Malware Analysis Report

2025-08-06 00:04

Sample ID 240223-mcp5qsfb83
Target setup.exe
SHA256 21865f37dd2347dcda29a3bf2aad9ee884e09e73b70b68dcf4c8ad1f9b278942
Tags
discovery evasion
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

21865f37dd2347dcda29a3bf2aad9ee884e09e73b70b68dcf4c8ad1f9b278942

Threat Level: Shows suspicious behavior

The file setup.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery evasion

Modifies Windows Firewall

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Drops file in Program Files directory

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Kills process with taskkill

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-23 10:19

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-23 10:19

Reported

2024-02-23 10:22

Platform

win7-20240221-en

Max time kernel

144s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

Signatures

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Counter-Strike Global Offensive\7lcfg_cs2.ini C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp N/A
File opened for modification C:\Program Files\Counter-Strike Global Offensive\rev.ini C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp N/A
File created C:\Program Files\Counter-Strike Global Offensive\uninstclient\unins000.msg C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp N/A
File opened for modification C:\Program Files\Counter-Strike Global Offensive\uninstclient\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp N/A
File created C:\Program Files\Counter-Strike Global Offensive\uninstclient\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp N/A
File created C:\Program Files\Counter-Strike Global Offensive\uninstclient\is-RF5CE.tmp C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp N/A
File created C:\Program Files\Counter-Strike Global Offensive\7launcher\is-3U0UK.tmp C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp N/A
File created C:\Program Files\Counter-Strike Global Offensive\7launcher\is-81N3Q.tmp C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2912 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp
PID 2912 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp
PID 2912 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp
PID 2912 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp
PID 2912 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp
PID 2912 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp
PID 2912 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp
PID 3012 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 312 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\netsh.exe
PID 3012 wrote to memory of 312 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\netsh.exe
PID 3012 wrote to memory of 312 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\netsh.exe
PID 3012 wrote to memory of 312 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\netsh.exe
PID 3012 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\netsh.exe
PID 3012 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\netsh.exe
PID 3012 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\netsh.exe
PID 3012 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\netsh.exe
PID 3012 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\netsh.exe
PID 3012 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\netsh.exe
PID 3012 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\netsh.exe
PID 3012 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\netsh.exe
PID 3012 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\netsh.exe
PID 3012 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\netsh.exe
PID 3012 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\netsh.exe
PID 3012 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\netsh.exe
PID 3012 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 328 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe
PID 3012 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp C:\Windows\system32\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp

"C:\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp" /SL5="$600EC,2697986,268288,C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Windows\system32\taskkill.exe

"C:\Windows\system32\taskkill.exe" /F /IM Run_CS2.exe

C:\Windows\system32\taskkill.exe

"C:\Windows\system32\taskkill.exe" /F /IM Run_CSGO.exe

C:\Windows\system32\taskkill.exe

"C:\Windows\system32\taskkill.exe" /F /IM csgo.exe

C:\Windows\system32\taskkill.exe

"taskkill.exe" /f /im "Run_CS2.exe"

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="P2P In" program="C:\Program Files\Counter-Strike Global Offensive\7launcher\tools\aria2\aria2c.exe" dir=in action=allow enable=yes

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="P2P Out" program="C:\Program Files\Counter-Strike Global Offensive\7launcher\tools\aria2\aria2c.exe" dir=out action=allow enable=yes

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Counter-Strike Global Offensive In" program="C:\Program Files\Counter-Strike Global Offensive\csgo.exe" dir=in action=allow enable=yes

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Counter-Strike Global Offensive Out" program="C:\Program Files\Counter-Strike Global Offensive\csgo.exe" dir=out action=allow enable=yes

C:\Windows\system32\taskkill.exe

"C:\Windows\system32\taskkill.exe" /F /IM cls-lolz_x86.exe

C:\Windows\system32\taskkill.exe

"C:\Windows\system32\taskkill.exe" /F /IM cls-lolz_x64.exe

C:\Windows\system32\taskkill.exe

"C:\Windows\system32\taskkill.exe" /F /IM xtool.exe

Network

N/A

Files

memory/2912-1-0x0000000000400000-0x000000000044B000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-OFVV0.tmp\setup.tmp

MD5 5387623ad877ef153fe604fbcaa67c6f
SHA1 207bde42f2b60fad94906dbd6b0eeaff56345b24
SHA256 2a6cecb802016f8c6edcc86d24eecc0da373cf620b2f70c4bafa7ca357dcc2df
SHA512 85d3824079c95ac3d0a9435199a30659a0a78a132fa681f66acf6d117cb5fa26df4e9c9a659ece07d12de57c19eeafc7a01855d5d3c868f3b88bbe5a1ea2a159

memory/3012-8-0x0000000000240000-0x0000000000241000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-09FD2.tmp\ISDone.dll

MD5 e5d596903de4973dc6e201529ff042b2
SHA1 4b6439ba8f6ab52c23498b790923d9d24a3fa03d
SHA256 afd38bf8761aa06908a74a69dc2a5c31bbc6485f2d862da901e04680220dea23
SHA512 951e1a86dfde32dc83c1da0bf7551d48dd3572c5b642758b3c5f90336f9a703f3d9fafe25195db4dcbaac64030baeeb80f4d8fdd51645c6956618c7e7cdeee08

memory/3012-12-0x0000000002E90000-0x0000000002F07000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-09FD2.tmp\cls-diskspan.dll

MD5 b4a275ec5ad09069dcb569f8020c7ccb
SHA1 8632162e63bd30712275b6245b8344f973465db4
SHA256 c86786af639abd74b189d9922797be8b5ac763d162e7566b1877437e2aa377fe
SHA512 1276f9e9c284a74bcc8760031cfc263f1d2ae9573e2d5952b09cabe09084a66c603b095a2fb8baa3791606e2443b7cba88a451dcc36005781163563fd7bce39f

memory/3012-16-0x0000000003010000-0x0000000003137000-memory.dmp

memory/2912-19-0x0000000000400000-0x000000000044B000-memory.dmp

memory/3012-20-0x0000000000400000-0x0000000000552000-memory.dmp

memory/3012-21-0x0000000002E90000-0x0000000002F07000-memory.dmp

memory/3012-22-0x0000000003010000-0x0000000003137000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-09FD2.tmp\cls.ini

MD5 8c91f3d2f3576180e9c2aad105d89a3d
SHA1 3a2a19cfd772ff094b7e80749037bae1a413e7e8
SHA256 c3900619cb3cc5f0854e5c0de7b572522ef89c1f9ba1019d261bf6f23b178ca4
SHA512 d1dc002973f54b8e192d5b0562b332879ab48496f2bfeb9154cce187485fbd27129ac5bfbbbc3ef89d19363001f7d76d4760d9090d970b6720ac19c5c6cd350a

C:\Program Files\Counter-Strike Global Offensive\7lcfg_cs2.ini

MD5 da4714d1cfaea9b7addfd6351533e6a3
SHA1 cf114bc173f6e014a6437710af1a6a52ac8fffc6
SHA256 4f72037f848182133c7ae979aa4dfaee3f39b21938c28670bede74c905e9efa6
SHA512 1fad15cac75c4285208b18547ef928e5ddd4e6c798865b14fec6137d90f0af8261d39a07968df21d260a4c519a9c0b57c005a4889e832a9d8504eb54212c1a88

memory/3012-66-0x0000000002E90000-0x0000000002F07000-memory.dmp

memory/3012-65-0x0000000000400000-0x0000000000552000-memory.dmp

memory/3012-67-0x0000000003010000-0x0000000003137000-memory.dmp

memory/3012-68-0x0000000000240000-0x0000000000241000-memory.dmp

memory/3012-70-0x0000000000400000-0x0000000000552000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-23 10:19

Reported

2024-02-23 10:22

Platform

win10v2004-20240221-en

Max time kernel

147s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-74664.tmp\setup.tmp N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Users\Admin\AppData\Local\Temp\is-74664.tmp\setup.tmp

"C:\Users\Admin\AppData\Local\Temp\is-74664.tmp\setup.tmp" /SL5="$A0066,2697986,268288,C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Windows\system32\taskkill.exe

"C:\Windows\system32\taskkill.exe" /F /IM Run_CS2.exe

C:\Windows\system32\taskkill.exe

"C:\Windows\system32\taskkill.exe" /F /IM Run_CSGO.exe

C:\Windows\system32\taskkill.exe

"C:\Windows\system32\taskkill.exe" /F /IM csgo.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 177.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp

Files

memory/4600-0-0x0000000000400000-0x000000000044B000-memory.dmp

memory/4600-2-0x0000000000400000-0x000000000044B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-74664.tmp\setup.tmp

MD5 5387623ad877ef153fe604fbcaa67c6f
SHA1 207bde42f2b60fad94906dbd6b0eeaff56345b24
SHA256 2a6cecb802016f8c6edcc86d24eecc0da373cf620b2f70c4bafa7ca357dcc2df
SHA512 85d3824079c95ac3d0a9435199a30659a0a78a132fa681f66acf6d117cb5fa26df4e9c9a659ece07d12de57c19eeafc7a01855d5d3c868f3b88bbe5a1ea2a159

memory/632-6-0x0000000000690000-0x0000000000691000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-VG0QC.tmp\ISDone.dll

MD5 e5d596903de4973dc6e201529ff042b2
SHA1 4b6439ba8f6ab52c23498b790923d9d24a3fa03d
SHA256 afd38bf8761aa06908a74a69dc2a5c31bbc6485f2d862da901e04680220dea23
SHA512 951e1a86dfde32dc83c1da0bf7551d48dd3572c5b642758b3c5f90336f9a703f3d9fafe25195db4dcbaac64030baeeb80f4d8fdd51645c6956618c7e7cdeee08

memory/632-12-0x0000000003380000-0x00000000033F7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-VG0QC.tmp\cls-diskspan.dll

MD5 b4a275ec5ad09069dcb569f8020c7ccb
SHA1 8632162e63bd30712275b6245b8344f973465db4
SHA256 c86786af639abd74b189d9922797be8b5ac763d162e7566b1877437e2aa377fe
SHA512 1276f9e9c284a74bcc8760031cfc263f1d2ae9573e2d5952b09cabe09084a66c603b095a2fb8baa3791606e2443b7cba88a451dcc36005781163563fd7bce39f

memory/632-18-0x0000000003500000-0x0000000003627000-memory.dmp

memory/4600-21-0x0000000000400000-0x000000000044B000-memory.dmp

memory/632-22-0x0000000000400000-0x0000000000552000-memory.dmp

memory/632-23-0x0000000003380000-0x00000000033F7000-memory.dmp

memory/632-24-0x0000000003500000-0x0000000003627000-memory.dmp

memory/632-29-0x0000000000690000-0x0000000000691000-memory.dmp

memory/632-32-0x0000000003380000-0x00000000033F7000-memory.dmp

memory/632-33-0x0000000003500000-0x0000000003627000-memory.dmp

memory/632-38-0x0000000000400000-0x0000000000552000-memory.dmp

memory/4600-40-0x0000000000400000-0x000000000044B000-memory.dmp