Malware Analysis Report

2024-09-11 16:48

Sample ID 240615-l94tqawhpf
Target files.zip
SHA256 12ac029fdde1e9af0c26344857f4da6c2c0851c2d639afced5402858ffa9e23b
Tags
stealc vidar stealer discovery spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

12ac029fdde1e9af0c26344857f4da6c2c0851c2d639afced5402858ffa9e23b

Threat Level: Known bad

The file files.zip was found to be: Known bad.

Malicious Activity Summary

stealc vidar stealer discovery spyware

Stealc

Vidar

Detect Vidar Stealer

Loads dropped DLL

Reads data files stored by FTP clients

Checks computer location settings

Checks installed software on the system

Suspicious use of SetThreadContext

Program crash

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Delays execution with timeout.exe

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-15 10:15

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 10:14

Reported

2024-06-15 10:17

Platform

win7-20240611-en

Max time kernel

115s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1136 set thread context of 1844 N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe C:\Windows\SysWOW64\netsh.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\coml.au3

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1136 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1136 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1136 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1136 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1136 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1844 wrote to memory of 2744 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1844 wrote to memory of 2744 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1844 wrote to memory of 2744 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1844 wrote to memory of 2744 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1844 wrote to memory of 2744 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1844 wrote to memory of 2744 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 2744 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2744 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2744 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2744 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 148

Network

N/A

Files

memory/1136-10-0x000007FEF5818000-0x000007FEF5819000-memory.dmp

memory/1136-11-0x000007FEF5801000-0x000007FEF5819000-memory.dmp

memory/1136-13-0x000007FEF5801000-0x000007FEF5819000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1c9d627f

MD5 df9e1a3e03d0bd7969e92e108983caf9
SHA1 b1f4bec7a5a32e444554bb72ae76b7550a71d271
SHA256 a410684e6534d484241933a14eb90bcae991483adc89321a0e26b93231f88efd
SHA512 e3a9723ff5f5b7c1164b6275e1f12c20fdd18b41692a85e48dc9fbf3e68ca696c522ba88d9aed5cb71231eb7c87fe734ed16f47789d196f036a494bf303f6ea6

memory/1844-15-0x00000000772E0000-0x0000000077489000-memory.dmp

memory/1844-18-0x00000000735EE000-0x00000000735F0000-memory.dmp

memory/1844-19-0x00000000735E0000-0x0000000073754000-memory.dmp

memory/1844-17-0x00000000735E0000-0x0000000073754000-memory.dmp

\Users\Admin\AppData\Local\Temp\coml.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/2744-25-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2744-24-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1844-26-0x00000000735E0000-0x0000000073754000-memory.dmp

memory/2744-28-0x0000000000C60000-0x00000000013AB000-memory.dmp

memory/2744-35-0x0000000000C60000-0x00000000013AB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 10:14

Reported

2024-06-15 10:17

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

54s

Command Line

"C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Reads data files stored by FTP clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1376 set thread context of 1876 N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe C:\Windows\SysWOW64\netsh.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1376 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1376 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1376 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1376 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1876 wrote to memory of 836 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1876 wrote to memory of 836 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1876 wrote to memory of 836 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1876 wrote to memory of 836 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1876 wrote to memory of 836 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 836 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\cmd.exe
PID 836 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\cmd.exe
PID 836 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\cmd.exe
PID 4332 wrote to memory of 1836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4332 wrote to memory of 1836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4332 wrote to memory of 1836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\coml.au3" & rd /s /q "C:\ProgramData\DAFIEHIEGDHI" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country Destination Domain Proto
US 8.8.8.8:53 feeldog.xyz udp

Files

memory/1376-0-0x00007FFB97C60000-0x00007FFB97DD2000-memory.dmp

memory/1376-11-0x00007FFB97C78000-0x00007FFB97C79000-memory.dmp

memory/1376-12-0x00007FFB97C60000-0x00007FFB97DD2000-memory.dmp

memory/1376-13-0x00007FFB97C60000-0x00007FFB97DD2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ae6bf9e7

MD5 69c38961d128cf9b8c90ea90cfe874d0
SHA1 2a1cdfa0143458c9d4723c5dd496620506ac4d18
SHA256 f2f0aca432838cc01c5f2ee85c1f1faa8d9fedd9807a63b549dcbe2f1bbd7976
SHA512 364565b61ad3a12c9e5d30853365f000b37bcad60ec340b9d448be886b3ce78086aa91fa09515e796c783b7beec552edda36d40f9e4f96e1492abcb36cbd7792

memory/1876-16-0x00007FFBB6E90000-0x00007FFBB7085000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\coml.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/836-22-0x0000000000B80000-0x00000000012CB000-memory.dmp

memory/836-24-0x00007FFBB6E90000-0x00007FFBB7085000-memory.dmp

memory/836-25-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/836-37-0x0000000000B80000-0x00000000012CB000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-15 10:14

Reported

2024-06-15 10:17

Platform

win11-20240508-en

Max time kernel

70s

Max time network

80s

Command Line

"C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Reads data files stored by FTP clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1796 set thread context of 1728 N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe C:\Windows\SysWOW64\netsh.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1796 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1796 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1796 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1796 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe C:\Windows\SysWOW64\netsh.exe
PID 1728 wrote to memory of 4964 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1728 wrote to memory of 4964 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1728 wrote to memory of 4964 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1728 wrote to memory of 4964 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 1728 wrote to memory of 4964 N/A C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\coml.au3
PID 4964 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\cmd.exe
PID 4964 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\cmd.exe
PID 4964 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\coml.au3 C:\Windows\SysWOW64\cmd.exe
PID 580 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 580 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 580 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\@!^Installer_PC_Setup_3355__@_______^\Setup.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\SysWOW64\netsh.exe

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Users\Admin\AppData\Local\Temp\coml.au3

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\coml.au3" & rd /s /q "C:\ProgramData\HIEHDHCFIJDB" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country Destination Domain Proto
US 8.8.8.8:53 feeldog.xyz udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 t.me udp
US 8.8.8.8:53 steamcommunity.com udp

Files

memory/1796-0-0x00007FFED9B40000-0x00007FFED9CBA000-memory.dmp

memory/1796-11-0x00007FFED9B58000-0x00007FFED9B59000-memory.dmp

memory/1796-12-0x00007FFED9B40000-0x00007FFED9CBA000-memory.dmp

memory/1796-13-0x00007FFED9B40000-0x00007FFED9CBA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9d7449ae

MD5 2708cb67b99a6b12b853e39e421556bc
SHA1 8a90ad5b905ca79efe43caf61073006ec76e8134
SHA256 08b68b861ba087f1e409a93c4d05bb32de599dccca1d578270d294d384b10772
SHA512 b664a2e8ec7168d94b23d356a18373e819befeabe2a885f47b23d1f2c768c2f955359f7b75d2f3a72aba56be95f62fb8aa71a1fbc77e5626abbb8b54e90a6aa5

memory/1728-16-0x00007FFEFB1C0000-0x00007FFEFB3C9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\coml.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/4964-22-0x00007FFEFB1C0000-0x00007FFEFB3C9000-memory.dmp

memory/4964-23-0x0000000000DA0000-0x00000000014EB000-memory.dmp

memory/4964-24-0x0000000000DA0000-0x00000000014EB000-memory.dmp

memory/4964-25-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/4964-37-0x0000000000DA0000-0x00000000014EB000-memory.dmp

memory/4964-38-0x0000000000DA0000-0x00000000014EB000-memory.dmp