"

C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe

"C:\Users\Admin\AppData\Local\Temp\RipperScanner.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\CacheScanner\""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\CacheScanner\activate.bat

C:\Users\Admin\CacheScanner\OneDriveCache.exe

"OneDriveCache.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im "RipperScanner.exe"

C:\Users\Admin\CacheScanner\OneDriveCache.exe

"OneDriveCache.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\CacheScanner\""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\systeminfo.exe

systeminfo

Network

Country Destination Domain Proto
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 gateway.discord.gg udp
US 162.159.136.234:443 gateway.discord.gg tcp
N/A 127.0.0.1:52638 tcp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 8.8.8.8:53 234.136.159.162.in-addr.arpa udp
US 8.8.8.8:53 ident.me udp
DE 49.12.234.183:443 ident.me tcp
US 8.8.8.8:53 ipv4.lafibre.info udp
NL 51.158.154.169:443 ipv4.lafibre.info tcp
US 8.8.8.8:53 183.234.12.49.in-addr.arpa udp
US 8.8.8.8:53 169.154.158.51.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI34682\python310.dll

MD5 178a0f45fde7db40c238f1340a0c0ec0
SHA1 dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA256 9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA512 4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

\Users\Admin\AppData\Local\Temp\_MEI34682\python310.dll

MD5 178a0f45fde7db40c238f1340a0c0ec0
SHA1 dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA256 9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA512 4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

C:\Users\Admin\AppData\Local\Temp\_MEI34682\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

memory/4936-1154-0x00007FFDDE970000-0x00007FFDDEDDE000-memory.dmp

\Users\Admin\AppData\Local\Temp\_MEI34682\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

C:\Users\Admin\AppData\Local\Temp\_MEI34682\base_library.zip

MD5 f5b15ac0a24a122d69c41843da5d463b
SHA1 e25772476631d5b6dd278cb646b93abd282c34ed
SHA256 ec3b8c865c6e3c5e35449b32dcb397da665d6a10fbee61284489a6c420c72a3b
SHA512 1704611166d63962e14deb6d519c2a7af4f05bca308c1949652fddf89bc526c594ede43a34b9306e5979998576f448951d08ad9e25b6d749d5d46b7d18d133b8

C:\Users\Admin\AppData\Local\Temp\_MEI34682\_ctypes.pyd

MD5 813fc3981cae89a4f93bf7336d3dc5ef
SHA1 daff28bcd155a84e55d2603be07ca57e3934a0de
SHA256 4ac7fb7b354069e71ebf7fcc193c0f99af559010a0ad82a03b49a92deb0f4d06
SHA512 ce93f21b315d96fde96517a7e13f66aa840d4ad1c6e69e68389e235e43581ad543095582ebcb9d2c6dda11c17851b88f5b1ed1d59d354578fe27e7299bbea1cc

\Users\Admin\AppData\Local\Temp\_MEI34682\python3.dll

MD5 c17b7a4b853827f538576f4c3521c653
SHA1 6115047d02fbbad4ff32afb4ebd439f5d529485a
SHA256 d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
SHA512 8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

\Users\Admin\AppData\Local\Temp\_MEI34682\python3.dll

MD5 c17b7a4b853827f538576f4c3521c653
SHA1 6115047d02fbbad4ff32afb4ebd439f5d529485a
SHA256 d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
SHA512 8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

C:\Users\Admin\AppData\Local\Temp\_MEI34682\python3.DLL

MD5 c17b7a4b853827f538576f4c3521c653
SHA1 6115047d02fbbad4ff32afb4ebd439f5d529485a
SHA256 d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
SHA512 8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

\Users\Admin\AppData\Local\Temp\_MEI34682\_ctypes.pyd

MD5 813fc3981cae89a4f93bf7336d3dc5ef
SHA1 daff28bcd155a84e55d2603be07ca57e3934a0de
SHA256 4ac7fb7b354069e71ebf7fcc193c0f99af559010a0ad82a03b49a92deb0f4d06
SHA512 ce93f21b315d96fde96517a7e13f66aa840d4ad1c6e69e68389e235e43581ad543095582ebcb9d2c6dda11c17851b88f5b1ed1d59d354578fe27e7299bbea1cc

\Users\Admin\AppData\Local\Temp\_MEI34682\libffi-7.dll

MD5 6f818913fafe8e4df7fedc46131f201f
SHA1 bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA256 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA512 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

C:\Users\Admin\AppData\Local\Temp\_MEI34682\libffi-7.dll

MD5 6f818913fafe8e4df7fedc46131f201f
SHA1 bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA256 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA512 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

memory/4936-1163-0x00007FFDE4050000-0x00007FFDE4074000-memory.dmp

memory/4936-1165-0x00007FFDE4040000-0x00007FFDE404F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI34682\_bz2.pyd

MD5 93fe6d3a67b46370565db12a9969d776
SHA1 ff520df8c24ed8aa6567dd0141ef65c4ea00903b
SHA256 92ec61ca9ac5742e0848a6bbb9b6b4cda8e039e12ab0f17fb9342d082dde471b
SHA512 5c91b56198a8295086c61b4f4e9f16900a7ec43ca4b84e793bc8a3fc8676048cab576e936515bf2971318c7847f1314674b3336fe83b1734f9f70d09615519ac

\Users\Admin\AppData\Local\Temp\_MEI34682\_bz2.pyd

MD5 93fe6d3a67b46370565db12a9969d776
SHA1 ff520df8c24ed8aa6567dd0141ef65c4ea00903b
SHA256 92ec61ca9ac5742e0848a6bbb9b6b4cda8e039e12ab0f17fb9342d082dde471b
SHA512 5c91b56198a8295086c61b4f4e9f16900a7ec43ca4b84e793bc8a3fc8676048cab576e936515bf2971318c7847f1314674b3336fe83b1734f9f70d09615519ac

memory/4936-1168-0x00007FFDE4020000-0x00007FFDE4039000-memory.dmp

\Users\Admin\AppData\Local\Temp\_MEI34682\_lzma.pyd

MD5 6f810f46f308f7c6ccddca45d8f50039
SHA1 6ee24ff6d1c95ba67e1275bb82b9d539a7f56cea
SHA256 39497259b87038e86c53e7a39a0b5bbbfcebe00b2f045a148041300b31f33b76
SHA512 c692367a26415016e05ebe828309d3ffec290c6d2fd8cc7419d529a51b0beda00ccdc327c9f187ae3ca0cc96336d23d84a8ff95b729c8958b14fb91b6da9e878

C:\Users\Admin\AppData\Local\Temp\_MEI34682\_lzma.pyd

MD5 6f810f46f308f7c6ccddca45d8f50039
SHA1 6ee24ff6d1c95ba67e1275bb82b9d539a7f56cea
SHA256 39497259b87038e86c53e7a39a0b5bbbfcebe00b2f045a148041300b31f33b76
SHA512 c692367a26415016e05ebe828309d3ffec290c6d2fd8cc7419d529a51b0beda00ccdc327c9f187ae3ca0cc96336d23d84a8ff95b729c8958b14fb91b6da9e878

C:\Users\Admin\AppData\Local\Temp\_MEI34682\_uuid.pyd

MD5 b10f1f10513a8876913ab8e9b2491426
SHA1 87e59bff4bd9ac5842de4d04dcaa84c870935183
SHA256 9c81eab871f6324a54f8f6248812eade891113bf45675a869553427ba5e963da
SHA512 e589a600d4a6db7720701e1ed0667e4cab17ab96930acfb6b91a2a5bbe5e672b5e4959a1767d5a2f48bcb53b387e5a268ba285b27cc4f08066f40447139e9f9c

C:\Users\Admin\AppData\Local\Temp\_MEI34682\_hashlib.pyd

MD5 4ae75c47dbdebaa16a596f31b27abd9e
SHA1 a11f963139c715921dedd24bc957ab6d14788c34
SHA256 2308ee238cc849b1110018b211b149d607bf447f4e4c1e61449049eab0cf513d
SHA512 e908fecb52268fac71933e2fdb96e539bdebe4675dfb50065aee26727bac53e07cca862193bcb3ab72d2ae62d660113a47e73e1e16db401480e4d3fd34d54fa8

\Users\Admin\AppData\Local\Temp\_MEI34682\_hashlib.pyd

MD5 4ae75c47dbdebaa16a596f31b27abd9e
SHA1 a11f963139c715921dedd24bc957ab6d14788c34
SHA256 2308ee238cc849b1110018b211b149d607bf447f4e4c1e61449049eab0cf513d
SHA512 e908fecb52268fac71933e2fdb96e539bdebe4675dfb50065aee26727bac53e07cca862193bcb3ab72d2ae62d660113a47e73e1e16db401480e4d3fd34d54fa8

\Users\Admin\AppData\Local\Temp\_MEI34682\libcrypto-1_1.dll

MD5 daa2eed9dceafaef826557ff8a754204
SHA1 27d668af7015843104aa5c20ec6bbd30f673e901
SHA256 4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914
SHA512 7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

\Users\Admin\AppData\Local\Temp\_MEI34682\_socket.pyd

MD5 7a31bc84c0385590e5a01c4cbe3865c3
SHA1 77c4121abe6e134660575d9015308e4b76c69d7c
SHA256 5614017765322b81cc57d841b3a63cbdc88678ff605e5d4c8fdbbf8f0ac00f36
SHA512 b80cd51e395a3ce6f345b69243d8fc6c46e2e3828bd0a7e63673a508d889a9905d562cac29f1ed394ccfcda72f2f2e22f675963dd96261c19683b06dea0a0882

\Users\Admin\AppData\Local\Temp\_MEI34682\_ssl.pyd

MD5 081c878324505d643a70efcc5a80a371
SHA1 8bef8336476d8b7c5c9ef71d7b7db4100de32348
SHA256 fcb70b58f94f5b0f9d027999cce25e99ddcc8124e4ddcc521cb5b96a52faaa66
SHA512 c36293b968a2f83705815ef3a207e444eeb7667ad9af61df75e85151f74f2fe0a299b3b1349de0d410bbbaea9f99cac5228189099a221de5fa1e20c97c648e32

\Users\Admin\AppData\Local\Temp\_MEI34682\select.pyd

MD5 666358e0d7752530fc4e074ed7e10e62
SHA1 b9c6215821f5122c5176ce3cf6658c28c22d46ba
SHA256 6615c62fa010bfba5527f5da8af97313a1af986f8564277222a72a1731248841
SHA512 1d3d35c095892562ddd2868fbd08473e48b3bb0cb64ef9ccc5550a06c88dda0d82383a1316b6c5584a49ca28ed1ef1e5ca94ec699a423a001ccd952bd6bd553d

\Users\Admin\AppData\Local\Temp\_MEI34682\libssl-1_1.dll

MD5 eac369b3fde5c6e8955bd0b8e31d0830
SHA1 4bf77158c18fe3a290e44abd2ac1834675de66b4
SHA256 60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c
SHA512 c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

memory/4936-1221-0x00007FFDE3F50000-0x00007FFDE3F69000-memory.dmp

memory/4936-1222-0x00007FFDE3F40000-0x00007FFDE3F4D000-memory.dmp

memory/4936-1223-0x00007FFDE3F10000-0x00007FFDE3F3E000-memory.dmp

memory/4936-1224-0x00007FFDE3D10000-0x00007FFDE3DC8000-memory.dmp

memory/4936-1225-0x00007FFDE3EF0000-0x00007FFDE3EFB000-memory.dmp

\Users\Admin\AppData\Local\Temp\_MEI34682\charset_normalizer\md.cp310-win_amd64.pyd

MD5 fd7838887746ab6ebdde4427c124f2a2
SHA1 839f9f982c3816bff698dcb5a4109f6d8da11592
SHA256 65b4faca21226d8436bee163d809700ca3c74d0ac2124043b846f43d9863f4df
SHA512 bf61d29f57b0c5a0ac9e2d8102bca3da0951e784a13ef36d1f7ea26b82b841c062a1b53d16dbc8f2f0f484508b39e3aef84f9f2d15a2e779da135bfd895675fa

C:\Users\Admin\AppData\Local\Temp\_MEI34682\charset_normalizer\md.cp310-win_amd64.pyd

MD5 fd7838887746ab6ebdde4427c124f2a2
SHA1 839f9f982c3816bff698dcb5a4109f6d8da11592
SHA256 65b4faca21226d8436bee163d809700ca3c74d0ac2124043b846f43d9863f4df
SHA512 bf61d29f57b0c5a0ac9e2d8102bca3da0951e784a13ef36d1f7ea26b82b841c062a1b53d16dbc8f2f0f484508b39e3aef84f9f2d15a2e779da135bfd895675fa

\Users\Admin\AppData\Local\Temp\_MEI34682\_queue.pyd

MD5 0e7612fc1a1fad5a829d4e25cfa87c4f
SHA1 3db2d6274ce3dbe3dbb00d799963df8c3046a1d6
SHA256 9f6965eb89bbf60df0c51ef0750bbd0655675110d6c42eca0274d109bd9f18a8
SHA512 52c57996385b9a573e3105efa09fd6fd24561589b032ef2b2ee60a717f4b33713c35989f2265669f980646d673e3c387b30b9fc98033bb8ca7c59ece1c17e517

memory/4936-1217-0x00007FFDD02E0000-0x00007FFDD0655000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI34682\_tkinter.pyd

MD5 590718c131f73080600718632bd921eb
SHA1 baeb12005cc6149b370106018b838e52c60d808c
SHA256 977ff6a5d134e867187bf3267d5a16da96418fb4c74ec6e0d5c6ae06a9a783e9
SHA512 174c950e59499ff1f74ad67993793fb0995e676d0cd1b2392fcfbf5ba4ab370bb9671021da2245d5be695e6ebb65986e65b8393f2acf6f9f47d3551c9e5e4c1c

C:\Users\Admin\AppData\Local\Temp\_MEI34682\_ssl.pyd

MD5 081c878324505d643a70efcc5a80a371
SHA1 8bef8336476d8b7c5c9ef71d7b7db4100de32348
SHA256 fcb70b58f94f5b0f9d027999cce25e99ddcc8124e4ddcc521cb5b96a52faaa66
SHA512 c36293b968a2f83705815ef3a207e444eeb7667ad9af61df75e85151f74f2fe0a299b3b1349de0d410bbbaea9f99cac5228189099a221de5fa1e20c97c648e32

memory/4936-1226-0x00007FFDE3ED0000-0x00007FFDE3EDB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI34682\_sqlite3.pyd

MD5 bb4aa2d11444900c549e201eb1a4cdd6
SHA1 ca3bb6fc64d66deaddd804038ea98002d254c50e
SHA256 f44d80ab16c27ca65da23ae5fda17eb842065f3e956f10126322b2ea3ecdf43f
SHA512 cd3c5704e5d99980109fdc505d39ad5b26a951685e9d8e3fed9e0848cd44e24cc4611669dbdb58acc20f1f4a5c37d5e01d9d965cf6fe74f94da1b29aa2ff6931

C:\Users\Admin\AppData\Local\Temp\_MEI34682\_socket.pyd

MD5 7a31bc84c0385590e5a01c4cbe3865c3
SHA1 77c4121abe6e134660575d9015308e4b76c69d7c
SHA256 5614017765322b81cc57d841b3a63cbdc88678ff605e5d4c8fdbbf8f0ac00f36
SHA512 b80cd51e395a3ce6f345b69243d8fc6c46e2e3828bd0a7e63673a508d889a9905d562cac29f1ed394ccfcda72f2f2e22f675963dd96261c19683b06dea0a0882

memory/4936-1227-0x00007FFDE3AC0000-0x00007FFDE3ACC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI34682\_queue.pyd

MD5 0e7612fc1a1fad5a829d4e25cfa87c4f
SHA1 3db2d6274ce3dbe3dbb00d799963df8c3046a1d6
SHA256 9f6965eb89bbf60df0c51ef0750bbd0655675110d6c42eca0274d109bd9f18a8
SHA512 52c57996385b9a573e3105efa09fd6fd24561589b032ef2b2ee60a717f4b33713c35989f2265669f980646d673e3c387b30b9fc98033bb8ca7c59ece1c17e517

C:\Users\Admin\AppData\Local\Temp\_MEI34682\_overlapped.pyd

MD5 9bd2b167101981c30c89d56492311553
SHA1 aa8e175a7894486a16a2d5d3a399c8894a7f1cae
SHA256 dd32ffbd9580876fb7fd1036f1fc3a6d9788627067ad9b0f3d366017b8865ccc
SHA512 0ec676e62f95b083142461745fdda699a7edf8597cea952ba4297f153a1d11abec621d5ce192d0ebdc52ebf3d745bf34f3161f87ad6593153cf1c95ecf474f45

C:\Users\Admin\AppData\Local\Temp\_MEI34682\_multiprocessing.pyd

MD5 3aadb93005d6c2ce4fba1dad0c99547f
SHA1 64aaeaf0a78ba60cf2c4324faf3dd94aeeacc297
SHA256 ec92fd9277bb5af0914c42f09d52651094793a7c4f79c35a4c9e4a2b6f955af3
SHA512 863a78664a5d43577cc6ffabe6028e8289201a94db81e00ebb29c301d996a46d496582779f22fd363820a0048245ac68e2af110231190d4fda2ab1e7b385bf98

C:\Users\Admin\AppData\Local\Temp\_MEI34682\_elementtree.pyd

MD5 31b43d82f290d98db22071addf6a7443
SHA1 f0790e953057545d2565278dd9f0c68477b6318d
SHA256 2bf758d7818b8633cae21a4bb717128aa654b53575a06a01b12eaa53baf59176
SHA512 55477076e23d93e756da8af7ef364f279f0ff3281b1e5cada2638425b07a78fe246336d27a4dcb2cc577c5c754055bca1e460c51160bada61862e6181a63c3ba

C:\Users\Admin\AppData\Local\Temp\_MEI34682\_decimal.pyd

MD5 f65d2fed5417feb5fa8c48f106e6caf7
SHA1 9260b1535bb811183c9789c23ddd684a9425ffaa
SHA256 574fe8e01054a5ba07950e41f37e9cf0aea753f20fe1a31f58e19202d1f641d8
SHA512 030502fa4895e0d82c8cce00e78831fc3b2e6d956c8cc3b9fb5e50cb23ef07cd6942949a9f16d02da6908523d9d4ef5f722fb1336d4a80cd944c9f0cb11239ab

memory/4936-1230-0x00007FFDE0760000-0x00007FFDE076B000-memory.dmp

memory/4936-1231-0x00007FFDE0750000-0x00007FFDE075C000-memory.dmp

memory/4936-1233-0x00007FFDE0730000-0x00007FFDE073E000-memory.dmp

memory/4936-1232-0x00007FFDE0740000-0x00007FFDE074D000-memory.dmp

memory/4936-1236-0x00007FFDE06F0000-0x00007FFDE06FB000-memory.dmp

memory/4936-1238-0x00007FFDE06D0000-0x00007FFDE06DC000-memory.dmp

memory/4936-1244-0x00007FFDE3F00000-0x00007FFDE3F0D000-memory.dmp

memory/4936-1243-0x00007FFDE3F70000-0x00007FFDE3F84000-memory.dmp

memory/4936-1242-0x00007FFDE0660000-0x00007FFDE0675000-memory.dmp

memory/4936-1245-0x00007FFDE3CE0000-0x00007FFDE3D04000-memory.dmp

memory/4936-1241-0x00007FFDE0690000-0x00007FFDE06A2000-memory.dmp

memory/4936-1240-0x00007FFDE06B0000-0x00007FFDE06BD000-memory.dmp

memory/4936-1246-0x00007FFDE3BC0000-0x00007FFDE3CD8000-memory.dmp

memory/4936-1248-0x00007FFDE3EE0000-0x00007FFDE3EEB000-memory.dmp

memory/4936-1250-0x00007FFDE0650000-0x00007FFDE0660000-memory.dmp

memory/4936-1252-0x00007FFDE0610000-0x00007FFDE062C000-memory.dmp

memory/4936-1251-0x00007FFDE0630000-0x00007FFDE0644000-memory.dmp

memory/4936-1253-0x00007FFDE05F0000-0x00007FFDE0603000-memory.dmp

memory/4936-1249-0x00007FFDE0680000-0x00007FFDE068C000-memory.dmp

memory/4936-1255-0x00007FFDE0570000-0x00007FFDE057E000-memory.dmp

memory/4936-1254-0x00007FFDE05D0000-0x00007FFDE05E5000-memory.dmp

memory/4936-1247-0x00007FFDE3B80000-0x00007FFDE3BB8000-memory.dmp

memory/4936-1256-0x00007FFDE0540000-0x00007FFDE055C000-memory.dmp

memory/4936-1239-0x00007FFDE06C0000-0x00007FFDE06CC000-memory.dmp

memory/4936-1258-0x00007FFDE0560000-0x00007FFDE056A000-memory.dmp

memory/4936-1259-0x00007FFDE0250000-0x00007FFDE02AD000-memory.dmp

memory/4936-1257-0x00007FFDE0580000-0x00007FFDE05C1000-memory.dmp

memory/4936-1237-0x00007FFDE06E0000-0x00007FFDE06EB000-memory.dmp

memory/4936-1235-0x00007FFDE0700000-0x00007FFDE070C000-memory.dmp

memory/4936-1234-0x00007FFDE0720000-0x00007FFDE072C000-memory.dmp

memory/4936-1228-0x00007FFDE3AB0000-0x00007FFDE3ABB000-memory.dmp

memory/4936-1229-0x00007FFDE3AA0000-0x00007FFDE3AAC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI34682\_cffi_backend.cp310-win_amd64.pyd

MD5 76041575bfb6c23f89168485ba802cd3
SHA1 740dbbbfb5a48985ee866139b2c3edcc33e88587
SHA256 3adf6b1cfcb47d99653c284dc74b13764f960873edf651e99b52a1b6ba1df590
SHA512 800fcac9c2e1312a6f3d46148a9d621ecbde07b473681d88a383d385c30adcc660d763a8babf32b8a4e815b2c2ce4a23d86660403c341f3dbc9ee021df341070

C:\Users\Admin\AppData\Local\Temp\_MEI34682\_asyncio.pyd

MD5 233f9c811b60c49e06d453977fc41c65
SHA1 97ffeae5938c919c0733e4b60c79a47a1b173ac7
SHA256 548baa872c4f1031bc0a77813629c6ecb864e4ab2f653b221be6a7baf2e1fc83
SHA512 46c7172e37a019987ec5844913823211f84a093faea8a2d7fd5727486ab79886ea0898b19bed18cb7af9022febdaafa7e154cdba42423834208531bf79f58e94

C:\Users\Admin\AppData\Local\Temp\_MEI34682\zlib1.dll

MD5 a35d7eeae683a35acb99e72e01cf132f
SHA1 cc37f1e0641f6afc821ef45a65986422eb853366
SHA256 c84547746f4c328daa9637414bbb252ec7124005d0cb7d4a8c62779cf641271c
SHA512 dd7996756a3aed62251f90cd0ae95feafa7bc1cfe7c51e7e2e09bfd30bf0bbb2775fe397a1963f63aed7ad49957b4dd75faed022c6ec4ed9576822f650612f2c

C:\Users\Admin\AppData\Local\Temp\_MEI34682\VCRUNTIME140_1.dll

MD5 bba9680bc310d8d25e97b12463196c92
SHA1 9a480c0cf9d377a4caedd4ea60e90fa79001f03a
SHA256 e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
SHA512 1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739

C:\Users\Admin\AppData\Local\Temp\_MEI34682\unicodedata.pyd

MD5 7a462a10aa1495cef8bfca406fb3637e
SHA1 6dcbd46198b89ef3007c76deb42ab10ba4c4cf40
SHA256 459bca991fcb88082d49d22cc6ebffe37381a5bd3efcc77c5a52f7a4bb3184c0
SHA512 d2b7c6997b4bd390257880a6f3336e88d1dd7159049811f8d7c54e3623e9b033e18e8922422869c81de72fc8c10890c173d8a958d192dd03bfc57cffaea1ac7b

C:\Users\Admin\AppData\Local\Temp\_MEI34682\tk86t.dll

MD5 705d202442d5c45f97f601b0a0fe68b7
SHA1 41ce23a7d279f675f16f22d3d0ab9b2eed2ed858
SHA256 5bc2117729d86f9caf1745ee42a9a456121cf9245acb8fa685ace77fcfe723a7
SHA512 d5f22b8c0232d79567b4be4096b0399db83ff4e3ae579826c0a33c08265a0342ce74d6331724cdc316276737db7040fea7a8f8b520853ec901239f47665a30f3

C:\Users\Admin\AppData\Local\Temp\_MEI34682\tcl86t.dll

MD5 cd5ed9fd9d0a08df65a0da18bd34439c
SHA1 6bc2d34a66be0e124788c6f5ee42fce25d127591
SHA256 0f2f4e7b87293ff4ab82bb4c2a0b3dda494bd9620751fc7b45c8b65a5889880b
SHA512 ee634ca22768645c25f6af9598236e844138cbe0ada097e58b7ff73d35bc9c75f2c4206f56d468068ebfa573fd707757f0e9d5bfce077d31ee850f99775c00c1

C:\Users\Admin\AppData\Local\Temp\_MEI34682\sqlite3.dll

MD5 bd2819965b59f015ec4233be2c06f0c1
SHA1 cff965068f1659d77be6f4942ca1ada3575ca6e2
SHA256 ab072d20cee82ae925dae78fd41cae7cd6257d14fd867996382a69592091d8ec
SHA512 f7758bd71d2ad236bf3220db0ad26f3866d9977eab311a5912f6e079b59fa918735c852de6dbf7b5fee9e04124bc0cd438c4c71edc0c04309330108ba0085d59

C:\Users\Admin\AppData\Local\Temp\_MEI34682\select.pyd

MD5 666358e0d7752530fc4e074ed7e10e62
SHA1 b9c6215821f5122c5176ce3cf6658c28c22d46ba
SHA256 6615c62fa010bfba5527f5da8af97313a1af986f8564277222a72a1731248841
SHA512 1d3d35c095892562ddd2868fbd08473e48b3bb0cb64ef9ccc5550a06c88dda0d82383a1316b6c5584a49ca28ed1ef1e5ca94ec699a423a001ccd952bd6bd553d

memory/4936-1260-0x00007FFDE0510000-0x00007FFDE0539000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI34682\SDL2_ttf.dll

MD5 9f5ece4e13e42058fa5ea65215c41c5d
SHA1 eddcecb4f10f2bb9b61c57b88fb6bd1b1d560a07
SHA256 f5f2690285fc087376ff03edb8849ab5f24c6e9d60ae3661013bea621786582b
SHA512 09cf0927b7cdb84f9ddec465ba10874af6160f947e58e9ff9ead2aa6d10e7d164dd8c5e2df6314f0dd8a84d0b104b48dbac8cc96522f749d54041b3e8ec03400

C:\Users\Admin\AppData\Local\Temp\_MEI34682\SDL2_mixer.dll

MD5 1230b474eca2c4cefb13cf0aaa2fc5d0
SHA1 e23f9cf8cb7dd47e92a02f7508922f01d4d1364b
SHA256 6879a16d963159cb0666e654ea4d5e9a92abffd96cfc6fffe6b39ae81b4ffca3
SHA512 2520fdfbd1370bb9683c29fe1722f771e3d4c7df635987371190be5445237f9e96ae506bbeb79035f6f483ac116995b56bb1e9fc35b6f6a6d49bb940dbf72ead

C:\Users\Admin\AppData\Local\Temp\_MEI34682\SDL2_image.dll

MD5 7174d7a8eec42d7700c5f4adfff39b57
SHA1 b850f0814e77a67f0414a85aae88c9534ca857e5
SHA256 155eab85fe565f6dd1ecb29d6496425539c994bc0d14b52cabd850df5927f9bf
SHA512 9a79cc9661cdab7efeb096f1eb121807ba937b444546d46a321613f6d2792ebf09cc62ff067ece7cb0458b988d6081feadd33e93a52c24faac53dc1539bf32c9

C:\Users\Admin\AppData\Local\Temp\_MEI34682\SDL2.dll

MD5 9684069bb2b8892408ccb50d66abbeda
SHA1 7df5e8f28481c4e7aef128e017a53a36b86c3b7b
SHA256 123c8a0d647e5b866545f8e1cc4cfba5fdadf8c1a247692050355a609d81996b
SHA512 fbe493326da9b582c9c4fa1b16ba02e5befcf5787324116656e108527894f692c3fc21493419a419833ab37a5fa5fb5e38e2c04a8cbdbc3c8afeba08df390697

C:\Users\Admin\AppData\Local\Temp\_MEI34682\pyexpat.pyd

MD5 0bcfd9aa6131d40693ea77fb593f6e2f
SHA1 8b837d663ac7e186c7e427a272c7403c880a9d5f
SHA256 0b966bb1c97b5947a01af98abbe636f34bd492edeba99ce0276108fbe07d2ea6
SHA512 683b9c2c5b810cfef68f684b2927a2123ff4acf2d5377b368fe1d69054ebd2d96e99e850bd8c77a2950d55ce96ada7ad7db81b6c309d0fe7058fd9fd7e2524b3

C:\Users\Admin\AppData\Local\Temp\_MEI34682\portmidi.dll

MD5 1b443fe9c75d57eedcf5fd67493573e2
SHA1 27504e51f5f19d3d73ed2a0ba473dc5cda787679
SHA256 96b2ba3d433b0e0a0ce72c72725e033ca35b570225b55b38fb7d71c716418ee3
SHA512 02f0ee765490d999ac621f54411b039ef42dddeba17d2edbb9970db20e481d29aed4d607d8330a7c5cd7133b214f13dcb427e89903f9baaef20ffc4a431bb0c4

C:\Users\Admin\AppData\Local\Temp\_MEI34682\libwebp-7.dll

MD5 4276d3cb447a08644a2c1d3b7afb9fdf
SHA1 d63f34d0b4e8eb660a92a3843b695eda16294b80
SHA256 cc3831ce9ff18f5ebfde8b20d1ee237e2336e4d9ca6405392ac5ec9c8c948174
SHA512 d3a539176243e31a15877b0a6c40c295036ccac5c3ac13cd7b74a340c4183a661a630bbe6b5b0c0ff54b4b27fc72bc154883c7ba5167cb4baeb4b0a528f514bc

C:\Users\Admin\AppData\Local\Temp\_MEI34682\libtiff-5.dll

MD5 f374796886d56c6c552f3a92a81c3338
SHA1 d61f0297386e9925a6ac0c6469ba40b86d3c98cd
SHA256 e2c5b370bcade6a167dba5dc9bb33107d4ed2612e7e8af8d1035be72f35f90d7
SHA512 b59cd888b41c67bf139c2c78d7968a33c84e9127752b9fa276b7b3b461a01cd71dc72936e51a334ddad7fa8e67dd4c250a3495ce544aa156efacb77e7f1dce9f

C:\Users\Admin\AppData\Local\Temp\_MEI34682\libssl-1_1.dll

MD5 eac369b3fde5c6e8955bd0b8e31d0830
SHA1 4bf77158c18fe3a290e44abd2ac1834675de66b4
SHA256 60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c
SHA512 c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

C:\Users\Admin\AppData\Local\Temp\_MEI34682\libpng16-16.dll

MD5 8f3bf615136b7241204419fb24c8d5ad
SHA1 d107f0b405c566974c37be20e1abbd365ccbb750
SHA256 a9c4d2443d6de90091eff8a5adfd7a3c207b0c7aefb913b855320866e93f8039
SHA512 a2ced7974c086291e69dce39f841335c771088aecbbc52b049d7af51c81342bd1e8bd0d8c78e62529e2041d15d8f5317e5a41727e299c2d827027bcbb0382aa1

C:\Users\Admin\AppData\Local\Temp\_MEI34682\libopusfile-0.dll

MD5 a729c1b14d695b00ae79472d3fe45339
SHA1 20cd334187fc7297138f014303e5c82b5f918c80
SHA256 57bb8b7dec2bd35ff1031f12c4ba3aa3cb2e8de2445e21ea29ffa3ad13e7be3a
SHA512 1da8060b1767bdf811b005e4a476c18f1c2f93186334aa40ca59937cec7aed37267c45a3b5aaeb8fa13d9b0639959d128d957e6d08fcb9787926df850e42fc22

C:\Users\Admin\AppData\Local\Temp\_MEI34682\libopus-0.x64.dll

MD5 17bed62f3389d532d3dfc59071bbd214
SHA1 2b0894cc48dd3756f0ff6602bf8c1e24cb8b6642
SHA256 4fd26640721088ac31fdac941db6fa3c094ca17bd97d240992969aefae19ff91
SHA512 976c5e0dd50487eb5f88c195633805cccbf34566496065eaf8f3ecbbea0300653097bfbbf628dbb2c238a4d552460187794bcebcb8d41452a3f873f0244fc6a4

C:\Users\Admin\AppData\Local\Temp\_MEI34682\libopus-0.dll

MD5 3c2e93c3d2b292a0f489449209f8e099
SHA1 751f18a79c6da4e7162439cef4d481189d17a242
SHA256 b6b32593c0bcecea7b31a900086870bbab039f25b29067170ac461cf2479dea5
SHA512 a0ec68d2a1c650720b4e3e437a5841e8d04d165fc920ce26a41cc20d6ddf4c761b05bbf3426e241c2ee13a9fbe146fc889aa45df70397600b2d962bdaa1bedbb

C:\Users\Admin\AppData\Local\Temp\_MEI34682\libogg-0.dll

MD5 6ffebd7d283079e9029c7f29d8ca7fba
SHA1 b470b09c8aa2f3e42bcff8392d95b6259cb87555
SHA256 0d9a915ea29ed4da271f86dbcfa90b52064a26b5136af590b2bb430d5dd6a67e
SHA512 2b9a9b5f298eefccf0a08af52d7c2c803db19ab9f3cedad2bb19df50466527c05e31f956b6018c9a337565448249465eba8952e9e8397b728b7f76e4f0561c68

C:\Users\Admin\AppData\Local\Temp\_MEI34682\libmodplug-1.dll

MD5 072093b2671589d4ce465de2b92ebee4
SHA1 821d9827286271859640984df28e01b4a37341fb
SHA256 04d07b4dcae8d3998156d563df20881ba790c32389aca23ade91de9cf9f4a3d4
SHA512 522d5faa8d17017f1891374a23d6e653cd62b51818734bf1f7343248d09e1e314ae49821595818fe69af62c9e51debca4ae384e421ad8fa658aced95f977379e

C:\Users\Admin\AppData\Local\Temp\_MEI34682\libjpeg-9.dll

MD5 6e67e46f957f50215b7e68c9091db53f
SHA1 e969fa4858351c95c337352dd0578fe5a83403f0
SHA256 24b25fe9ebe303496973c4d11144b053a5f5a03eabf53f9d8eab0c15fdbfbffe
SHA512 86af5560269ef21490f5343ea3e0522f35e271d42e64f61a2f05471302856de79d34bf00658e1667d7145af48667627fa3897bca2fc479928ab9a62ecba81396

C:\Users\Admin\AppData\Local\Temp\_MEI34682\libcrypto-1_1.dll

MD5 daa2eed9dceafaef826557ff8a754204
SHA1 27d668af7015843104aa5c20ec6bbd30f673e901
SHA256 4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914
SHA512 7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

C:\Users\Admin\AppData\Local\Temp\_MEI34682\freetype.dll

MD5 522257e451efcc3bfe980f56d3fed113
SHA1 f5e12321517f523842943ea7f3ba74d449dba1f4
SHA256 8c74376e7932eebcd084191b40774056b32525ba48e375d942754cdc4fc03c60
SHA512 d590cd813281278be4aec86af3713216dd306399b4910221a2447a3200accbca1b5f8d9495bf21f69ff8e09e5465a71c715a85ce0d87cdc26cbf27b0fae2cc4c

C:\Users\Admin\AppData\Local\Temp\_MEI34682\crypto_clipper.json

MD5 da626c1cb4be06b2c6e5bf24171bacf5
SHA1 afe10e3db0ce1a6da3540ebf2b6d3f0845ef1175
SHA256 b54dd5bec6901ecda1e323da8eb790a7fa6bc5cb4073b39c286b80c47831def3
SHA512 67390f77d8c8dfae165c8db8a8a0e0bb9729dbbae873b4870cf72eb0f20ea26fe544dbea897eda837c2f0eaf12e85326657243117f0b36434419d0ae8652d74e

memory/4936-1171-0x00007FFDE3F90000-0x00007FFDE3FBD000-memory.dmp

memory/4936-1261-0x00007FFDDE970000-0x00007FFDDEDDE000-memory.dmp

memory/4936-1262-0x00007FFDE0220000-0x00007FFDE024E000-memory.dmp

memory/4936-1263-0x00007FFDE4050000-0x00007FFDE4074000-memory.dmp

memory/4936-1264-0x00007FFDE0200000-0x00007FFDE021F000-memory.dmp

memory/4936-1265-0x00007FFDE0080000-0x00007FFDE01F1000-memory.dmp

memory/4936-1267-0x00007FFDE4020000-0x00007FFDE4039000-memory.dmp

memory/4936-1268-0x00007FFDE3F90000-0x00007FFDE3FBD000-memory.dmp

memory/4936-1266-0x00007FFDE0060000-0x00007FFDE0078000-memory.dmp

memory/4936-1269-0x00007FFDE0610000-0x00007FFDE062C000-memory.dmp

memory/4936-1270-0x00007FFDE04F0000-0x00007FFDE04FB000-memory.dmp

memory/4936-1271-0x00007FFDDFFE0000-0x00007FFDDFFEB000-memory.dmp

memory/4936-1272-0x00007FFDDFFD0000-0x00007FFDDFFDC000-memory.dmp

memory/4936-1273-0x00007FFDDFFC0000-0x00007FFDDFFCB000-memory.dmp

memory/4936-1274-0x00007FFDDFFB0000-0x00007FFDDFFBC000-memory.dmp

memory/4936-1276-0x00007FFDDFF90000-0x00007FFDDFF9E000-memory.dmp

memory/4936-1275-0x00007FFDDFFA0000-0x00007FFDDFFAD000-memory.dmp

memory/4936-1277-0x00007FFDDFF80000-0x00007FFDDFF8C000-memory.dmp

memory/4936-1278-0x00007FFDDFF70000-0x00007FFDDFF7C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v5jieu4u.2ra.ps1

MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

memory/4936-1433-0x00007FFDDE970000-0x00007FFDDEDDE000-memory.dmp

memory/4936-1435-0x00007FFDE4040000-0x00007FFDE404F000-memory.dmp

memory/4936-1438-0x00007FFDE3F70000-0x00007FFDE3F84000-memory.dmp

memory/4936-1441-0x00007FFDE3F40000-0x00007FFDE3F4D000-memory.dmp

memory/4936-1440-0x00007FFDE3F50000-0x00007FFDE3F69000-memory.dmp

memory/4936-1442-0x00007FFDE3F10000-0x00007FFDE3F3E000-memory.dmp

memory/4936-1439-0x00007FFDD02E0000-0x00007FFDD0655000-memory.dmp

memory/4936-1437-0x00007FFDE3F90000-0x00007FFDE3FBD000-memory.dmp

memory/4936-1436-0x00007FFDE4020000-0x00007FFDE4039000-memory.dmp

memory/4936-1434-0x00007FFDE4050000-0x00007FFDE4074000-memory.dmp

memory/4936-1443-0x00007FFDE3D10000-0x00007FFDE3DC8000-memory.dmp

memory/4936-1444-0x00007FFDE3F00000-0x00007FFDE3F0D000-memory.dmp

memory/4936-1445-0x00007FFDE3EF0000-0x00007FFDE3EFB000-memory.dmp

memory/4936-1446-0x00007FFDE3CE0000-0x00007FFDE3D04000-memory.dmp

memory/4936-1447-0x00007FFDE3BC0000-0x00007FFDE3CD8000-memory.dmp

memory/4936-1448-0x00007FFDE3B80000-0x00007FFDE3BB8000-memory.dmp

memory/4936-1450-0x00007FFDE0650000-0x00007FFDE0660000-memory.dmp

memory/4936-1449-0x00007FFDE0660000-0x00007FFDE0675000-memory.dmp

memory/4936-1452-0x00007FFDE0630000-0x00007FFDE0644000-memory.dmp

memory/4936-1453-0x00007FFDE0610000-0x00007FFDE062C000-memory.dmp

memory/4936-1462-0x00007FFDE0580000-0x00007FFDE05C1000-memory.dmp

memory/4936-1457-0x00007FFDE05D0000-0x00007FFDE05E5000-memory.dmp

memory/4936-1463-0x00007FFDE0570000-0x00007FFDE057E000-memory.dmp

memory/4936-1475-0x00007FFDE0540000-0x00007FFDE055C000-memory.dmp

memory/4936-1467-0x00007FFDE0560000-0x00007FFDE056A000-memory.dmp

memory/4936-1455-0x00007FFDE05F0000-0x00007FFDE0603000-memory.dmp

memory/4936-1497-0x00007FFDE0250000-0x00007FFDE02AD000-memory.dmp

memory/4936-1500-0x00007FFDE0510000-0x00007FFDE0539000-memory.dmp

memory/4936-1503-0x00007FFDE0220000-0x00007FFDE024E000-memory.dmp

memory/4936-1510-0x00007FFDE0200000-0x00007FFDE021F000-memory.dmp

memory/4936-1511-0x00007FFDE0080000-0x00007FFDE01F1000-memory.dmp

memory/4936-1519-0x00007FFDE0060000-0x00007FFDE0078000-memory.dmp

memory/4936-1532-0x00007FFDDFDD0000-0x00007FFDDFE04000-memory.dmp

memory/4936-1551-0x00007FFDDEF00000-0x00007FFDDEF2B000-memory.dmp

memory/4936-1550-0x00007FFDDEF30000-0x00007FFDDEFEC000-memory.dmp

memory/4936-1553-0x00007FFDD0080000-0x00007FFDD02D4000-memory.dmp

memory/4936-1556-0x00007FFDDE910000-0x00007FFDDE965000-memory.dmp

memory/4936-1560-0x00007FFDDE8F0000-0x00007FFDDE901000-memory.dmp

memory/4936-1562-0x00007FFDCFE00000-0x00007FFDD0078000-memory.dmp

memory/4936-1578-0x00007FFDDE8B0000-0x00007FFDDE8C5000-memory.dmp

memory/4936-1569-0x00007FFDDE8D0000-0x00007FFDDE8E6000-memory.dmp

memory/4936-1579-0x00007FFDDF0E0000-0x00007FFDDF0EF000-memory.dmp

memory/4936-1580-0x00007FFDDE8A0000-0x00007FFDDE8AC000-memory.dmp

memory/4936-1583-0x00007FFDDE850000-0x00007FFDDE86B000-memory.dmp

memory/4936-1582-0x00007FFDDE870000-0x00007FFDDE87E000-memory.dmp

memory/4936-1581-0x00007FFDDE880000-0x00007FFDDE891000-memory.dmp

memory/4936-1584-0x00007FFDDE7B0000-0x00007FFDDE7C5000-memory.dmp

memory/4936-1585-0x00007FFDDE740000-0x00007FFDDE784000-memory.dmp

memory/4936-1586-0x00007FFDDE720000-0x00007FFDDE736000-memory.dmp

memory/4936-1587-0x00007FFDDE700000-0x00007FFDDE714000-memory.dmp

memory/4936-1588-0x00007FFDDE6E0000-0x00007FFDDE6F1000-memory.dmp

memory/4936-1589-0x00007FFDDE6D0000-0x00007FFDDE6DE000-memory.dmp

memory/4936-1590-0x0000000068B40000-0x0000000068B81000-memory.dmp

memory/4936-1592-0x0000000062E80000-0x0000000062EA8000-memory.dmp

memory/4936-1591-0x000000006A880000-0x000000006A8AB000-memory.dmp

memory/4936-1593-0x00007FFDDE6C0000-0x00007FFDDE6CE000-memory.dmp

memory/4936-1594-0x00007FFDDE680000-0x00007FFDDE68F000-memory.dmp

memory/4936-1595-0x00007FFDDE670000-0x00007FFDDE67E000-memory.dmp

memory/4936-1596-0x00007FFDDE660000-0x00007FFDDE66E000-memory.dmp

memory/4936-1597-0x00007FFDDE640000-0x00007FFDDE656000-memory.dmp

memory/4936-1598-0x00007FFDDE630000-0x00007FFDDE640000-memory.dmp

memory/4936-1599-0x00007FFDDE610000-0x00007FFDDE625000-memory.dmp

memory/4936-1600-0x00007FFDDE510000-0x00007FFDDE527000-memory.dmp

memory/4936-1601-0x00007FFDDE600000-0x00007FFDDE60F000-memory.dmp