fc5035171eb4766ec37318e345b42bad42bfabcc5a52520f361f9e9308bc6cd2

Resubmissions

28/06/2026, 15:38

260628-s3bypahz5v10

28/06/2026, 15:11

260628-skl1yahy2110

Analysis

max time kernel
299s
max time network
304s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SteamX.exe
Size 47.8MB
Sample260628-skl1yahy21
SHA256 fc5035171eb4766ec37318e345b42bad42bfabcc5a52520f361f9e9308bc6cd2
MD5 5ab7885904f130f2414ce291e0234b6f
SHA1 cb073f6d83b711e19fc46693e1a31a298db69dad
SHA512 73dd611d94954c4b5adc8faaeb2eaa61ec887b45c11ff1ecf2ca1baf4fd20fe629a9493a7705d56ab3e12c9cdc0132c9df247257b371963534ac90266f097fa0
SSDEEP 786432:Mh8Th9ZJzbhhnYqWFeJ4SpKqrMFTWObiyM8vFuhnWYttMFo03awG40tY:e8TTZd/hvJ4SpfrMlLjM8v4WYtSFo0JJ
TLSH
T1CDB733A9F182496DEEA25539A922C0737E7B3C4973D9E5DB1AC50B0CEE271D34C7C608
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution impact persistence privilege_escalation pyinstaller ransomware trojan upx

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2760	powershell.exe
3896	powershell.exe
6064	powershell.exe
2404	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
2404	powershell.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3832	netsh.exe
4320	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
692	bound.exe
2224	bound.exe
1964	BloodSc.exe
4576	BloodSc.exe

Loads dropped DLL 64 IoCs

pid	Process
1932	SteamX.exe
1932	SteamX.exe
1932	SteamX.exe
1932	SteamX.exe
1932	SteamX.exe
1932	SteamX.exe
1932	SteamX.exe
1932	SteamX.exe
1932	SteamX.exe
1932	SteamX.exe
1932	SteamX.exe
1932	SteamX.exe
1932	SteamX.exe
1932	SteamX.exe
1932	SteamX.exe
1932	SteamX.exe
1932	SteamX.exe
1932	SteamX.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
2224	bound.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe
4576	BloodSc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BloodSc = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\BloodSc.exe"	bound.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4956	tasklist.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000024408-35.dat	upx
behavioral1/memory/1932-39-0x00007FFFE15F0000-0x00007FFFE1CB2000-memory.dmp	upx
behavioral1/files/0x00070000000243f5-42.dat	upx
behavioral1/files/0x0007000000024405-43.dat	upx
behavioral1/files/0x00070000000243ff-69.dat	upx
behavioral1/files/0x00070000000243fe-68.dat	upx
behavioral1/files/0x00070000000243fd-67.dat	upx
behavioral1/files/0x00070000000243fc-66.dat	upx
behavioral1/files/0x00070000000243fb-65.dat	upx
behavioral1/files/0x00070000000243fa-64.dat	upx
behavioral1/memory/1932-73-0x00007FFFEED10000-0x00007FFFEED3C000-memory.dmp	upx
behavioral1/memory/1932-76-0x00007FFFEF0A0000-0x00007FFFEF0AD000-memory.dmp	upx
behavioral1/memory/1932-78-0x00007FFFEF090000-0x00007FFFEF09F000-memory.dmp	upx
behavioral1/memory/1932-72-0x00007FFFEF0B0000-0x00007FFFEF0C9000-memory.dmp	upx
behavioral1/files/0x00070000000243f8-71.dat	upx
behavioral1/files/0x00070000000243f4-70.dat	upx
behavioral1/files/0x00070000000243f9-63.dat	upx
behavioral1/files/0x00070000000243f7-61.dat	upx
behavioral1/files/0x00070000000243f6-60.dat	upx
behavioral1/files/0x00070000000243f3-58.dat	upx
behavioral1/files/0x000700000002441c-56.dat	upx
behavioral1/files/0x000700000002441a-55.dat	upx
behavioral1/files/0x000700000002440b-54.dat	upx
behavioral1/files/0x0007000000024407-51.dat	upx
behavioral1/files/0x0007000000024406-50.dat	upx
behavioral1/files/0x0007000000024404-49.dat	upx
behavioral1/memory/1932-46-0x00007FFFF7410000-0x00007FFFF741F000-memory.dmp	upx
behavioral1/memory/1932-45-0x00007FFFEFD60000-0x00007FFFEFD85000-memory.dmp	upx
behavioral1/memory/1932-80-0x00007FFFEECE0000-0x00007FFFEECF4000-memory.dmp	upx
behavioral1/memory/1932-82-0x00007FFFE15F0000-0x00007FFFE1CB2000-memory.dmp	upx
behavioral1/memory/1932-83-0x00007FFFE09D0000-0x00007FFFE0F03000-memory.dmp	upx
behavioral1/memory/1932-92-0x00007FFFE0830000-0x00007FFFE08FE000-memory.dmp	upx
behavioral1/memory/1932-91-0x00007FFFE1EB0000-0x00007FFFE1EE3000-memory.dmp	upx
behavioral1/memory/1932-89-0x00007FFFEFD60000-0x00007FFFEFD85000-memory.dmp	upx
behavioral1/memory/1932-87-0x00007FFFEECC0000-0x00007FFFEECCD000-memory.dmp	upx
behavioral1/memory/1932-85-0x00007FFFE22A0000-0x00007FFFE22B9000-memory.dmp	upx
behavioral1/memory/1932-99-0x00007FFFEF140000-0x00007FFFEF164000-memory.dmp	upx
behavioral1/memory/1932-102-0x00007FFFE1470000-0x00007FFFE15EF000-memory.dmp	upx
behavioral1/memory/1932-101-0x00007FFFEF090000-0x00007FFFEF09F000-memory.dmp	upx
behavioral1/memory/2760-105-0x0000014D4E020000-0x0000014D4E030000-memory.dmp	upx
behavioral1/memory/1932-104-0x00007FFFE09D0000-0x00007FFFE0F03000-memory.dmp	upx
behavioral1/memory/1932-103-0x00007FFFEECE0000-0x00007FFFEECF4000-memory.dmp	upx
behavioral1/memory/1932-124-0x00007FFFDBAF0000-0x00007FFFDBC0A000-memory.dmp	upx
behavioral1/memory/1932-411-0x00007FFFEF0A0000-0x00007FFFEF0AD000-memory.dmp	upx
behavioral1/memory/1932-425-0x00007FFFE1EB0000-0x00007FFFE1EE3000-memory.dmp	upx
behavioral1/memory/1932-424-0x00007FFFEECC0000-0x00007FFFEECCD000-memory.dmp	upx
behavioral1/memory/1932-423-0x00007FFFE22A0000-0x00007FFFE22B9000-memory.dmp	upx
behavioral1/memory/1932-422-0x00007FFFE0830000-0x00007FFFE08FE000-memory.dmp	upx
behavioral1/memory/1932-421-0x00007FFFEECE0000-0x00007FFFEECF4000-memory.dmp	upx
behavioral1/memory/1932-420-0x00007FFFE15F0000-0x00007FFFE1CB2000-memory.dmp	upx
behavioral1/memory/1932-410-0x00007FFFEED10000-0x00007FFFEED3C000-memory.dmp	upx
behavioral1/memory/1932-409-0x00007FFFEF0B0000-0x00007FFFEF0C9000-memory.dmp	upx
behavioral1/memory/1932-408-0x00007FFFEF090000-0x00007FFFEF09F000-memory.dmp	upx
behavioral1/memory/1932-407-0x00007FFFEFD60000-0x00007FFFEFD85000-memory.dmp	upx
behavioral1/memory/1932-406-0x00007FFFF7410000-0x00007FFFF741F000-memory.dmp	upx
behavioral1/memory/1932-403-0x00007FFFDBAF0000-0x00007FFFDBC0A000-memory.dmp	upx
behavioral1/memory/1932-401-0x00007FFFE1470000-0x00007FFFE15EF000-memory.dmp	upx
behavioral1/memory/1932-400-0x00007FFFEF140000-0x00007FFFEF164000-memory.dmp	upx
behavioral1/memory/1932-394-0x00007FFFE09D0000-0x00007FFFE0F03000-memory.dmp	upx

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000300000001e6a4-130.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Interacts with shadow copies 3 TTPs 4 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4784	vssadmin.exe
4768	vssadmin.exe
5276	vssadmin.exe
1472	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2760	powershell.exe
2404	powershell.exe
2404	powershell.exe
2760	powershell.exe
3896	powershell.exe
3896	powershell.exe
3896	powershell.exe
6064	powershell.exe
6064	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeIncreaseQuotaPrivilege	1624	WMIC.exe
Token: SeSecurityPrivilege	1624	WMIC.exe
Token: SeTakeOwnershipPrivilege	1624	WMIC.exe
Token: SeLoadDriverPrivilege	1624	WMIC.exe
Token: SeSystemProfilePrivilege	1624	WMIC.exe
Token: SeSystemtimePrivilege	1624	WMIC.exe
Token: SeProfSingleProcessPrivilege	1624	WMIC.exe
Token: SeIncBasePriorityPrivilege	1624	WMIC.exe
Token: SeCreatePagefilePrivilege	1624	WMIC.exe
Token: SeBackupPrivilege	1624	WMIC.exe
Token: SeRestorePrivilege	1624	WMIC.exe
Token: SeShutdownPrivilege	1624	WMIC.exe
Token: SeDebugPrivilege	1624	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1624	WMIC.exe
Token: SeRemoteShutdownPrivilege	1624	WMIC.exe
Token: SeUndockPrivilege	1624	WMIC.exe
Token: SeManageVolumePrivilege	1624	WMIC.exe
Token: 33	1624	WMIC.exe
Token: 34	1624	WMIC.exe
Token: 35	1624	WMIC.exe
Token: 36	1624	WMIC.exe
Token: SeDebugPrivilege	4956	tasklist.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeIncreaseQuotaPrivilege	1624	WMIC.exe
Token: SeSecurityPrivilege	1624	WMIC.exe
Token: SeTakeOwnershipPrivilege	1624	WMIC.exe
Token: SeLoadDriverPrivilege	1624	WMIC.exe
Token: SeSystemProfilePrivilege	1624	WMIC.exe
Token: SeSystemtimePrivilege	1624	WMIC.exe
Token: SeProfSingleProcessPrivilege	1624	WMIC.exe
Token: SeIncBasePriorityPrivilege	1624	WMIC.exe
Token: SeCreatePagefilePrivilege	1624	WMIC.exe
Token: SeBackupPrivilege	1624	WMIC.exe
Token: SeRestorePrivilege	1624	WMIC.exe
Token: SeShutdownPrivilege	1624	WMIC.exe
Token: SeDebugPrivilege	1624	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1624	WMIC.exe
Token: SeRemoteShutdownPrivilege	1624	WMIC.exe
Token: SeUndockPrivilege	1624	WMIC.exe
Token: SeManageVolumePrivilege	1624	WMIC.exe
Token: 33	1624	WMIC.exe
Token: 34	1624	WMIC.exe
Token: 35	1624	WMIC.exe
Token: 36	1624	WMIC.exe
Token: SeBackupPrivilege	3856	vssvc.exe
Token: SeRestorePrivilege	3856	vssvc.exe
Token: SeAuditPrivilege	3856	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5168	WMIC.exe
Token: SeSecurityPrivilege	5168	WMIC.exe
Token: SeTakeOwnershipPrivilege	5168	WMIC.exe
Token: SeLoadDriverPrivilege	5168	WMIC.exe
Token: SeSystemProfilePrivilege	5168	WMIC.exe
Token: SeSystemtimePrivilege	5168	WMIC.exe
Token: SeProfSingleProcessPrivilege	5168	WMIC.exe
Token: SeIncBasePriorityPrivilege	5168	WMIC.exe
Token: SeCreatePagefilePrivilege	5168	WMIC.exe
Token: SeBackupPrivilege	5168	WMIC.exe
Token: SeRestorePrivilege	5168	WMIC.exe
Token: SeShutdownPrivilege	5168	WMIC.exe
Token: SeDebugPrivilege	5168	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5168	WMIC.exe
Token: SeRemoteShutdownPrivilege	5168	WMIC.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1932	1508	SteamX.exe	87
PID 1932 wrote to memory of 1356	1932	SteamX.exe	89
PID 1932 wrote to memory of 3636	1932	SteamX.exe	90
PID 3636 wrote to memory of 2404	3636	cmd.exe	93
PID 1356 wrote to memory of 2760	1356	cmd.exe	94
PID 1932 wrote to memory of 4664	1932	SteamX.exe	95
PID 1932 wrote to memory of 2384	1932	SteamX.exe	96
PID 1932 wrote to memory of 4064	1932	SteamX.exe	99
PID 1932 wrote to memory of 4976	1932	SteamX.exe	101
PID 4064 wrote to memory of 4956	4064	cmd.exe	105
PID 4976 wrote to memory of 1624	4976	cmd.exe	106
PID 4664 wrote to memory of 3896	4664	cmd.exe	107
PID 2384 wrote to memory of 692	2384	cmd.exe	108
PID 692 wrote to memory of 2224	692	bound.exe	110
PID 2224 wrote to memory of 208	2224	bound.exe	112
PID 208 wrote to memory of 1472	208	cmd.exe	115
PID 2224 wrote to memory of 900	2224	bound.exe	119
PID 900 wrote to memory of 3832	900	cmd.exe	121
PID 2224 wrote to memory of 3880	2224	bound.exe	122
PID 3880 wrote to memory of 3468	3880	cmd.exe	124
PID 2224 wrote to memory of 4352	2224	bound.exe	125
PID 4352 wrote to memory of 2416	4352	cmd.exe	127
PID 1964 wrote to memory of 4576	1964	BloodSc.exe	130
PID 4576 wrote to memory of 6140	4576	BloodSc.exe	131
PID 6140 wrote to memory of 4784	6140	cmd.exe	133
PID 4576 wrote to memory of 2024	4576	BloodSc.exe	135
PID 2024 wrote to memory of 4320	2024	cmd.exe	137
PID 4576 wrote to memory of 628	4576	BloodSc.exe	138
PID 628 wrote to memory of 4184	628	cmd.exe	140
PID 4576 wrote to memory of 412	4576	BloodSc.exe	141
PID 412 wrote to memory of 4148	412	cmd.exe	143
PID 2224 wrote to memory of 4996	2224	bound.exe	147
PID 4996 wrote to memory of 4768	4996	cmd.exe	149
PID 2224 wrote to memory of 5352	2224	bound.exe	150
PID 5352 wrote to memory of 5276	5352	cmd.exe	152
PID 2224 wrote to memory of 5264	2224	bound.exe	153
PID 5264 wrote to memory of 5168	5264	cmd.exe	155
PID 2224 wrote to memory of 5392	2224	bound.exe	157
PID 5392 wrote to memory of 6064	5392	cmd.exe	159

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\SteamX.exe
"C:\Users\Admin\AppData\Local\Temp\SteamX.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Temp\SteamX.exe
  "C:\Users\Admin\AppData\Local\Temp\SteamX.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SteamX.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SteamX.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:692
    - - C:\Users\Admin\AppData\Local\Temp\bound.exe
        
        bound.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2224
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        7⤵
        Interacts with shadow copies
        
        PID:1472
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:900
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set allprofiles state off
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3832
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        7⤵
        Modifies Windows Defender DisableAntiSpyware settings
        
        PID:3468
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:2416
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        7⤵
        Interacts with shadow copies
        
        PID:4768
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin resize shadowstorage /for=C: /on=C: /maxsize=100MB"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5352
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=C: /on=C: /maxsize=100MB
        7⤵
        Interacts with shadow copies
        
        PID:5276
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic shadowcopy delete"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5264
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5168
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WmiObject Win32_ShadowCopy | Remove-WmiObject""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Get-WmiObject Win32_ShadowCopy | Remove-WmiObject"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4064
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1624

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3856

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\BloodSc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\BloodSc.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\BloodSc.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\BloodSc.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6140
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:4784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh advfirewall set allprofiles state off"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 fafde5bec1db5e838e0a43603714686f9911b7aaa8d8ff0fe40f9496a7b38747
MD5 2524e72b0573fa94e9cb8089728a4b47
SHA1 3d5c4dfd6e7632153e687ee866f8ecc70730a0f1
SHA512 99a7593a82353f792a58ea99196330aaa8c34ac2f616f0be4b4ca4f76388485866ba96dc62d9b8e7627c1df6a1f74111342307ba82400adce5adac68b47a6fa8
TLSH
T1BC112223F38C89A1CC961639509DAC5172B686CB81AFDEDF7FC0C210E1AF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 85f6b0971e94daf9fd4e39413824f162851a9f5ce7f989bd92c903a4dbcbef26
MD5 029fbf628b046653ab7ff10b31deeeb2
SHA1 93c2cb1905c8f5e71f5ea97a1e8a8c891eae077c
SHA512 d4e3626dba2572bd1e53446b384962f955cc0c7e56a72cacf50a845d74714ec1020bcb0fdcc50636a1dfd4f08dc34143dbb5638dd90180df6aa31dab9228c98c
TLSH
T192112227F38C8920CC96163A509DAC5172B586DB81AEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\_asyncio.pyd
Size 40KB
SHA256 f95d04e9625473d9bfb84a851c19fc10dac23b1f804889cafd749a966c6b214d
MD5 3ad53f5579918b216c12c064430583c4
SHA1 b06f9baef6e83c9b4e417ac7148818e60ea86458
SHA512 875a9a25c8b293b2bd9a2e616b27de17380e568601e1032ae2271c958f3d367bdd3605f9d3a50c43c65404a77b9129ca3245b345d61bbc36c0dd0d1a1937847a
SSDEEP 768:v0GWI/OAwbExs/sye85FagqpPKpjpoJMdpeTzIBOnNAQ+Eyobo+Y7N2Ip4iETxfC:eIvYws/sye85IdPIjua+zIBOnNB7yo4z
TLSH
T18D03CFCB9278815EEEA6ADB162E0D953FE38BBE314504B5B70C592961D273C0E316339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\_bz2.pyd
Size 50KB
SHA256 631986727d23bff71bb824a06ce21d4485dc4a82a283a99fbf457483be59c3f7
MD5 698c1303e7ba75129b7031a427ea4587
SHA1 850317d1b3977ffc4e4577b5cf810786b70db768
SHA512 da33b3304d487b269fe3e22c6b6f437b937fad4f6a25ad0ff12d49842e15c564af6d1f343523998bbf7ba6ec3a72ef5083ff256a8050212b87ad43b3c0742c7b
SSDEEP 1536:wzTAsFl1R2u75vp+qUe31w2EIBCV9U7yo47Q9mfIgH6D:wztl1R2uD6e31+IBCV9U/Yy
TLSH
T1F233CFC646788153EA96EE71A2E4D943BA3977F39024876F30D662560C637D0E3062BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\_ctypes.pyd
Size 61KB
SHA256 5980fa126c22d76ebfb5ac3186445121c994325b85d31d3f4b7cfc76fc0dc616
MD5 ab71cf8d96142ed8b2ae8c4caea20f20
SHA1 0ad1dc04a895f45e71a5a5dc9b4a9487d4e9e4c7
SHA512 683b2a328463714acf259d252714deebb7c7b0ec46a6b2a3f20781001f9e96f787218d24bce05e8207974b4de2393da6fe3ef0fb9168f91b83b241dc07840895
SSDEEP 1536:DGpsm1Gm1Iunq3rghh1jKVm4MRQ7eIBLPtN7yo47Q9ZfIZRG7g:DGpsm1D030hh1qmNQ6IBLPtNKZ+g
TLSH
T17153E1E285BC5857EEA35E7042D1DD57BC38A3C35960836E38AA919A4E5B3C0E31432E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\_decimal.pyd
Size 109KB
SHA256 c66db0368b98bc2332c5cc8dd9aa7bb8150a4c1162c064a873f007182488f968
MD5 53c439f442b08955ba160f89f384b295
SHA1 7d27b16efd2e0114061c544f07bcecd94bcf9651
SHA512 b19e5eba558f90676186dca7b6e2e5f6c83afee466c00bdfc8141c3ed61b56c768c42a28b3febca588ed5eec2a73a0c4d2e6bfa263b7a9d7c5b85212cac0dfbb
SSDEEP 3072:jZB5i33g5s3UUV35ohSn54MJfovRQyKjaIBOqL7cHY/:FBcnjUUV3xn54CovaP7c4/
TLSH
T15EB3F1EA92B6C556E672D973C2D4E9C1F93CBFA31400CB29749E01251A877D0E36237B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\_hashlib.pyd
Size 36KB
SHA256 361c9596f2788f35dd6e9614fa0dfdb0565c719ae9a85073110eb3b970923339
MD5 f589f4dedfb54a8a424c7d67a870f343
SHA1 b0269e30456b499157d021576fc84ba390e7a95f
SHA512 5e168c9e074ac6603a0b8612f910e76c7485331749163f7c7e0c990059261ae347a4d09176115361acb6f45640f66cae98925a0af21eba9f208f4a2d71d718b1
SSDEEP 768:PbKdUeBIro4sHLq6C3R/op1TfIBOIgwQ+Eyobo+Y7N2Ip4MCxf1ml0ZMya:PG9WsHLHC3RmTfIBOIgR7yo47Q9VfIbN
TLSH
T14F03BFC74674D106EA63E67252D1EE92F934BBD318248B2F70D852964EA33D0F319379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\_lzma.pyd
Size 88KB
SHA256 d0b282abc78f98ae33e756c44d9981cffd246d318ae325cdcc135b70d11d82fc
MD5 ff9d95babaf25f2b585a53c09d80be75
SHA1 e911e1ec5957e3c9d112a845e70e02dea8cdb7d1
SHA512 14cc5964a0674af705bc347b287ad2a26165bb971e9a99652870db51b0042f564605fe559f5af276dc02a55a0b93a57f5f634e91a91e4b2da91cb81b9aefa1b2
SSDEEP 1536:fB8WbMZcJfOC2nKdLtBF6lT43WtFSf6gphAVM7uqGKsx3L3IBZ1mY7yo47Q9kfID:OwMZUfOKdLjFnQFmf4MxGvzIBZ1mY1Yi
TLSH
T11693F18585BEA1A7FA97AEF41390EE83F43877D32510876B34E7651908533C6C31E26E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\_multiprocessing.pyd
Size 29KB
SHA256 b54822c8a3e369b53e5d44167da567a01003382b1efb0fda1b8dafab1c71024b
MD5 8d65778560646af2c8adf61cc0acba72
SHA1 2a2e2902d8fd29929c3a2a9fcf9c13e88a731436
SHA512 42abe52ba8ecd9bf0a9d692377fa2ed9401644487409ede34a38a97258b4a78b9810e024bea3b20132948222571dea4eb5a4389bc3c588b12b66e289f5b62b78
SSDEEP 768:6bFFaEpUbFIBWtwEQ+Eyobo+Y7N2Ip4u+Txf1ml/6dHQDZj:SDa3bFIBWtwt7yo47Q9NfIgHct
TLSH
T1F9D28DD781388166FAA7AEF042E0DD82FD38B7D35410866F30E9A19A1E533C1E316379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\_overlapped.pyd
Size 35KB
SHA256 989bb2249abc8b17356a1557c6993d9bfcce89cc9f0a497901a0ef0d8278849b
MD5 a04ae364d4152686236bf1d2ec12dbe8
SHA1 3b69472382c46e0f783997c862753e29311bbf59
SHA512 4202a439b6ae9a1314276ecf383674393236fe12f0d1957d0085f347d112d52dca7632e8e485b3c6acf8414c6b8aabefdf67804a0cef9b6529f6de6770ca321f
SSDEEP 768:mDaQS3Pr2gV++dOe7n5p3jsIBXtwVQ+Eyobo+Y7N2Ip4ITxf1mltPRV/g2:m+QSD2gtRzjsIBXtwm7yo47Q90fIZRF/
TLSH
T186F2AFC78B7D804AEF63ADB082E0E941FA3877E344518B6B70E953A51D573C0A31636E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\_queue.pyd
Size 27KB
SHA256 3c221f4b456833ecd6f11e77ae9b05da5a38ce0114a5c24071002b1ad502c266
MD5 029579b124b4abb292a79f63d4c6c04e
SHA1 75a19f6cd8f0645a7161efb5db9471ae1c7d72db
SHA512 72bc000e9d7ef2c366f04b1b38266c884a8c08a101f468b49617ebaad1009a522ba7b4fa0eae186eedc12e1962db3c5637b1f7efac04ad4c2f4629e1f12d363b
SSDEEP 768:M7dttUBpJfIBQUgOQ+Eyobo+Y7N2Ip4reCxf1mljr8VMA:ydGfIBQUg/7yo47Q9/fI38VMA
TLSH
T1C3C29FCB4578915AE953EDB042E1DAD2F93C7BE35414875F70CAA29A0E533D0E30632E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\_socket.pyd
Size 46KB
SHA256 21768a2e7d7197dea93e84dd3ae1a9e2a411bbc966a8743b03bb50016790db99
MD5 dc054de6ea9a3b995af65df9f65e0456
SHA1 326ede4b154185518e9cbf816bf05ff6bc82bac6
SHA512 8412125a609a216ca94fff7e142d4bc1362c1da9989259dfa7262393b737f25a668d5fb749e424c1f91509194879e4c73b97ead5765d735176e3203a5a35abf5
SSDEEP 768:rNDTv9rez/QuT6QgD2liklWC8aeRceeurAYpNs2hLpNjMIBLwNBNQ+Eyobo+Y7Nh:rhv9rerTPgK0IWCt6lJXJjMIBLwNBu7y
TLSH
T1DF23C0C94DB8C042DE539EB152E9D992BB3CBBE35955871B30DAB35A0E5B3C0F315228
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\_sqlite3.pyd
Size 59KB
SHA256 087d8ffe952beece1b8f443d1ab99930a335af38eacc6810cccf8ad9241b9362
MD5 dd5f059bff900cdce9b595ccce7d1151
SHA1 89612aa889a1eb5e508c893b59c40ed944e843b9
SHA512 1489504cdb20fe54257455d4fce4542a04e0d1df747d71763b8504e87033e23efff77dd58abb58f33888f826ce18e6817fe183a7b959ae241b39767a31d4424c
SSDEEP 1536:ydnfsB0vq/fNtJCHWf7IBOQdY7yo47Q9ffIZRUz:ydfsB8qdrsEIBOQdYwZC
TLSH
T13053D0CB567C816ADE92AD70A1E1D4C2FC342BC7A4158B2B305D53EA0E173F5E75D228
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\_ssl.pyd
Size 66KB
SHA256 c91d6fa8b91b15b6460b2f6050ee963ad78b959fd19b3ce9fd7c103b64b881f4
MD5 9d03d71357ec0b041b8152c75177f0ca
SHA1 7c952de84739917085c9d4bcaac433f960b9f959
SHA512 d947dfcf56dc872a92dfd4679318c4569f20f7fced2878e0c50c28ae56054d97f5abd313b5c580e9618913a61a0b8ee3dac7f637f038dd9e79396feed2229ebe
SSDEEP 1536:AWwqFNhPURlsX+2UiRhT2bmAN1lpZ5rtIBC7mD1j7yo47Q9BfIiTX:AWwqpsRWXrHRt2FN1nrRIBC7mRiuX
TLSH
T17C63E0DB0178C517DD83EAB110E4CD83F83667936D49C6AFA4AD11AE0E633D0E369279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\_wmi.pyd
Size 29KB
SHA256 8b1b6d3ecdcc31a85789aacea9d50c069509dfbd555f46afdf935c49e1f6a9ac
MD5 c7805f676be59982740fb558cecf712a
SHA1 bf8c7de369c414c5ab391abbaa586bc24f24bfb5
SHA512 39d1ee8c58fff55f5649607f0535d49069dcc54c804ad6628fd2e5f5bdd6efeb9ee1f2e1655ca049893fb3e2991c6bd5cf35e1f28ce9f3adf732ea28981a7b04
SSDEEP 768:/Z/k0lQZ5vcUHIUopl7IIBCiAqQ+Eyobo+Y7N2Ip4YMLCxf1ml0ZMZ:/Z/4FG7IIBCiAT7yo47Q9YjfIbZ
TLSH
T179D2AFCB86B89156EE53E97263D6DD82F8347BE39414875F30D952560E673C0B30632E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\base_library.zip
Size 1.3MB
SHA256 408d3b129ff59998bbfaa10be4ce3de15af3d31c5582666061b3c6e18a685d67
MD5 b214b0fe44b0f5b477504643a6e1c6db
SHA1 38abba7399d28c221aeb18ec2935a34c23ca7ccb
SHA512 ecd9f46dc296806b1903f397717df950097935148a02fc60d43e6a81c17782ef9c9e3cc61d9abc5540aafecc921cb381df48f4fca44b7c9bfed7c2108e448f63
SSDEEP 12288:C8lJGUmaRrmn9GNs2t/nVTVihlyixmpvQXMHYf/RtLR9HbP1dm02/H551N:C8lJGUp69J2Jhq3DbP1dm02/HJN
TLSH
T1ED55D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\blank.aes
Size 90KB
SHA256 41f6eb5a50d0b4c75e3cc19313eaab14a35b9489e983d768375b84b0dd75493e
MD5 e43c782e70318dc67c0331ce82fa1932
SHA1 c8126ac80f4132eb61510c92a5f3fa9203d50fdf
SHA512 271ecc3eb3516a2fd49c5754d1b4e0775e01d4296765ee1876a20b5c20c80f76ecc5ebf60394e9a2026d50c0f1e222d5c4fa13d6529a8ccddc468b5ea18b1a19
SSDEEP 1536:n9JWbv4qgbdJWI2pA3YASZoHcJwYvzVz7wW9lIbQsk7A9rUUKYvfDlhLxn1nNAOO:LqCG72I9OcJpz5zss0rKYXnNhip
TLSH
T16993D014B1C1C77BF51DF2B2A85057AEB3A9C6A1FB47E763369E51221F923508C48ACC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\blank.aes
Size 90KB
SHA256 c5a6b2cc771e4fe97ddd42137b4f3f989819f97e5fe44c3157813d2075c8bde6
MD5 4736b26f62ad1625f0cc1cf4c9638c1c
SHA1 c4a7a604c0ee5bdeae82209592ef010f552719b5
SHA512 a3e1833ee51abeb5926002a81413e06bcb6fab3acb7568a1478c4a0ec163702f8ffe64ef30c05ab2159f51ccb383bc55eb82ddb471399389e1fea6f63f40cb8c
SSDEEP 1536:QBYFSj0CTej+IRpd8NbvdS0ULlrfvXP9GMkVqs3JhVJIE/qNV9ptWrs6JXj62:OYo0EeiqkdS08f0MkqUlJdqNrpsJd22
TLSH
T13893129B893A590BC2176C52C944E263E042CE437A3F44E6A4ED084927E7585B5BDD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bound.blank

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\bound.blank
Size 38.0MB
SHA256 970c7bdb3c0a8ef2635e47b0fa4dab724d29c4e8f78ed5ca221ced29d80ab0b9
MD5 c82a60c26eed0aa4f369b9f2a4ae42e5
SHA1 7934dacadd6f575f6f818215015c2eacb99bca2a
SHA512 edaa8b857a4c577e9d90cfb2134a665e1b63cd689530f5fb03bfb217c73fb64db206cead660c9765b4445b86ea9080adaf4b79468603d5f7134788f458443b82
SSDEEP 786432:lwD/pTnrd15Vi2OtCLGiJ6I50ZRIMXw66OxZUhb4kJzSLIoNO6:lwDxTrRRdLGiJT50HrH6OxW4kJ+LIoR
TLSH
T1D39733AAE1C75D5EDFA49639B93511B3392EAC5EB4CFB8972D83090CDD152478CAC80C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\libcrypto-3.dll
Size 1.6MB
SHA256 88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d
MD5 8377fe5949527dd7be7b827cb1ffd324
SHA1 aa483a875cb06a86a371829372980d772fda2bf9
SHA512 c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7
SSDEEP 49152:f3Y7UGnm3dtF6Q5xkI61CPwDvt3uFlDCm:/Y7Bm3dz6Q5c1CPwDvt3uFlDCm
TLSH
T11775131424BF680BF69AAC788E708E2A896A1731B31CDFB32D6DDD184C18D1E59F44DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\libssl-3.dll
Size 221KB
SHA256 3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4
MD5 b2e766f5cf6f9d4dcbe8537bc5bded2f
SHA1 331269521ce1ab76799e69e9ae1c3b565a838574
SHA512 5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a
SSDEEP 6144:PpEswYxCQyTp2Z/3YUtoQe5efEw+OXDbM3nFLQdFM4mNJQ:PpAqo92h3Y660Ew+OTbAFLQd2lw
TLSH
T1DD2401933E2FD83AC803AD76AE7492D2D26C37424702DE66370BC9A97B75E4D617C052
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\pyexpat.pyd
Size 90KB
SHA256 2ed7eea0176481934b45d537d0953bd98d5367bf2578d6dcebe16ddc4c220a63
MD5 00ff161b1fb306c9be028ad0061bb689
SHA1 2cdffe3cf85bcc693c59c2eb090908674cefc310
SHA512 a10dc48b6145f36743b4b48984b199993c6fe21e402676aeb02cfff8acd7ad40a293f6fc8f6a7c78cec8c6502696fc6bc43c84828e7c94d290328d6223d561bf
SSDEEP 1536:cYxoxqdTv4GlHeb6Af1EQnlONwv33ZZfsg8Tl6C5hWVRIxHKK/1bgPr90LIBLhrE:cYxoOTAGef17nlt3ZZfsgDehWVRuF1bf
TLSH
T1FA9302CA8A5DD01BFFB2E9F260D8DC46B43877C7E4008B9F6594939D04E6351B7061BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\python312.dll
Size 1.7MB
SHA256 a6a2a464dfbb3bf5dad26a0eeae1af443160e2996ca59b85a9669e94b1a0d136
MD5 b4aca05e0313328b0cb6c696b15dc130
SHA1 2aee2e1f3c9135651a61453b0a3480bda49282e0
SHA512 2a2bb820ff9103379c7b273c1dde88e4701232c4793df0641a095a48c0f19d73300df7fd0e2433977667864279e8a8b5da6d0df493c46adf408c291469d81f6a
SSDEEP 49152:F/QxgZIg5iQqHc9TbBQGRwWs6kSruZuNFNMZ:F0g/IccGQ/S6Zus
TLSH
T1BC853373C85BE625D8E4BBB61886D6436CA43BC1D8B290D539B4E3C36B9FB105E17708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\select.pyd
Size 27KB
SHA256 7d9e448ef9b89978885c4b16fed76c8e72c5d9b5185bad95770fde84df1134fc
MD5 748a2840018c697f8c38043b2bc80562
SHA1 2d07e9372fe9fafd6c0ab5e0ae09b04961b147c4
SHA512 5dc5c13b3a54f1ad4ca80cc994ddb072cd3bc093c58533f144d5268458fa589d0d8243c5dd3ec421bbf97a0ea72ce411c090076487b3ca7e329b31c1dd9b6a64
SSDEEP 768:EGXglQPHjpYrGIBQGg1Q+Eyobo+Y7N2Ip4ShmTxf1ml/6dHQqZ2Z:E3lyWrGIBQGgG7yo47Q9ShGfIgHJQ
TLSH
T1ABD28EC78538A167EE53AE7152E0ED82FC38BBD35401875F34A9A19A0D573C0E31577A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\sqlite3.dll
Size 645KB
SHA256 b176131217844666b267813f7dadf18e3aa7c56fe22d5c872e95543fd132a093
MD5 99fbd3751bb02e3807c35bd701e6a764
SHA1 70f329aafa04ec3ba98d97d803dab3e6b6b63756
SHA512 a345a6809dfee336f3145e0cbebe2b7999f1b771a2490ea85af42b0bf7cb48d7acc3e9431d2981d3205a60f93c7dc8a8d4a88a8bd00884817198da895fbaeb74
SSDEEP 12288:1pZ29aLlU2+a9Li5EMtSJS3mIgwgPlXtovn7RY/AWHAGPxVNCu/:TvipaE5gNOvlYIGAA0u/
TLSH
T19CE423E32BAE0E1CE9E2A0709BC258D2A460761655F479EBF11813FC3E5FAE1E1F0144
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15082\unicodedata.pyd
Size 296KB
SHA256 8b4b1b829be6705d9cf55680517774459e491a6d5c0561c8a942a350d309abec
MD5 011cba6a7c5145d620655b22fec99e89
SHA1 ea7b9b2a0ac6f376eb9c0e6edd4487de34617808
SHA512 88b19b4ca4516662050d6cf7ce1be838ecbde9cbac6d1b40bc6baddead5db0c009002cbd6f81b74312615cbc8214a7e9542c1e0f40ba4aafbe78556d30c89128
SSDEEP 6144:gL4g17Ziz1gCtki0R7KjUAkDvN/mMHvmCMztFY3oudYnc3zR5lv:gL4Q7Qz1pknmIhxsQKcDRv
TLSH
T1B95412F7972BC154D767FD723B61ACA6387B0BD3B850199322CA40D389527C1729A32B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6922\_ctypes.pyd
Size 124KB
SHA256 ed4170b2c2c302639301a01c6aac4c5575e6e4c936edc803d3ba6c34444e35e1
MD5 fc2da679024ed27f02ecd1b05cf14cda
SHA1 5b5f4436e0527b2540aaf5407b22e8f410e6afd4
SHA512 0fc6b5fc862a0c528fe4fb8bed97d2622e0f1ce9fddb1005b138041859cd307119e9a35854aa9af9be6972ce71c4bbf3a587db73c78cba09131ae79b21a06e9d
SSDEEP 3072:YHcU2CMTT6mCZwIj+3ffEQj6ED434JIBLPnKZ+g:2tTST6mJNffEQuo4gT
TLSH
T1C8C36C4B335400A6EBA35178C5B3AF47E7B1B45B171093CF12A4C6992F637A36E2E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI6922\base_library.zip
Size 1.3MB
SHA256 22eedfcbc3ad62de4125b1097afd9c8e8dcd158bb61e0dba57b2b74b4df388b0
MD5 449616e2058f735cd4dd5e1cfc8c7246
SHA1 7701174922d0fee5bd9066f604bd78f41d26bdd3
SHA512 bd3d6ed58a43f2a3d49f97149695fcc7841063cc659c30287cdcbccd5fe8667653ecdae171c682dc7eb3948029e966974afc0b0b5c8dcf03f529e72c8bd611e6
SSDEEP 12288:AIq2/HTRenVTVihlyixmpvQXMHYqNRrmn9GpHbP1dms2tq/Rxs8lJGUm96:q2/HTIhp69WbP1dms2Ac8lJGU06
TLSH
T19F55D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI6922\python3.dll
Size 68KB
SHA256 e6811bc64d0cc2a8525098b691db364679602c7456894c2f69e1837214a8a705
MD5 3887abd76341942acef5eaf8999fd3d1
SHA1 cdcbff88d88d542887669065ad0371fc16d9675e
SHA512 83c0e83f5a6455c3cefeff9102027e55465f4507446391c8fe22910ed97627459dcdedf080dc1a74442fe3eb7aafcd51b3fc02a355cb7577bffeb0c87f61e463
SSDEEP 1536:DDmF61JFn+/OtJIBL0O7yo47Q9CfIgHNS:DqU17JIBL0OjYk
TLSH
T109636142BB54F893DBFA66FC79D199CE642B12CC872588ECA47593D30D1A310A2E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI6922\python312.dll
Size 6.6MB
SHA256 b6227a506a9963e7c8182785a54e14a193af51f7b277a61dda04492b499f49ad
MD5 b0939b2f7ec83154e09eabf606179525
SHA1 1ac5d572ef064de65d9ce1330425a67ad9be9b7c
SHA512 20c20665d047a82d30934d8f39854bf953b864566d1dc54f5ad6132e6d621bc1d0c3f9b31ba3b17b7270b9a5f5b2924eec055d1fc2a0ac27c248bc7b35c8cd3d
SSDEEP 98304:WuYbN/2UfE8f2XC06dfzCuvRHqMiELXzhnMg:W7b0+Zf2SHdZiM1N
TLSH
T1BF667C5A7358C0A9C96B90B4CC13C68EE7B27C517F50830B70ABB71E2F73792969A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_432uqz4a.k4u.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_432uqz4a.k4u.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bound.exe

Path C:\Users\Admin\AppData\Local\Temp\bound.exe
Size 38.2MB
SHA256 0458a2f592a059b10c0bff93a045bd553c8c8e37416b8f63e56839615f54defd
MD5 fd4e0c1cb9934404fe0e85bea47ee76d
SHA1 e46cbe2136d7f8f7209b19c5abdb6984334d4fec
SHA512 d0d950805f9007b390a927297bbf8dcfc87b52bad419202f4609bf6a67b5c5487e4401b650f8bf1cd3bfd3c7151ef173c62ae43ab32d481b6e4b2d2c07301740
SSDEEP 786432:hWTclJ53ZrFiGVFHMABWLsU86LGwgW8Vzfa7KZtXMb8Sz59eNeq:xn53ZIGVdxBKs9jWeLa7KZtc
TLSH
T1919733D47B450180ED93917C89FA010525817DA113BA8DEB8BF8AED25CF36E4EE7DB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1932-89-0x00007FFFEFD60000-0x00007FFFEFD85000-memory.dmp

Download

memory/1932-423-0x00007FFFE22A0000-0x00007FFFE22B9000-memory.dmp

Download

memory/1932-87-0x00007FFFEECC0000-0x00007FFFEECCD000-memory.dmp

Download

memory/1932-85-0x00007FFFE22A0000-0x00007FFFE22B9000-memory.dmp

Download

memory/1932-92-0x00007FFFE0830000-0x00007FFFE08FE000-memory.dmp

Download

memory/1932-99-0x00007FFFEF140000-0x00007FFFEF164000-memory.dmp

Download

memory/1932-102-0x00007FFFE1470000-0x00007FFFE15EF000-memory.dmp

Download

memory/1932-101-0x00007FFFEF090000-0x00007FFFEF09F000-memory.dmp

Download

memory/1932-39-0x00007FFFE15F0000-0x00007FFFE1CB2000-memory.dmp

Download

memory/1932-73-0x00007FFFEED10000-0x00007FFFEED3C000-memory.dmp

Download

memory/1932-104-0x00007FFFE09D0000-0x00007FFFE0F03000-memory.dmp

Download

memory/1932-103-0x00007FFFEECE0000-0x00007FFFEECF4000-memory.dmp

Download

memory/1932-76-0x00007FFFEF0A0000-0x00007FFFEF0AD000-memory.dmp

Download

memory/1932-83-0x00007FFFE09D0000-0x00007FFFE0F03000-memory.dmp

Download

memory/1932-124-0x00007FFFDBAF0000-0x00007FFFDBC0A000-memory.dmp

Download

memory/1932-82-0x00007FFFE15F0000-0x00007FFFE1CB2000-memory.dmp

Download

memory/1932-80-0x00007FFFEECE0000-0x00007FFFEECF4000-memory.dmp

Download

memory/1932-45-0x00007FFFEFD60000-0x00007FFFEFD85000-memory.dmp

Download

memory/1932-411-0x00007FFFEF0A0000-0x00007FFFEF0AD000-memory.dmp

Download

memory/1932-425-0x00007FFFE1EB0000-0x00007FFFE1EE3000-memory.dmp

Download

memory/1932-424-0x00007FFFEECC0000-0x00007FFFEECCD000-memory.dmp

Download

memory/1932-91-0x00007FFFE1EB0000-0x00007FFFE1EE3000-memory.dmp

Download

memory/1932-422-0x00007FFFE0830000-0x00007FFFE08FE000-memory.dmp

Download

memory/1932-421-0x00007FFFEECE0000-0x00007FFFEECF4000-memory.dmp

Download

memory/1932-420-0x00007FFFE15F0000-0x00007FFFE1CB2000-memory.dmp

Download

memory/1932-410-0x00007FFFEED10000-0x00007FFFEED3C000-memory.dmp

Download

memory/1932-46-0x00007FFFF7410000-0x00007FFFF741F000-memory.dmp

Download

memory/1932-409-0x00007FFFEF0B0000-0x00007FFFEF0C9000-memory.dmp

Download

memory/1932-408-0x00007FFFEF090000-0x00007FFFEF09F000-memory.dmp

Download

memory/1932-407-0x00007FFFEFD60000-0x00007FFFEFD85000-memory.dmp

Download

memory/1932-406-0x00007FFFF7410000-0x00007FFFF741F000-memory.dmp

Download

memory/1932-403-0x00007FFFDBAF0000-0x00007FFFDBC0A000-memory.dmp

Download

memory/1932-401-0x00007FFFE1470000-0x00007FFFE15EF000-memory.dmp

Download

memory/1932-400-0x00007FFFEF140000-0x00007FFFEF164000-memory.dmp

Download

memory/1932-394-0x00007FFFE09D0000-0x00007FFFE0F03000-memory.dmp

Download

memory/1932-72-0x00007FFFEF0B0000-0x00007FFFEF0C9000-memory.dmp

Download

memory/1932-78-0x00007FFFEF090000-0x00007FFFEF09F000-memory.dmp

Download

memory/2224-2118-0x00007FFFE14C0000-0x00007FFFE14E9000-memory.dmp

Download

memory/2404-113-0x000001C5A3E00000-0x000001C5A3E22000-memory.dmp

Download

memory/2760-106-0x0000014D4E020000-0x0000014D4E030000-memory.dmp

Download

memory/2760-105-0x0000014D4E020000-0x0000014D4E030000-memory.dmp

Download

memory/4576-2142-0x00007FFFE1F50000-0x00007FFFE1F79000-memory.dmp

Download

memory/6064-2175-0x0000022FED800000-0x0000022FEE2C1000-memory.dmp

Download