hijackloader | c2a75fb224674bd4825034ecb647cb1d83f451bf5f3907e4465f7f73d97c6ad8

Analysis

max time kernel
146s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2024 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VDeck Setup.exe
Size

47.5MB
MD5

2a63e2054769d84b26710bc65f378dbb
SHA1

8b8eed631cdce7d1b3784d8b27bcea3e1835f4a8
SHA256

c2a75fb224674bd4825034ecb647cb1d83f451bf5f3907e4465f7f73d97c6ad8
SHA512

e3e6a9d88ab303abd745e5be4bc64f3f0b07c62eac4e408657dbe81fa635ce9e2bea87716edd34fdb32590a21803e865b48740985038503b4e6ff248900e5be8
SSDEEP

786432:w05Iws7+lUI4i5PwrRJswginBlsGcuOE3W/4wfpwu94euy8XosV8q23yvjMEgn:w0Xzp4iirRJ1gB+OE3WAq594etE239Tn

Score

10^/10

hijackloader stealc cloregod2 credential_access discovery execution loader spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

cloregod2

http://45.156.27.196

Attributes

url_path
/4c7ef30d4540070f.php

Signatures

Detects HijackLoader (aka IDAT Loader) 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2200-770-0x0000000000400000-0x0000000000565000-memory.dmp	family_hijackloader
behavioral2/memory/3988-850-0x00000000001B0000-0x00000000009AC000-memory.dmp	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2836 powershell.exe
3700 powershell.exe
3956 powershell.exe
1852 powershell.exe
Downloads MZ/PE file

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
C:\Program Files (x86)\VDeck\VDeck.dll	net_reactor

Executes dropped EXE 3 IoCs

Processes:

VDeck.exesnss1.exesnss2.exe

pid process

2332 VDeck.exe
2200 snss1.exe
3988 snss2.exe

pid	process
2332	VDeck.exe
2200	snss1.exe
3988	snss2.exe

Loads dropped DLL 56 IoCs

Processes:

VDeck Setup.exeVDeck.exeexplorer.exe

pid	process
3920	VDeck Setup.exe
3920	VDeck Setup.exe
3920	VDeck Setup.exe
3920	VDeck Setup.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
2332	VDeck.exe
4548	explorer.exe
4548	explorer.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 2 IoCs

Processes:

snss1.exesnss2.exe

description pid process target process

PID 2200 set thread context of 3192 2200 snss1.exe cmd.exe
PID 3988 set thread context of 4148 3988 snss2.exe cmd.exe

description	pid	process	target process
PID 2200 set thread context of 3192	2200	snss1.exe	cmd.exe
PID 3988 set thread context of 4148	3988	snss2.exe	cmd.exe

Drops file in Program Files directory 64 IoCs

Processes:

VDeck Setup.exe

description	ioc	process
File created	C:\Program Files (x86)\VDeck\System.Security.Cryptography.Xml.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\ja\PresentationCore.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\pt-BR\PresentationCore.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.IO.MemoryMappedFiles.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\es\UIAutomationClientSideProviders.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\it\PresentationFramework.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\pt-BR\System.Windows.Forms.Design.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\ko\PresentationFramework.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\zh-Hant\UIAutomationTypes.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.Diagnostics.TraceSource.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.Windows.Extensions.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\VDeck.exe	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\de\System.Windows.Forms.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\cs\System.Windows.Forms.Primitives.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\pl\System.Xaml.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\zh-Hant\WindowsFormsIntegration.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.Net.NetworkInformation.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.Xml.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\UIAutomationTypes.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\cs\PresentationCore.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\tr\System.Windows.Forms.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.AppContext.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.Runtime.Serialization.Xml.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.Security.SecureString.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\pl\UIAutomationClient.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.Runtime.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.IO.Pipes.AccessControl.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\hostfxr.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\tr\ReachFramework.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.Globalization.Extensions.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\fr\UIAutomationClient.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\pl\PresentationCore.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\pl\PresentationUI.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.Diagnostics.Debug.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.Diagnostics.Process.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\ru\System.Windows.Input.Manipulations.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.Globalization.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\it\System.Windows.Forms.Design.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\ko\System.Windows.Input.Manipulations.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\msquic.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\wpfgfx_cor3.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\it\ReachFramework.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\ja\PresentationFramework.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\de\System.Windows.Input.Manipulations.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\pl\System.Windows.Forms.Design.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\pl\System.Windows.Forms.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\zh-Hant\System.Windows.Input.Manipulations.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\DirectWriteForwarder.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.IO.Pipes.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.Linq.Expressions.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.Resources.Reader.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\cs\UIAutomationClientSideProviders.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\it\System.Xaml.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\ko\PresentationUI.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.Formats.Tar.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.Net.WebClient.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.ServiceProcess.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\ru\ReachFramework.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\PresentationFramework-SystemXml.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\clrjit.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\ja\System.Windows.Input.Manipulations.resources.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\System.Linq.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\vcruntime140_cor3.dll	VDeck Setup.exe
File created	C:\Program Files (x86)\VDeck\fr\System.Windows.Forms.Primitives.resources.dll	VDeck Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

snss2.exeVDeck Setup.exeexplorer.execmd.execmd.exeexplorer.exesnss1.execmd.exetimeout.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snss2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VDeck Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snss1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1940 timeout.exe

pid	process
1940	timeout.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exesnss1.execmd.exeexplorer.exesnss2.execmd.exe

pid	process
2836	powershell.exe
2836	powershell.exe
3700	powershell.exe
3700	powershell.exe
3956	powershell.exe
3956	powershell.exe
1852	powershell.exe
1852	powershell.exe
2200	snss1.exe
2200	snss1.exe
3192	cmd.exe
3192	cmd.exe
4548	explorer.exe
4548	explorer.exe
3988	snss2.exe
3988	snss2.exe
4148	cmd.exe
4148	cmd.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

snss1.execmd.exesnss2.execmd.exe

pid process

2200 snss1.exe
3192 cmd.exe
3988 snss2.exe
4148 cmd.exe

pid	process
2200	snss1.exe
3192	cmd.exe
3988	snss2.exe
4148	cmd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	3700	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

snss2.exe

pid process

3988 snss2.exe

pid	process
3988	snss2.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

VDeck Setup.exeVDeck.exesnss1.execmd.exeexplorer.execmd.exesnss2.execmd.exe

description	pid	process	target process
PID 3920 wrote to memory of 2332	3920	VDeck Setup.exe	VDeck.exe
PID 3920 wrote to memory of 2332	3920	VDeck Setup.exe	VDeck.exe
PID 2332 wrote to memory of 2836	2332	VDeck.exe	powershell.exe
PID 2332 wrote to memory of 2836	2332	VDeck.exe	powershell.exe
PID 2332 wrote to memory of 3700	2332	VDeck.exe	powershell.exe
PID 2332 wrote to memory of 3700	2332	VDeck.exe	powershell.exe
PID 2332 wrote to memory of 3956	2332	VDeck.exe	powershell.exe
PID 2332 wrote to memory of 3956	2332	VDeck.exe	powershell.exe
PID 2332 wrote to memory of 1852	2332	VDeck.exe	powershell.exe
PID 2332 wrote to memory of 1852	2332	VDeck.exe	powershell.exe
PID 2332 wrote to memory of 2200	2332	VDeck.exe	snss1.exe
PID 2332 wrote to memory of 2200	2332	VDeck.exe	snss1.exe
PID 2332 wrote to memory of 2200	2332	VDeck.exe	snss1.exe
PID 2200 wrote to memory of 3192	2200	snss1.exe	cmd.exe
PID 2200 wrote to memory of 3192	2200	snss1.exe	cmd.exe
PID 2200 wrote to memory of 3192	2200	snss1.exe	cmd.exe
PID 2200 wrote to memory of 3192	2200	snss1.exe	cmd.exe
PID 3192 wrote to memory of 4548	3192	cmd.exe	explorer.exe
PID 3192 wrote to memory of 4548	3192	cmd.exe	explorer.exe
PID 3192 wrote to memory of 4548	3192	cmd.exe	explorer.exe
PID 3192 wrote to memory of 4548	3192	cmd.exe	explorer.exe
PID 4548 wrote to memory of 1380	4548	explorer.exe	cmd.exe
PID 4548 wrote to memory of 1380	4548	explorer.exe	cmd.exe
PID 4548 wrote to memory of 1380	4548	explorer.exe	cmd.exe
PID 1380 wrote to memory of 1940	1380	cmd.exe	timeout.exe
PID 1380 wrote to memory of 1940	1380	cmd.exe	timeout.exe
PID 1380 wrote to memory of 1940	1380	cmd.exe	timeout.exe
PID 2332 wrote to memory of 3988	2332	VDeck.exe	snss2.exe
PID 2332 wrote to memory of 3988	2332	VDeck.exe	snss2.exe
PID 2332 wrote to memory of 3988	2332	VDeck.exe	snss2.exe
PID 3988 wrote to memory of 4148	3988	snss2.exe	cmd.exe
PID 3988 wrote to memory of 4148	3988	snss2.exe	cmd.exe
PID 3988 wrote to memory of 4148	3988	snss2.exe	cmd.exe
PID 3988 wrote to memory of 4148	3988	snss2.exe	cmd.exe
PID 4148 wrote to memory of 4380	4148	cmd.exe	explorer.exe
PID 4148 wrote to memory of 4380	4148	cmd.exe	explorer.exe
PID 4148 wrote to memory of 4380	4148	cmd.exe	explorer.exe
PID 4148 wrote to memory of 4380	4148	cmd.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\VDeck Setup.exe
"C:\Users\Admin\AppData\Local\Temp\VDeck Setup.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3920

C:\Program Files (x86)\VDeck\VDeck.exe
"C:\Program Files (x86)\VDeck\VDeck.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3700

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1852

C:\Users\Admin\AppData\Local\Temp\e7a94d57-70c5-4973-b4a4-540967c02ddd\snss1.exe
"C:\Users\Admin\AppData\Local\Temp\e7a94d57-70c5-4973-b4a4-540967c02ddd\snss1.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3192

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4548

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\SysWOW64\explorer.exe" & del "C:\ProgramData\*.dll"" & exit
6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\SysWOW64\timeout.exe
timeout /t 5
7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1940

C:\Users\Admin\AppData\Local\Temp\e7a94d57-70c5-4973-b4a4-540967c02ddd\snss2.exe
"C:\Users\Admin\AppData\Local\Temp\e7a94d57-70c5-4973-b4a4-540967c02ddd\snss2.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3988

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4148

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- System Location Discovery: System Language Discovery
PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\VDeck\Accessibility.dll

Filesize
20KB

MD5
fb554f9fe0b91f135d26ac6459cfd6f2

SHA1
b1269a2c28bded872b14fe70b69484631ef3a65d

SHA256
929ea150ad45b7c7dd5427461fbec44d43b67c08081f59b42b6abf570feae271

SHA512
8dffde6cddfc59ec380111fd36048126559e1f1e080c081ca0d09021bb23d6888e93e1659c7b3a8fa46f76602b03cf3e638ec1a80fba79e51648dcb32362e10c

Download Submit
C:\Program Files (x86)\VDeck\Microsoft.Win32.Primitives.dll

Filesize
15KB

MD5
300c95ff95b52e8a02fec6bfcfa58225

SHA1
b646f89fcd463ad5c19889b4fea40540568b780c

SHA256
f1b40565e5c4c41da810aee5b7d2272a0906e88f796812435aa5ed712bcac40c

SHA512
9bfe0eb6eea98b2d35aa42986a273ec82424143965e173b32bb4b7e5537580a027940a6952a45fc54f0b665e871deb2a95651106c2f24c7de3b3d3cd2dec7e89

Download Submit
C:\Program Files (x86)\VDeck\Microsoft.Win32.SystemEvents.dll

Filesize
94KB

MD5
089edcaae873c9371b2dc9a4399f62b9

SHA1
441686e76986ecf295e50e80a78dc093dc9f9a02

SHA256
c81a58bd27c74f91e26245c530c4cadc5425a1a1586886c6a5631eef9d81fde2

SHA512
6b88f9264fdbbb0585efa21940fc888c593862ebb3bd305890294f64b37a81967a8ab2fbba30aa3f5db2994c25c57929df1644e269be898b77c77d4c0181f943

Download Submit
C:\Program Files (x86)\VDeck\System.Collections.Specialized.dll

Filesize
102KB

MD5
cc26e9e30ffab763a1e54c0ef3713382

SHA1
c3be6646b7a4576ebd7729dbf4dccbd1fc159d51

SHA256
0cbabb81eae22f4c07c6c846054d207ae3f25da15649eb7fa29e4e2cecd24db4

SHA512
c8e57fb70cfa7667f9a5484c99eedd0bf34004ee26e9642e99a6b90624caa804af571d8aaafa7e9b121550af58205f8ed197b4ddb928210d394ff0b4c1897149

Download Submit
C:\Program Files (x86)\VDeck\System.Collections.dll

Filesize
254KB

MD5
92063926c04f2e4bf5b5fde16542831d

SHA1
e7be34eaff2d3d8796911d21f1fdbb93bf231dec

SHA256
9193aaef3ea8f19408f88c25fcaf5880e7836d1c35028d7e4077f6090b083541

SHA512
e855ee37980d1da2d143ee39133b05fff81937e529cffe74433e73088549daabd3abadbf05f3765bf3ffffd50313f0ed966efec0eb244d7363241affd73cc29f

Download Submit
C:\Program Files (x86)\VDeck\System.ComponentModel.EventBasedAsync.dll

Filesize
46KB

MD5
333639248121fb67d18323613a8203ea

SHA1
0cee5f7d46596239b833b3b30dccde27b0136959

SHA256
4c97d7bc0742faaa52ba86018b040aac44ddfc88a5835f9e6a659e03b4558999

SHA512
714fcb7299abcb26100b5f4103834c11c58f535ee9853fca2bcb22f43a3d1e7608d6ccae2dcc93d1687a4f1c8b521afe683d537f70f858681e62fff2d79c4acb

Download Submit
C:\Program Files (x86)\VDeck\System.ComponentModel.Primitives.dll

Filesize
78KB

MD5
1c59c00ab0850af4b4d2bafd6be47db3

SHA1
4c6185b2f42987e25a5fdf2aa30cf4150de25d5b

SHA256
133ec34432ab8fa4f63ade636193864b6a62a089a0c98d746f5532c8a52f437b

SHA512
8425c02c4afb274e862e4ed5dd1c766ebfa1bcf5bf59018d86238014a52603331a8b7c1e233f5a1f22171e90132ddd585db0d2561ff2cd287d703397afdff4b1

Download Submit
C:\Program Files (x86)\VDeck\System.ComponentModel.TypeConverter.dll

Filesize
726KB

MD5
f6f78df8a3ef64639ac0cb7de24ed66b

SHA1
384422c0ceb6bb6870c4f7d9074e9c78d33e4c0c

SHA256
88129c110d748f7c8ef8a923f68cd26d39e0505b49bf5cc10cbd23b92f1a00a3

SHA512
ed63f75e3477196b5308c42f259c0294a29ef5edf6eb0df4f8268be3f0495b9cfd8ca3467bc1574db142571c368940468bb84d14c26aaccacd6eee66ddd98403

Download Submit
C:\Program Files (x86)\VDeck\System.Diagnostics.FileVersionInfo.dll

Filesize
46KB

MD5
1daf75cc369569182bbdb664eb8cb4c7

SHA1
ec0ff43694f0027a469d31221b591bff2ef29d69

SHA256
92ae8401342fd8484e749c65a7726a0f5bff69346ad4e96026bfa063ff567b8b

SHA512
9d0ee9b59354f721136a1631e46d395b763f755b212e44daea5c62a91b4c5edfd218587c8aa56db27f7efc7b9678c59ea822964f279a7837aa5e12f46be4e79b

Download Submit
C:\Program Files (x86)\VDeck\System.Diagnostics.StackTrace.dll

Filesize
46KB

MD5
70c0d0120a96a30c980414f44bfe9d5e

SHA1
ad158543ae92c9b47e6290bab86b4cb5511b7029

SHA256
318eb3af0fda576d8094404185690b9570d576ea56e85c47251769c09de8035c

SHA512
42e9e048668b491a7fce4d5da6a2690f386c9d4d847b7ce0b2c70f743f615dc9917eafa5cc3d94f4e5803abe65d892c4f89d88ce8531b7d3c2b8c536d7d224da

Download Submit
C:\Program Files (x86)\VDeck\System.Diagnostics.TraceSource.dll

Filesize
142KB

MD5
fe6a4b96e144131788108c8396a849eb

SHA1
40e6e5d03cfe036645ae854d5a2262faec6bed32

SHA256
22365ee4e3ba3c991d495e41f92e29bf6ddb38a48c44f55651271b80ee62b6d1

SHA512
61644c0e970dd6a6ff697b110bf99962931dd94deda5a966ea0fded3d23cba7433b802656295e04f1a95421774ea3c838f0a642d26b5e46ae6c05becb52eb7f1

Download Submit
C:\Program Files (x86)\VDeck\System.Drawing.Common.dll

Filesize
1.5MB

MD5
e4715322db624dc52947a42ac67757ab

SHA1
ba0b0850142ecc3910927d6f2e5781b896d7d442

SHA256
75b1e772a4355145364121af00e5b5cf06c7212aa53d662fdc996bc11e8092a9

SHA512
3c86d44eb209a3a1f2001968a2b139e532a0513fd2decff04aa1bf8b30b6202c70fc0e7ac8b22ace563023671259cd74cf65062132e7f1b97d3580621686b05a

Download Submit
C:\Program Files (x86)\VDeck\System.Drawing.Primitives.dll

Filesize
130KB

MD5
b5ca10a41cc865048491f617678722a9

SHA1
afe171d9d676b78983b802e18ef8e00927073c64

SHA256
cbe9fbb1d1e4850460854474ffd8c01ddcc756dcb33a86d1674c0cb2e2a0b026

SHA512
2afdce56b7eec6deb82f8b2d5ec3029b5a0ee1e8bbf2e0ff9a0a5310bf265ddcdf63660546b4dbcc3c5fb0cba3cbb94f2408fe5cb4d14dbe0e74aba6dd5a2192

Download Submit
C:\Program Files (x86)\VDeck\System.IO.Compression.Brotli.dll

Filesize
82KB

MD5
4cde4fcd6f41f0d6d400c1d66f391538

SHA1
7c4a13f37c8d20fbe60c5b612107bd0242b68e26

SHA256
51bc8800f8579a14d1edf0f650c9a5d828ef9d96532d7dd304a4394fa9cfd641

SHA512
d7b444ec7f230c3104fdd98c60af9de998a85e622e0c8ce3471a3809d9ba8bb368d7827800fb177ac97f0ce3feb3ad2292a77d41b8c36bc99b2df1263feb8735

Download Submit
C:\Program Files (x86)\VDeck\System.IO.Compression.Native.dll

Filesize
809KB

MD5
68deb864299c12cd26aea44c39aa665b

SHA1
03613118a674e115c23b3eae354805e9e41bb34c

SHA256
1d58d2b17d468651e17870876029dbd3f68d6ba74b18a75f148581eaddc9c1b1

SHA512
4ad6b2c38338469de0f0247152f773f6886ea5396aca5cbc178dc2e894aeccc1296fd02ffec1d1a266bc548a490a8afc5ba383087bd89567957980472318ccad

Download Submit
C:\Program Files (x86)\VDeck\System.IO.Compression.dll

Filesize
258KB

MD5
e11feb9fb874d60b76c2ad7a5fef7ac8

SHA1
e7622bad558fd695442b3ecfeea8f706601c0310

SHA256
3f5083bf4404c5969557e6c19a5b87d7db5bef2ee10fd86d775b6a96b357232a

SHA512
dd3e75b0a86ee2240ebf37d728f467b11fd4a25e4b7fdbc8f4c5b4180bcd0e8c1a1695f5cb72133da428f791cb922699cc3a325e05c44bd7931c141b07504587

Download Submit
C:\Program Files (x86)\VDeck\System.Memory.dll

Filesize
154KB

MD5
7e999da530c21a292cec8a642127b8c8

SHA1
6585d0260ae98bab2ad1eaba0f9cfe8ebb8a0b3f

SHA256
3af25e0c81c1462d0db86f55c4e5fd8c048c70685f9a566d29d499bc46935fb4

SHA512
a18b6649b5c2f9f96bf639863df9faad436759200a64f91fb2d955f33c71ce4b2d5798be982f692a247ac864d8acb63fb731b31c06333e5c7d9a9c895ecd6451

Download Submit
C:\Program Files (x86)\VDeck\System.Numerics.Vectors.dll

Filesize
15KB

MD5
b7adf99da15738c602df256e8a1aac4a

SHA1
ff98005dfcf40f876b618a599f227397f36915df

SHA256
2466f7df763b191a6b4a536eae1016394d81e175fc53cefe56b8ce27459412af

SHA512
8eb34d00f8149d688bd5efe2ffdc834f669fa8c30d4c265814647de78a55502805104ccc3682010b246d26d805004b188ab19ad59fc2e866103bbe191e2225ad

Download Submit
C:\Program Files (x86)\VDeck\System.Private.CoreLib.dll

Filesize
12.6MB

MD5
805cf170e27dd31219a6b873c17dce88

SHA1
ac90fa4690a8b54b6248dcb4c41a2c9a74547667

SHA256
ba7e61a00e7a4634b5c5a79b83126f75580ceec235c613000c3efbc01826cad0

SHA512
fa946aae906b66cb5570155a1c77340f2b6d4efb9be16068da03a8f1c5b5f37ad847d65cd1416017db19375dc6a72670300da4c766e6d9bb1a00374f492bd866

Download Submit
C:\Program Files (x86)\VDeck\System.Runtime.InteropServices.dll

Filesize
94KB

MD5
49c86e36b713e2b7daeb7547cede45fb

SHA1
75fe38864362226d2cce32b2c25432b1fd18ba37

SHA256
756de3f5f2e07b478ac046a0ac976b992ef6bc653a1be2bb1e28524a4ff8d67d

SHA512
a9bd42b626158c540be04f8d392620daba544a55b7438d6caefe93b9df10ec2219f28959c4e0d706a86b92008275de94dfdf19de730787cdacf46d99fc45e3a9

Download Submit
C:\Program Files (x86)\VDeck\System.Runtime.dll

Filesize
42KB

MD5
53501b2f33c210123a1a08a977d16b25

SHA1
354e358d7cf2a655e80c4e4a645733c3db0e7e4d

SHA256
1fc86ada2ec543a85b8a06a9470a7b5aaa91eb03cfe497a32cd52a1e043ea100

SHA512
9ef3b47ddd275de9dfb5ded34a69a74af2689ebcb34911f0e4ffef9e2faf409e2395c7730bce364b5668b2b3b3e05a7b5998586563fb15e22c223859b2e77796

Download Submit
C:\Program Files (x86)\VDeck\System.Security.Cryptography.Csp.dll

Filesize
15KB

MD5
c7f55dbc6f5090194c5907054779e982

SHA1
efa17e697b8cfd607c728608a3926eda7cd88238

SHA256
16bc1f72938d96deca5ce031a29a43552385674c83f07e4f91d387f5f01b8d0a

SHA512
ae0164273b04afdec2257ae30126a8b44d80ee52725009cc917d28d09fcfb19dfbbb3a817423e98af36f773015768fed9964331d992ad1830f6797b854c0c355

Download Submit
C:\Program Files (x86)\VDeck\System.Security.Cryptography.dll

Filesize
2.0MB

MD5
75f18d3666eb009dd86fab998bb98710

SHA1
b273f135e289d528c0cfffad5613a272437b1f77

SHA256
4582f67764410785714a30fa05ffaaad78fe1bc8d4689889a43c2af825b2002e

SHA512
9e110e87e00f42c228729e649903ad649b962ae28900d486ee8f96c47acca094dbace608f9504745abf7e69597cdef3c6b544b5194703882a0a7f27b011fa8d5

Download Submit
C:\Program Files (x86)\VDeck\System.Threading.Thread.dll

Filesize
15KB

MD5
72d839e793c4f3200d4c5a6d4aa28d20

SHA1
fbc25dd97b031a6faddd7e33bc500719e8eead19

SHA256
84c9a95609878542f00fe7da658f62d1a6943a43e6346af80d26bcff069a4dbd

SHA512
a414cd9d7cf6a04709f3bdbef0295349b845a8301171ed6394e97b9993f35816383b958736c814f91c359a783cca86ee04802856486d4b4e0ab90a45da39db1d

Download Submit
C:\Program Files (x86)\VDeck\System.Threading.dll

Filesize
82KB

MD5
32aa6e809d0ddb57806c6c23b584440e

SHA1
6bd651b9456f88a28f7054af475031afe52b7b64

SHA256
e8d1f5c422ee0ba3b235b22028ab92dc77c1ff9774edc0b940cad7224a30ba7d

SHA512
fe43b3d6ed5c37d59a44636d3c7522a88d83e6ec074bf69d3cbb6e5454fdd8f0523ea10fdf6fd452cbd0e2fc159cf9d03dfad6b30e80e400e7f1773b5a2e8632

Download Submit
C:\Program Files (x86)\VDeck\System.Windows.Forms.Primitives.dll

Filesize
2.9MB

MD5
8129c2d72bcba8b50576e7c43e558832

SHA1
f4892f78d2496f3a2e1fa2380ff68fbeb62e2dca

SHA256
5794a3996a0b4ab9cb13f3de0f87d50462615a7d0eb1d243d9324a682c1b58cb

SHA512
40fafbf9590d2b2c8f487f44708e9e97ddce03b1487be5c7cb3d4c92bdb7100a98aebada379f63003f0dd9d447ee2b0b9dfa0b057320ac05f7f77b31c5ffa97d

Download Submit
C:\Program Files (x86)\VDeck\System.Windows.Forms.dll

Filesize
12.9MB

MD5
a51632facb386d55cc3bc1f0822e4222

SHA1
59144c26183277304933fd8bb5da7d363fcc11fa

SHA256
efc52dbbef5202d9ff424d7adc6e2249b66450a5fd5414891776fc617b00123e

SHA512
2a8d8e2ee8168e6f79476616385320f463ebc161c7393db2b18a7d35ca0111c5100b83954c5eabfe32b12cac3dbfdc514271dde4cc4468dd26235eb7020d9c14

Download Submit
C:\Program Files (x86)\VDeck\VDeck.dll

Filesize
547KB

MD5
e40435c83bd20baceaf366715681802a

SHA1
44b58c1df66799c3e03d95c43bd98cac672c1b44

SHA256
59f0ddfd450a4280f7f0b63f5c9d2b92bc40680762d9390bb94786ca2ca7ab27

SHA512
caacb3c9a3990fb3d339250ba90e89168966f0fa645fe5bd09297fb44016f8c81edff2419ca8804f7f27250f764dc75fd6ff4f6adc4e505a4a7538d36382be36

Download Submit
C:\Program Files (x86)\VDeck\VDeck.exe

Filesize
337KB

MD5
b49848e297488ef03b44c4c4b197472d

SHA1
440255ca9282f7e2667a7bd0b27b8d2bdc4c1db3

SHA256
35be11ddfa4f1d776f0b6b814a325f50189100222fe04436a50563c89c2a02bd

SHA512
3515e6775862b0d66a206c24fa4916b2de208fe3cd0c7aec4e24d6d940a391f9d32a489642a32efafaa9c87b15fbbd4c462320797693705db50a85a2f523f655

Download Submit
C:\Program Files (x86)\VDeck\clrjit.dll

Filesize
1.7MB

MD5
8b81a3f0521b10e9de59507fe8efd685

SHA1
0516ff331e09fbd88817d265ff9dd0b647f31acb

SHA256
0759c8129bc761fe039e1cacb92c643606591cb8149a2ed33ee16babc9768dcb

SHA512
ea11c04b92a76957dcebe9667bef1881fc9afa0f8c1547e23ada8125aa9e40d36e0efaf5749da346ba40c66da439cbd15bf98453e1f8dab4fe1efd5618fdc176

Download Submit
C:\Program Files (x86)\VDeck\coreclr.dll

Filesize
4.8MB

MD5
9369162a572d150dca56c7ebcbb19285

SHA1
81ce4faeecbd9ba219411a6e61d3510aa90d971d

SHA256
871949a2ec19c183ccdacdea54c7b3e43c590eaf445e1b58817ee1cb3ce366d5

SHA512
1eb5eb2d90e3dd38023a3ae461f717837ce50c2f9fc5e882b0593ab81dae1748bdbb7b9b0c832451dfe3c1529f5e1894a451365b8c872a8c0a185b521dbcd16b

Download Submit
C:\Program Files (x86)\VDeck\hostfxr.dll

Filesize
342KB

MD5
16532d13721ba4eac3ca60c29eefb16d

SHA1
f058d96f8e93b5291c07afdc1d891a8cc3edc9a0

SHA256
5aa15c6119b971742a7f824609739198a3c7c499370ed8b8df5a5942f69d9303

SHA512
9da30d469b4faed86a4bc62617b309f34e6bda66a3021b4a27d197d4bcb361f859c1a7c0aa2d16f0867ad93524b62a5f4e5ae5cf082da47fece87fc3d32ab100

Download Submit
C:\Program Files (x86)\VDeck\hostpolicy.dll

Filesize
388KB

MD5
a7e9ed205cf16318d90734d184f220d0

SHA1
10de2d33e05728e409e254441e864590b77e9637

SHA256
02c8dbe7bf1999352fc561cb35b51c6a88c881a4223c478c91768fdaf8e47b62

SHA512
3ecbaf20946e27d924a38c5a2bf11bac7b678b8c4ebf6f436c923ea935982500e97f91d0e934b7fd6b1fc2a2fd34e7d7b31dbbe91314a218724b3b2fd64c4052

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jhv4k1pm.a4a.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx983B.tmp\InstallOptions.dll

Filesize
15KB

MD5
d095b082b7c5ba4665d40d9c5042af6d

SHA1
2220277304af105ca6c56219f56f04e894b28d27

SHA256
b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

SHA512
61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx983B.tmp\LangDLL.dll

Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx983B.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx983B.tmp\ioSpecial.ini

Filesize
1KB

MD5
6950eab804d0a3545a5300d83eb34bf9

SHA1
a32de3033ca1ad9b1d80676719ff431104d384f3

SHA256
616a6132cc2eec95989c97c6fe8b527dbafbe843bf93f1d9e605c5c8336f1814

SHA512
ad6f1766209d33e276bfb56413a4f3e05a129b53284ea7766dcd767112a4eaf3f6d7cc083e6beac4ba354dff4ad60d3c49bbefc7720fcf1577e4b9979f532a8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx983B.tmp\ioSpecial.ini

Filesize
1KB

MD5
e6e8d797bdc7c0d99dc380d40a2bb573

SHA1
af58d21f037f174240a27d438db78effd77cfab4

SHA256
babd936c93d22cd94dcc356c744ab476147c191f01e0f0196bfa4796f48fa31c

SHA512
6947914fac87c761122d353b3c56e20bdcaa36e90e9c77fba2b7a2761fb8b16a38b243ce92f54eeb2bc372e2e3ed166bedce5e41c335d25ba9539dfd4074103b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx983B.tmp\ioSpecial.ini

Filesize
1KB

MD5
1c2ea07c4e620276d08488829417e1a3

SHA1
bef2c88d7b7e91b5f4e74bdff3ec0a217d6019e2

SHA256
85871adac0ffffc0124f4b5d6b8089a43c13fb23b3aa602bad263fa64f5736a8

SHA512
73d7c15c26bf4de06c7055142561683879f00db0dd915e2e156699d96b55bc97d9bc71b068a35ee4d52e8687f7978107fabf4eb0243afa073c9853a81df04a95

Download Submit
memory/2200-770-0x0000000000400000-0x0000000000565000-memory.dmp

Filesize
1.4MB

Download
memory/2200-771-0x0000000074600000-0x000000007477B000-memory.dmp

Filesize
1.5MB

Download
memory/2200-772-0x00007FF9632D0000-0x00007FF9634C5000-memory.dmp

Filesize
2.0MB

Download
memory/2200-773-0x0000000074600000-0x000000007477B000-memory.dmp

Filesize
1.5MB

Download
memory/2836-735-0x0000021673A20000-0x0000021673A42000-memory.dmp

Filesize
136KB

Download
memory/3192-776-0x00007FF9632D0000-0x00007FF9634C5000-memory.dmp

Filesize
2.0MB

Download
memory/3192-777-0x0000000074600000-0x000000007477B000-memory.dmp

Filesize
1.5MB

Download
memory/3988-850-0x00000000001B0000-0x00000000009AC000-memory.dmp

Filesize
8.0MB

Download
memory/3988-853-0x0000000074240000-0x00000000743BB000-memory.dmp

Filesize
1.5MB

Download
memory/3988-852-0x00007FF9632D0000-0x00007FF9634C5000-memory.dmp

Filesize
2.0MB

Download
memory/3988-851-0x0000000074240000-0x00000000743BB000-memory.dmp

Filesize
1.5MB

Download
memory/4148-857-0x0000000074240000-0x00000000743BB000-memory.dmp

Filesize
1.5MB

Download
memory/4148-856-0x00007FF9632D0000-0x00007FF9634C5000-memory.dmp

Filesize
2.0MB

Download
memory/4380-859-0x0000000000C80000-0x0000000000CFF000-memory.dmp

Filesize
508KB

Download
memory/4380-860-0x00007FF9632D0000-0x00007FF9634C5000-memory.dmp

Filesize
2.0MB

Download
memory/4380-861-0x0000000000C80000-0x0000000000CFF000-memory.dmp

Filesize
508KB

Download
memory/4548-848-0x0000000001030000-0x0000000001275000-memory.dmp

Filesize
2.3MB

Download
memory/4548-846-0x0000000001030000-0x0000000001275000-memory.dmp

Filesize
2.3MB

Download
memory/4548-784-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4548-781-0x0000000001030000-0x0000000001275000-memory.dmp

Filesize
2.3MB

Download
memory/4548-780-0x00007FF9632D0000-0x00007FF9634C5000-memory.dmp

Filesize
2.0MB

Download
memory/4548-779-0x0000000001030000-0x0000000001275000-memory.dmp

Filesize
2.3MB

Download