Malware Analysis Report

2025-08-11 01:27

Sample ID 240229-gb33baga6z
Target Trojan-Ransom.Win32.GenericCryptor.czx-308e2d9a98066c0789a73be20246262b10d29d5b0859421ede2274af17a57190
SHA256 308e2d9a98066c0789a73be20246262b10d29d5b0859421ede2274af17a57190
Tags
urelas aspackv2 trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

308e2d9a98066c0789a73be20246262b10d29d5b0859421ede2274af17a57190

Threat Level: Known bad

The file Trojan-Ransom.Win32.GenericCryptor.czx-308e2d9a98066c0789a73be20246262b10d29d5b0859421ede2274af17a57190 was found to be: Known bad.

Malicious Activity Summary

urelas aspackv2 trojan

Urelas

Checks computer location settings

ASPack v2.12-2.42

Deletes itself

Executes dropped EXE

Loads dropped DLL

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-29 05:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-29 05:38

Reported

2024-02-29 05:47

Platform

win7-20240221-en

Max time kernel

200s

Max time network

175s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe"

Signatures

Urelas

trojan urelas

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyfod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\piotw.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2444 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe C:\Users\Admin\AppData\Local\Temp\lyfod.exe
PID 2444 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe C:\Users\Admin\AppData\Local\Temp\lyfod.exe
PID 2444 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe C:\Users\Admin\AppData\Local\Temp\lyfod.exe
PID 2444 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe C:\Users\Admin\AppData\Local\Temp\lyfod.exe
PID 2444 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe C:\Windows\SysWOW64\cmd.exe
PID 2444 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe C:\Windows\SysWOW64\cmd.exe
PID 2444 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe C:\Windows\SysWOW64\cmd.exe
PID 2444 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe C:\Windows\SysWOW64\cmd.exe
PID 2892 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\lyfod.exe C:\Users\Admin\AppData\Local\Temp\piotw.exe
PID 2892 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\lyfod.exe C:\Users\Admin\AppData\Local\Temp\piotw.exe
PID 2892 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\lyfod.exe C:\Users\Admin\AppData\Local\Temp\piotw.exe
PID 2892 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\lyfod.exe C:\Users\Admin\AppData\Local\Temp\piotw.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe"

C:\Users\Admin\AppData\Local\Temp\lyfod.exe

"C:\Users\Admin\AppData\Local\Temp\lyfod.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\piotw.exe

"C:\Users\Admin\AppData\Local\Temp\piotw.exe"

Network

Country Destination Domain Proto
KR 218.54.31.226:11110 tcp
KR 1.234.83.146:11170 tcp
KR 218.54.31.165:11110 tcp
JP 133.242.129.155:11110 tcp

Files

memory/2444-0-0x0000000001010000-0x0000000001092000-memory.dmp

memory/2444-1-0x0000000000140000-0x0000000000141000-memory.dmp

\Users\Admin\AppData\Local\Temp\lyfod.exe

MD5 1b8156b4d4ed55ac8a15b511ad708bb6
SHA1 e7aa4dc84ef417c156726351da8745b2ba8c670c
SHA256 a46ec81202d475eb22614e8623a4f3282f01beace4db9a6d4f95d63719f80d37
SHA512 91d023f06890a9d0cc4d45ebf2184f88ce1eb2fc9215dda59660abf13739d90f203068c3f098e86c24163e1d8290a55121180ae42b58f99743151839f5792bc2

memory/2444-7-0x0000000002870000-0x00000000028F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 c1a0648fe9d4b93ec746a6e41f3f7ca8
SHA1 57e04f2693480be87a11398ca938f8183e62db7c
SHA256 3de16b3be327336ff28d2383af13c7c6f0ae7d3b75884c4dc7a4885f54110e0c
SHA512 3c4320927f9468c11ef7e3641db0af457a344492873d49262b57d1fd4cc47d1c08f02a959a4e2cb93a6e2f447899501f4fb35da53726ded737f22c906fb4878d

memory/2892-17-0x0000000000100000-0x0000000000101000-memory.dmp

memory/2444-19-0x0000000001010000-0x0000000001092000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 c84c819b9a1e342f8fba9dd480a7a154
SHA1 f5e355c1b74dd98eccce1493661b0f8ad8c0a7c7
SHA256 aa97a1d943d5595194092e7f080891f3e9b27c784162f81b3a6de5ef9005dc8d
SHA512 810e245418ac4d25fa78a181c4d6e86f04125b2f91b5568685d5779e15d3d269361232b162a2353498062f9fa47b4be86c8971fceb67678cbaf1ccff1f4e7c53

memory/2892-22-0x0000000000150000-0x00000000001D2000-memory.dmp

\Users\Admin\AppData\Local\Temp\piotw.exe

MD5 890e693cdde54bbd1e26e5addc821ac0
SHA1 2a1711a13c2b24eb40446fe271c6c281d12e5b98
SHA256 31dbdaf305907bb1db8431d4f947e6e28c177f96149b63cdb6b6675da71da4d5
SHA512 85c3090b91442631291f99606089a19f1453fff7b412980215486ebb3fc4a47c4d5fa014fd428ff0067aae3bab20ceb6f9fe37a984c18c085f6baccba545fb49

memory/2096-41-0x00000000003F0000-0x000000000049D000-memory.dmp

memory/2096-42-0x00000000003F0000-0x000000000049D000-memory.dmp

memory/2892-39-0x0000000002FC0000-0x000000000306D000-memory.dmp

memory/2096-38-0x00000000003F0000-0x000000000049D000-memory.dmp

memory/2892-37-0x0000000000150000-0x00000000001D2000-memory.dmp

memory/2096-43-0x00000000003F0000-0x000000000049D000-memory.dmp

memory/2096-45-0x00000000003F0000-0x000000000049D000-memory.dmp

memory/2096-46-0x00000000003F0000-0x000000000049D000-memory.dmp

memory/2096-47-0x00000000003F0000-0x000000000049D000-memory.dmp

memory/2096-48-0x00000000003F0000-0x000000000049D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-29 05:38

Reported

2024-02-29 05:45

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe"

Signatures

Urelas

trojan urelas

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\hekey.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\hekey.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xemed.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe

"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe"

C:\Users\Admin\AppData\Local\Temp\hekey.exe

"C:\Users\Admin\AppData\Local\Temp\hekey.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\xemed.exe

"C:\Users\Admin\AppData\Local\Temp\xemed.exe"

Network

Country Destination Domain Proto
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
KR 218.54.31.226:11110 tcp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
KR 1.234.83.146:11170 tcp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
KR 218.54.31.165:11110 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
JP 133.242.129.155:11110 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/2668-0-0x0000000000140000-0x00000000001C2000-memory.dmp

memory/2668-1-0x00000000009A0000-0x00000000009A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\hekey.exe

MD5 a5c46d21a52c4e0acab53dde87b3c41e
SHA1 84d373d216eac1919a5037e89bf17b1c2eca9784
SHA256 814e69cd594e8d09b6c470ef3bb2a5a202eff7445c4e459b484c2903d453bfb1
SHA512 60d952b735db40371b3c41adf6ff21da7735e348e29fe7b02b0094cf40cc0b3ff75837338f6bfbb009a39c70ecb0b82bd48dbd0b9045cedb1e012898e768b7aa

memory/3608-10-0x0000000000200000-0x0000000000282000-memory.dmp

memory/3608-14-0x0000000001040000-0x0000000001041000-memory.dmp

memory/2668-16-0x0000000000140000-0x00000000001C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 c1a0648fe9d4b93ec746a6e41f3f7ca8
SHA1 57e04f2693480be87a11398ca938f8183e62db7c
SHA256 3de16b3be327336ff28d2383af13c7c6f0ae7d3b75884c4dc7a4885f54110e0c
SHA512 3c4320927f9468c11ef7e3641db0af457a344492873d49262b57d1fd4cc47d1c08f02a959a4e2cb93a6e2f447899501f4fb35da53726ded737f22c906fb4878d

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 cfa173f565973e1e53932ed6fbf85176
SHA1 02b4a70ca089a16df9959c75e355abc7f8d69a41
SHA256 cfdc4de5c83b66e16ca0dd636ab5c97e43e8dad1a7140a7bc30a28736978006c
SHA512 7c4349ff63e2bb245bd71e6af2b8208fb2660fc0187cc4c711e5825ae406892daca9199469ef72f4e395d16969b0a7cf0e56e2b230854b7fd797f98d11fd5548

memory/3608-19-0x0000000000200000-0x0000000000282000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xemed.exe

MD5 2a7d1dd97b22db38d807bb3a62dfa799
SHA1 7406f6f4f5b70614d0ee9ef017b9cdd3e2e1c97a
SHA256 56620cf71d52d8f474e96c1a4618ff85a75074f76b389e427c807cd6fc585cca
SHA512 2b3320596b8e227e1a74bb72fe45cd52efc8b1910de0320e786fd2cddebf67386f136ce1490e5c30255a8208b5d3f363e8b77c734e56cd52626829aa4e2eccf0

memory/3608-38-0x0000000000200000-0x0000000000282000-memory.dmp

memory/3724-37-0x0000000000D70000-0x0000000000E1D000-memory.dmp

memory/3724-40-0x0000000000D70000-0x0000000000E1D000-memory.dmp

memory/3724-39-0x0000000000D70000-0x0000000000E1D000-memory.dmp

memory/3724-41-0x0000000000D70000-0x0000000000E1D000-memory.dmp

memory/3724-43-0x0000000000D70000-0x0000000000E1D000-memory.dmp

memory/3724-44-0x0000000000D70000-0x0000000000E1D000-memory.dmp

memory/3724-45-0x0000000000D70000-0x0000000000E1D000-memory.dmp

memory/3724-46-0x0000000000D70000-0x0000000000E1D000-memory.dmp

memory/3724-47-0x0000000000D70000-0x0000000000E1D000-memory.dmp