Malware Analysis Report

2024-09-11 16:44

Sample ID 240614-wg7p1svbjq
Target #Active_Setup_2233_P@ssWord#.zip
SHA256 c8d9edbb928cd7fe9d1ed38aed464b39195cfcd687d4d87164edbd465c8ffd46
Tags
stealc vidar stealer discovery spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c8d9edbb928cd7fe9d1ed38aed464b39195cfcd687d4d87164edbd465c8ffd46

Threat Level: Known bad

The file #Active_Setup_2233_P@ssWord#.zip was found to be: Known bad.

Malicious Activity Summary

stealc vidar stealer discovery spyware

Vidar

Detect Vidar Stealer

Stealc

Loads dropped DLL

Reads data files stored by FTP clients

Checks computer location settings

Checks installed software on the system

Suspicious use of SetThreadContext

Enumerates physical storage devices

Program crash

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Suspicious behavior: MapViewOfSection

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-14 17:54

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 17:54

Reported

2024-06-14 17:57

Platform

win7-20240220-en

Max time kernel

112s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2064 set thread context of 1756 N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe C:\Windows\SysWOW64\netsh.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\coml.au3

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2064 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 2064 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 2064 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 2064 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 2064 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1756 wrote to memory of 2688 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1756 wrote to memory of 2688 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1756 wrote to memory of 2688 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1756 wrote to memory of 2688 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1756 wrote to memory of 2688 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1756 wrote to memory of 2688 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2688 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2688 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2688 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2688 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 148

Network

N/A

Files

memory/2064-10-0x000007FEF5878000-0x000007FEF5879000-memory.dmp

memory/2064-11-0x000007FEF5861000-0x000007FEF5879000-memory.dmp

memory/2064-13-0x000007FEF5861000-0x000007FEF5879000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b088c854

MD5 a04c731a889e4f8eda78a8165f564f8c
SHA1 8ee01b9ec1f82185d223d91a75fd92d3f35a889a
SHA256 f696bb94a03f716a577508ea1d5e7fff3b77b03fbb1e12107a618d12d9000f01
SHA512 c304d170e0f040369ed04dd1b1b997e788fc2964ad80ea78f95a7fac40418969668beefe0299857c974f9871a9f510d8ae7bdff14563427b3bca2de7d771d982

memory/1756-15-0x0000000077360000-0x0000000077509000-memory.dmp

memory/1756-18-0x000000007366E000-0x0000000073670000-memory.dmp

memory/1756-17-0x0000000073660000-0x00000000737D4000-memory.dmp

\Users\Admin\AppData\Local\Temp\coml.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/1756-22-0x0000000073660000-0x00000000737D4000-memory.dmp

memory/2688-25-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2688-24-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1756-26-0x0000000073660000-0x00000000737D4000-memory.dmp

memory/2688-28-0x00000000006F0000-0x0000000000E3B000-memory.dmp

memory/2688-35-0x00000000006F0000-0x0000000000E3B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 17:54

Reported

2024-06-14 17:57

Platform

win10v2004-20240508-en

Max time kernel

114s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Reads data files stored by FTP clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2680 set thread context of 3528 N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe C:\Windows\SysWOW64\netsh.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2680 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 2680 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 2680 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 2680 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 3528 wrote to memory of 4684 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 3528 wrote to memory of 4684 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 3528 wrote to memory of 4684 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 3528 wrote to memory of 4684 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 3528 wrote to memory of 4684 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4684 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\cmd.exe
PID 4684 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\cmd.exe
PID 4684 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\cmd.exe
PID 2036 wrote to memory of 2968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2036 wrote to memory of 2968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2036 wrote to memory of 2968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4024,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\coml.au3" & rd /s /q "C:\ProgramData\EBAKKFHJDBKK" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 feeldog.xyz udp

Files

memory/2680-0-0x00007FF990880000-0x00007FF9909F2000-memory.dmp

memory/2680-11-0x00007FF990898000-0x00007FF990899000-memory.dmp

memory/2680-12-0x00007FF990880000-0x00007FF9909F2000-memory.dmp

memory/2680-13-0x00007FF990880000-0x00007FF9909F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\97d06774

MD5 e71241365f74b3d58080af2b1b9ad074
SHA1 fa43b37fdea44c75fb454254e935af0451c3f133
SHA256 761ce50b4c422554aed6bca115484b707376db9f0c5bf1260580043d22e7f346
SHA512 221abe77aaae729ad7d421a6c2951d08cc765af0583ef94be54b0c5e5f0887aa90159abfedf207f7443fdb90ef82b5e8864c8193b25cb64307d3360e51d4d90b

memory/3528-16-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\coml.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/4684-22-0x0000000001660000-0x0000000001DAB000-memory.dmp

memory/4684-24-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

memory/4684-25-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/4684-37-0x0000000001660000-0x0000000001DAB000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-14 17:54

Reported

2024-06-14 17:57

Platform

win11-20240508-en

Max time kernel

64s

Max time network

76s

Command Line

"C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Reads data files stored by FTP clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2052 set thread context of 4008 N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe C:\Windows\SysWOW64\netsh.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2052 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 2052 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 2052 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 2052 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 4008 wrote to memory of 5116 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4008 wrote to memory of 5116 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4008 wrote to memory of 5116 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4008 wrote to memory of 5116 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4008 wrote to memory of 5116 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 5116 wrote to memory of 4420 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\cmd.exe
PID 5116 wrote to memory of 4420 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\cmd.exe
PID 5116 wrote to memory of 4420 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\cmd.exe
PID 4420 wrote to memory of 1356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4420 wrote to memory of 1356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4420 wrote to memory of 1356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\#Active_Setup_2233_P@ssWord#\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\coml.au3" & rd /s /q "C:\ProgramData\CBFCBKKFBAEH" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country Destination Domain Proto
US 8.8.8.8:53 feeldog.xyz udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 t.me udp
US 8.8.8.8:53 steamcommunity.com udp

Files

memory/2052-0-0x00007FF836420000-0x00007FF83659A000-memory.dmp

memory/2052-11-0x00007FF836438000-0x00007FF836439000-memory.dmp

memory/2052-12-0x00007FF836420000-0x00007FF83659A000-memory.dmp

memory/2052-13-0x00007FF836420000-0x00007FF83659A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\d5272a2a

MD5 eefaffd9f8a2c831af48786ea17957df
SHA1 3bbf8f21f939a2e883232cd99a7721d267e37a06
SHA256 ed0f931c5d002aee80499ef286dc9fd8eed781f7e0595a313798ed07ac652bac
SHA512 b098a41c67bfacb8de1ad8d04e520a7a23891d42fcdfc74b38e199c64741b2b248a4a50d9d02f512131868d7b61c36f7eae2aa6cd2987b31d7cb4097f4bd5a09

memory/4008-16-0x00007FF84A4C0000-0x00007FF84A6C9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\coml.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/5116-22-0x0000000001430000-0x0000000001B7B000-memory.dmp

memory/5116-24-0x00007FF84A4C0000-0x00007FF84A6C9000-memory.dmp

memory/5116-25-0x0000000001430000-0x0000000001B7B000-memory.dmp

memory/5116-26-0x0000000001430000-0x0000000001B7B000-memory.dmp

memory/5116-28-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/5116-40-0x0000000001430000-0x0000000001B7B000-memory.dmp