stealc | a548b65783231dc2d4a936ac0cdde7ae373ac84e1142a7678bd045b9d129cc06

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20251231-en
resource tags

arch:x64arch:x86image:win10v2004-20251231-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.DownLoader49.25798.1231.24170.exe
Size 2.2MB
Sample260107-vx83cady7d
SHA256 a548b65783231dc2d4a936ac0cdde7ae373ac84e1142a7678bd045b9d129cc06
MD5 75914207c89e01520ec7905774192f04
SHA1 e8e1b890692083e893de4c8eec718200ce00ca14
SHA512 f025a3223195b659f0af309865cb08607aedc597d67e666b3afc00aeb4a3d795c4d608382ab25c0458ee38de98cd308953a3c3070fa47e69295f154cbd67a3f2
SSDEEP 49152:ZaBNlIwxb3uCrb/TMvO90d7HjmAFd4A64nsfJt0udLClUBr4HyfZhsRoYg15Q6Eb:ut3unArwYh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

crypt discovery downloader stealc svcstealer installer persistence spyware stealer upx

Malware Config

Extracted

Family

stealc

Botnet

crypt

http://196.251.107.23

Attributes

url_path
/7ffc7a279c17c091.php

rc4.plain

Signatures

Detects SvcStealer Payload 1 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
behavioral1/files/0x000d0000000241af-63.dat	family_svcstealer

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer
Svcstealer family
svcstealer

Downloads MZ/PE file 1 IoCs

flow	pid	Process
18	5660	helpPane.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-96356054-3272438343-75478577-1000\Control Panel\International\Geo\Nation	9QkDGTZErrXB.tmp

Executes dropped EXE 10 IoCs

pid	Process
5992	9QkDGTZErrXB.exe
5900	nPmP7tawzVgC.exe
2624	9QkDGTZErrXB.tmp
5216	1sLS2i3JQSbP.exe
5880	svchost.exe
5720	9QkDGTZErrXB.exe
3280	9QkDGTZErrXB.tmp
1628	FnHotkeyUtility.exe
4668	FnHotkeyUtility.exe
956	FnHotkeyUtility.exe

Loads dropped DLL 20 IoCs

pid	Process
2624	9QkDGTZErrXB.tmp
2624	9QkDGTZErrXB.tmp
3280	9QkDGTZErrXB.tmp
3280	9QkDGTZErrXB.tmp
1628	FnHotkeyUtility.exe
1628	FnHotkeyUtility.exe
1628	FnHotkeyUtility.exe
1628	FnHotkeyUtility.exe
1628	FnHotkeyUtility.exe
1628	FnHotkeyUtility.exe
4668	FnHotkeyUtility.exe
4668	FnHotkeyUtility.exe
4668	FnHotkeyUtility.exe
4668	FnHotkeyUtility.exe
4668	FnHotkeyUtility.exe
956	FnHotkeyUtility.exe
956	FnHotkeyUtility.exe
956	FnHotkeyUtility.exe
956	FnHotkeyUtility.exe
956	FnHotkeyUtility.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-96356054-3272438343-75478577-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	1sLS2i3JQSbP.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\dll\shell32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\bcrypt.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\crypt32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\mscorlib.ni.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\gdi32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\msvcrt.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\ws2_32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\symbols\dll\msvcp140.amd64.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\symbols\dll\powrprof.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\ws2_32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\mscoreei.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\symbols\dll\psapi.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\ntdll.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\kernel32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\win32u.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\dbghelp.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\vcruntime140.amd64.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\SensApi.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\advapi32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\symbols\dll\ole32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\symbols\dll\wintrust.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\hid.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\spkvol.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\sechost.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\msvcp_win.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\oleaut32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\SensApi.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\symbols\dll\clr.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\oleaut32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\vcruntime140_1.amd64.spectre.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\vcruntime140.amd64.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\spkvol.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\symbols\dll\bcryptprimitives.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\gdi32full.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\winhttp.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\symbols\dll\ws2_32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\gdi32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\crypt32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\kernelbase.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\user32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\DLL\iphlpapi.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\symbols\dll\msasn1.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\symbols\dll\rpcrt4.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\gdiplus.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\ucrtbase.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\DLL\hid.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\SensApi.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\spkvol.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\symbols\dll\clr.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\symbols\dll\ucrtbase_clr0400.amd64.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\clrjit.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\symbols\dll\vcruntime140_1.amd64.spectre.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\bcrypt.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\symbols\DLL\imm32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\kernel32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dbghelp.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\Kernel.Appcore.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\ucrtbase_clr0400.amd64.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\advapi32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\ole32.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\Kernel.Appcore.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\symbols\exe\FnHotkeyUtility.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\dll\ntdll.pdb	FnHotkeyUtility.exe
File opened for modification	C:\Windows\System32\userenv.pdb	FnHotkeyUtility.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5740 set thread context of 5660	5740	SecuriteInfo.com.Trojan.DownLoader49.25798.1231.24170.exe	85

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000800000002438f-184.dat	upx
behavioral1/memory/1628-195-0x00007FFB4E940000-0x00007FFB4EBA6000-memory.dmp	upx
behavioral1/memory/1628-199-0x00007FFB4E940000-0x00007FFB4EBA6000-memory.dmp	upx
behavioral1/memory/1628-220-0x00007FFB4E940000-0x00007FFB4EBA6000-memory.dmp	upx
behavioral1/memory/1628-222-0x00007FFB4E940000-0x00007FFB4EBA6000-memory.dmp	upx
behavioral1/memory/1628-223-0x00007FFB4E940000-0x00007FFB4EBA6000-memory.dmp	upx
behavioral1/memory/4668-226-0x00007FFB4E9D0000-0x00007FFB4EC36000-memory.dmp	upx
behavioral1/memory/4668-232-0x00007FFB4E9D0000-0x00007FFB4EC36000-memory.dmp	upx
behavioral1/memory/4668-234-0x00007FFB4E9D0000-0x00007FFB4EC36000-memory.dmp	upx
behavioral1/memory/4668-260-0x00007FFB4E9D0000-0x00007FFB4EC36000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9QkDGTZErrXB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9QkDGTZErrXB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9QkDGTZErrXB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9QkDGTZErrXB.tmp

Inno Setup is an open-source installation builder for Windows applications. 5 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x00110000000241a5-49.dat	innosetup
behavioral1/memory/5992-58-0x00000000004D0000-0x00000000005B9000-memory.dmp	innosetup
behavioral1/memory/5720-137-0x00000000004D0000-0x00000000005B9000-memory.dmp	innosetup
behavioral1/memory/5992-140-0x00000000004D0000-0x00000000005B9000-memory.dmp	innosetup
behavioral1/memory/5720-197-0x00000000004D0000-0x00000000005B9000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	FnHotkeyUtility.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	FnHotkeyUtility.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	FnHotkeyUtility.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	FnHotkeyUtility.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	FnHotkeyUtility.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	FnHotkeyUtility.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	FnHotkeyUtility.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	FnHotkeyUtility.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	FnHotkeyUtility.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	FnHotkeyUtility.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	FnHotkeyUtility.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	FnHotkeyUtility.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	FnHotkeyUtility.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	FnHotkeyUtility.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	FnHotkeyUtility.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	FnHotkeyUtility.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	FnHotkeyUtility.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	FnHotkeyUtility.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	helpPane.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	helpPane.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5660	helpPane.exe
5660	helpPane.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
2624	9QkDGTZErrXB.tmp
2624	9QkDGTZErrXB.tmp
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe
5900	nPmP7tawzVgC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3240	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3280	9QkDGTZErrXB.tmp

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3240	Explorer.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5740 wrote to memory of 5660	5740	SecuriteInfo.com.Trojan.DownLoader49.25798.1231.24170.exe	85
PID 5740 wrote to memory of 5660	5740	SecuriteInfo.com.Trojan.DownLoader49.25798.1231.24170.exe	85
PID 5740 wrote to memory of 5660	5740	SecuriteInfo.com.Trojan.DownLoader49.25798.1231.24170.exe	85
PID 5740 wrote to memory of 5660	5740	SecuriteInfo.com.Trojan.DownLoader49.25798.1231.24170.exe	85
PID 5740 wrote to memory of 5660	5740	SecuriteInfo.com.Trojan.DownLoader49.25798.1231.24170.exe	85
PID 5740 wrote to memory of 5660	5740	SecuriteInfo.com.Trojan.DownLoader49.25798.1231.24170.exe	85
PID 5740 wrote to memory of 5660	5740	SecuriteInfo.com.Trojan.DownLoader49.25798.1231.24170.exe	85
PID 5740 wrote to memory of 5660	5740	SecuriteInfo.com.Trojan.DownLoader49.25798.1231.24170.exe	85
PID 5660 wrote to memory of 4864	5660	helpPane.exe	86
PID 5660 wrote to memory of 4864	5660	helpPane.exe	86
PID 5660 wrote to memory of 2056	5660	helpPane.exe	88
PID 5660 wrote to memory of 2056	5660	helpPane.exe	88
PID 5660 wrote to memory of 5992	5660	helpPane.exe	92
PID 5660 wrote to memory of 5900	5660	helpPane.exe	94
PID 5992 wrote to memory of 2624	5992	9QkDGTZErrXB.exe	95
PID 5660 wrote to memory of 5216	5660	helpPane.exe	96
PID 2624 wrote to memory of 5720	2624	9QkDGTZErrXB.tmp	100
PID 5720 wrote to memory of 3280	5720	9QkDGTZErrXB.exe	101
PID 5900 wrote to memory of 3240	5900	nPmP7tawzVgC.exe	54
PID 5900 wrote to memory of 3240	5900	nPmP7tawzVgC.exe	54
PID 3280 wrote to memory of 1628	3280	9QkDGTZErrXB.tmp	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3240
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader49.25798.1231.24170.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader49.25798.1231.24170.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\helpPane.exe
    "C:\Windows\helpPane.exe"
    3⤵
    - Downloads MZ/PE file
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2056
  - - C:\Users\Admin\AppData\Local\9QkDGTZErrXB.exe
      "C:\Users\Admin\AppData\Local\9QkDGTZErrXB.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\is-S6R3UNVJZ1.tmp\9QkDGTZErrXB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-S6R3UNVJZ1.tmp\9QkDGTZErrXB.tmp" /SL5="$140244,3851360,893440,C:\Users\Admin\AppData\Local\9QkDGTZErrXB.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2624
      - C:\Users\Admin\AppData\Local\9QkDGTZErrXB.exe
        
        "C:\Users\Admin\AppData\Local\9QkDGTZErrXB.exe" /VERYSILENT /PASSWORD=11d4712e-0c58-4cfb-a314-ac5f5c2c8098
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\is-IQ8QR6W7AX.tmp\9QkDGTZErrXB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-IQ8QR6W7AX.tmp\9QkDGTZErrXB.tmp" /SL5="$150244,3851360,893440,C:\Users\Admin\AppData\Local\9QkDGTZErrXB.exe" /VERYSILENT /PASSWORD=11d4712e-0c58-4cfb-a314-ac5f5c2c8098
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3280
        
        C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe
        
        "C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe" -Embedding
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        
        PID:1628
  - - C:\Users\Admin\AppData\Local\nPmP7tawzVgC.exe
      "C:\Users\Admin\AppData\Local\nPmP7tawzVgC.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5900
  - - C:\Users\Admin\AppData\Local\1sLS2i3JQSbP.exe
      "C:\Users\Admin\AppData\Local\1sLS2i3JQSbP.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:5216

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1032

C:\Users\Admin\Pictures\svchost.exe
C:\Users\Admin\Pictures\svchost.exe
1⤵
- Executes dropped EXE
PID:5880

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:4960

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3232

C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe
C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4668

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:5504

C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe
C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:956

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:4068

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FnHotkeyUtility.exe

Path C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe
Size 1.3MB
SHA256 2728e26af764a64dd31f6df20bad9ce68f27a1c54628abf7353a62f5e67a9dff
MD5 ac01b1efe9bdd6c127bcb489765e935d
SHA1 2ba7bbcf28c0171e51bd31ed8f4c9695134de3dc
SHA512 3ada07d1a35e80f726229ca3266eabc296500853274cc04be76d59461a80fc9ee8a1bc28678a20423f1fcf0ff194de5b629452250dd5be7a08c25bf52df84a35
SSDEEP 24576:RHGG1DQA1jJiCmuz8OPzbWFa4WbaMrres:R2A1lXyQbWFbw
MD5 SHA1 SHA512 SSDEEP

Submit Download

ludp.dll

Path C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\ludp.dll
Size 1.6MB
SHA256 a62f73b7cef738ebd9963744665aa85772b428aef214f07f8112ff3816b09241
MD5 084f247502e6054ada4a65a8935a4396
SHA1 1794e9b5e818cbcc378f48cdc336e055020fa321
SHA512 f1fcddbe75d98ad5d1d7d3951730d0451663aab00a355ad38298a33e36df7be057f9cddc97e38fab9368a804b97c3af6893eaa84b25b16fab21e692fad45fe47
SSDEEP 49152:/Gtlq7kjBH5M5QMSA7i57S3OD8CK6Iwg:JA0iSe
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\msvcp140.dll
Size 571KB
SHA256 a68a9ac35aa1e183fe3bd9e7144259631530db07502112a339e5e1c8dccc9a31
MD5 990a590eb079f420946fde91975798b9
SHA1 e78619eea4699bbb24a32051842ae15a971f7107
SHA512 6ccf8b198986de3478411233514803b22750560da419cbcb052ff963ebfea40386d54db6c335d7cd771503eb93693b872ff3c1bf39385eabc7fdd06ca40f6296
SSDEEP 12288:jSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQN:jUStZaQEKZm+jWodEE9CQN
MD5 SHA1 SHA512 SSDEEP

Submit Download

spkvol.dll

Path C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\spkvol.dll
Size 4.2MB
SHA256 40129767e7985b4c7aedf0827e669c059b90c834dddb4a0d40eeaf495a8c5846
MD5 ad61adc8f8e3bfb13b0722de763dc562
SHA1 921b951275ae77efbeb95adfb70fb532bc1737f3
SHA512 21d75216037f67c182288e66960227d128dc0107fc2324197aef2a4e2871b27a48bc3fe5219f8037ef52fa90bdf258421d486deada3e31b2a5612f4f30459d11
SSDEEP 24576:bHGJGQoIqtWimgiIxOegtKDSRRV5svwGI1+28sgonuA:bGJGQoI+mw8KSRv5g/2tzu
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\vcruntime140.dll
Size 101KB
SHA256 5dc711b1f190df5b1257b92883e9c3f10cb4e953591da13dd50d9f0c7a4af695
MD5 c5bc6d2136f51d438af4dbe8ef8103d1
SHA1 186e176ad2df3df728acd5c5b0dee6dcdf036e80
SHA512 2ae122c612882a4a5f16bd5c69e5ed4b3e5e87d52f979d2e0e34254f397c63ae1dbeb5ab64c35c640b17d626aa4feafc6927f745102e1ac13f1837f1e665eeaa
SSDEEP 1536:m3qPWvVCMgfw2eeWqjOebgk0jIpePxd76LGYU8j6ecbolG8E/4xPcj888iiBg9z:m66dsFeeBGPj1L6LGY+ecboCN78iZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140_1.dll

Path C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\vcruntime140_1.dll
Size 46KB
SHA256 e30874ceaf6b8dfe72ba67e5c1f21027d79cb3a873a32eb12c5ed89bfa660d1f
MD5 f17586db47571622455a6f57fecdda53
SHA1 5ca5ef3ca3eb244174a5b912b6c7ea607247e6eb
SHA512 d942964b65b1df656025b848ed2f6b423c6cdffd6626855b7f39a7152fc4ffa20672214e7c0ff1075130363127a5db35b98831ada51596d4d322387a7d0a0708
SSDEEP 768:Ime4gSbOzTRU2RESkCW89wf9fV49zBA9USp9HPisSg:cO0r9KfWzB4Dx5P
MD5 SHA1 SHA512 SSDEEP

Submit Download

5A040CBC-CAC3-6A10-5FC4-1BD8F74CF320.txt

Path C:\ProgramData\5A040CBC-CAC3-6A10-5FC4-1BD8F74CF320.txt
Size 64B
SHA256 7061ad452b786dd6bea209843c9cb75081c31b7532342938a32c3ea1ee6d65b9
MD5 766bf2c5c2242f267bc491d0246b322a
SHA1 d28b5079029a0cb8a09ce4dcaba12acd20d5a1d3
SHA512 9ffd2da2496ac085cb21bc1fd7658373b62ad2638b5041af230cccf378a290e05f7f5666c7da1d8c7d6fd67983caafd2674525c96f5eee185ba1d7a6e87143b9
MD5 SHA1 SHA512

Submit Download

5A040CBC-CAC3-6A10-5FC4-1BD8F74CF320.txt

Path C:\ProgramData\5A040CBC-CAC3-6A10-5FC4-1BD8F74CF320.txt
Size 64B
SHA256 ed6970ced87459ddd397fd4df201e2cfb3679b5500cebbab7da01e3a29b6b19a
MD5 dff252b435a06f7c8dae779b0d80cda8
SHA1 086649dcb90feaafc859a3713e2bbd599d6f8fe1
SHA512 fa32b63740fe1052fbe502a78c6597c7d08f990fa7879462d651881c6c111ceb1d1328d66be5c1ef45696c9ec28e754b5ae11fb74af98bb163f6a1e32e2436f1
MD5 SHA1 SHA512

Submit Download

Edge_History

Path C:\ProgramData\{efdd1174-e6b3-11f0-8c66-806e6f6e6963}\Browsers\Edge_History
Size 204KB
SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
MD5 0f709d9a7125f5d69ba52e8846867f41
SHA1 e9e554385d503e88a18665f5fa36d4b8f9d49fb9
SHA512 9969ad8f86e8c40d9d609e65c091565e14ce550d9191c3ea0d1c62ce51d076a79b20078f556667e96f012dffd60578ef82a8cc245676db78d3b6b2b3d9d71711
SSDEEP 96:3XIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:3Xf+G83uy3Ct7XBBKjH7DXspU3i
MD5 SHA1 SHA512 SSDEEP

Submit Download

1sLS2i3JQSbP.exe

Path C:\Users\Admin\AppData\Local\1sLS2i3JQSbP.exe
Size 253KB
SHA256 baf43d31ee9e62706ca5a894735202bbaf918729a09bcd91b5066b8e820dbc90
MD5 e5f76b2db75723b2803f5d4a5b5187e8
SHA1 23e0ceb34a9d968465054fb7fb32e205f9ac786e
SHA512 805850bc4647f91db633014536c359c241c17536b5f91b13e460e2c1d6e9b063e6f0bb453490c3543e53f87440cb98954dea2a5916672c3adc8364934d3e1f45
SSDEEP 3072:mNOwqK4rgK11DQFhjFs5zlwuSnXrZNkxIEAL9DVdUr6RFhPp3YVKrw90C8/NHLXI:8ORK4rg+1DOpskTXlNkxM/smwn8BobE
MD5 SHA1 SHA512 SSDEEP

Submit Download

9QkDGTZErrXB.exe

Path C:\Users\Admin\AppData\Local\9QkDGTZErrXB.exe
Size 4.7MB
SHA256 1f0f46dc270ea7e929b2ae662a8480f5766df7e17ff76816bba7a07865b2806d
MD5 6b18bc2388eb1162da48c366fc90bedc
SHA1 c759351e55b66f8f1c2f5c7ce5ce975dd05d4561
SHA512 de4d0992e1d0517dd5eebecb68780bd762b42c378a4320cf660fdfbca4c2d24b9dc09df0fe5904b12aa771841813129d84eaf5de6b10219a5004ea05c6455aa3
SSDEEP 98304:HN66h+qY9CLppI6cmLB6/EGv+e+6QX0/RSLOEAN3v5Ilb:/ZgCLrI6cmLw/Rv+e+6dZ1PN3ip
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\History
Size 204KB
SHA256 7734176bbba168a8f0d50d87ee1f329d0e64a41f663e55f212e3d9fe2b7f95cb
MD5 79f1f6452341c483ef8b82df1ca1582a
SHA1 34b2e3c427617535ab5ce8b753573d2ffca45282
SHA512 58d1f7340e9098cef7a9750b66444ae778de1cca4efa26496961d2a29559b588d403c94ec0cf4880fda7ae7a8b61acc9d9f3ce0be9b01771dae6e2f063bca9a7
SSDEEP 96:J4IU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:J4f+G83uy3Ct7XBBKjH7DXspU3i
MD5 SHA1 SHA512 SSDEEP

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-QB8K196DRY.tmp\_isetup\_isdecmp.dll
Size 34KB
SHA256 31d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26
MD5 c6ae924ad02500284f7e4efa11fa7cfc
SHA1 2a7770b473b0a7dc9a331d017297ff5af400fed8
SHA512 f321e4820b39d1642fc43bf1055471a323edcc0c4cbd3ddd5ad26a7b28c4fb9fc4e57c00ae7819a4f45a3e0bb9c7baa0ba19c3ceedacf38b911cdf625aa7ddae
SSDEEP 768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5 SHA1 SHA512 SSDEEP

Submit Download

9QkDGTZErrXB.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-S6R3UNVJZ1.tmp\9QkDGTZErrXB.tmp
Size 3.6MB
SHA256 cc127c89698ba84f6965a0c177776affbf52ed07e9222e589ddb307c84d40d82
MD5 901ffea60915cebef6768295a9563e5f
SHA1 79f82756574fe121a80d77870d7ae8d5f1038d0c
SHA512 87f88ad0d8d6f39b11f78e67a2e200b4c427508ee802b6cc09a03507b079f796cc25ee2fc67c26be54b6f35684c92c4e8ef7e6107300de2c3d1c5caa73024a8b
SSDEEP 49152:K3SA9I3bZxTZElVySH6UNoO7zjQynN4s7UUZyE8eECaN2MU333uy:KCbWroSkynN4sQ+TdMU333N
MD5 SHA1 SHA512 SSDEEP

Submit Download

nPmP7tawzVgC.exe

Path C:\Users\Admin\AppData\Local\nPmP7tawzVgC.exe
Size 1.6MB
SHA256 7b2620cf008268fa8eff18c136ca020fa948634e646f7301ab48a5dd936033fd
MD5 2df6951b9ef238bfb1c879e18221db30
SHA1 c019d8c7cb1760958f44c7e3dcdd5b040ddf517e
SHA512 5399577cd5a9d704a0c3328cdb9fbc3bf0b5095ce7d9db8d3c52c1e0e920bf06536467e95b333a24252adb779bac102e5a61cf57827341d437c8dadd7c33c0fa
SSDEEP 24576:402+h4Q8qAjv6qfjq1nJAfPVHDClF7rDheENnlBtSqlOqrXtd0RlgbCpS:+Q8FDjWJAfPVHCpheENnd75r03gb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/956-267-0x00007FF78DBF0000-0x00007FF78DD44000-memory.dmp

Download

memory/1628-216-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/1628-212-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/1628-223-0x00007FFB4E940000-0x00007FFB4EBA6000-memory.dmp

Download

memory/1628-222-0x00007FFB4E940000-0x00007FFB4EBA6000-memory.dmp

Download

memory/1628-221-0x000002B125380000-0x000002B1254BB000-memory.dmp

Download

memory/1628-220-0x00007FFB4E940000-0x00007FFB4EBA6000-memory.dmp

Download

memory/1628-200-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/1628-215-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/1628-207-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/1628-209-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/1628-211-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/1628-195-0x00007FFB4E940000-0x00007FFB4EBA6000-memory.dmp

Download

memory/1628-213-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/1628-214-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/1628-198-0x00007FF78DBF0000-0x00007FF78DD44000-memory.dmp

Download

memory/1628-217-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/1628-218-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/1628-219-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/1628-210-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/1628-208-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/1628-199-0x00007FFB4E940000-0x00007FFB4EBA6000-memory.dmp

Download

memory/2624-139-0x0000000000420000-0x00000000007C5000-memory.dmp

Download

memory/3240-165-0x0000000008390000-0x00000000083D6000-memory.dmp

Download

memory/3240-161-0x0000000008390000-0x00000000083D6000-memory.dmp

Download

memory/3240-159-0x0000000008390000-0x00000000083D6000-memory.dmp

Download

memory/3240-158-0x0000000008390000-0x00000000083D6000-memory.dmp

Download

memory/3240-157-0x0000000008390000-0x00000000083D6000-memory.dmp

Download

memory/3240-156-0x0000000008390000-0x00000000083D6000-memory.dmp

Download

memory/3240-155-0x0000000008390000-0x00000000083D6000-memory.dmp

Download

memory/3240-154-0x0000000008390000-0x00000000083D6000-memory.dmp

Download

memory/3240-152-0x0000000002EF0000-0x0000000002F31000-memory.dmp

Download

memory/3240-153-0x0000000008390000-0x00000000083D6000-memory.dmp

Download

memory/3240-166-0x0000000008390000-0x00000000083D6000-memory.dmp

Download

memory/3240-164-0x0000000008390000-0x00000000083D6000-memory.dmp

Download

memory/3240-160-0x0000000008390000-0x00000000083D6000-memory.dmp

Download

memory/3240-163-0x0000000008390000-0x00000000083D6000-memory.dmp

Download

memory/3240-162-0x0000000008390000-0x00000000083D6000-memory.dmp

Download

memory/3280-196-0x0000000000710000-0x0000000000AB5000-memory.dmp

Download

memory/4668-242-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/4668-234-0x00007FFB4E9D0000-0x00007FFB4EC36000-memory.dmp

Download

memory/4668-232-0x00007FFB4E9D0000-0x00007FFB4EC36000-memory.dmp

Download

memory/4668-226-0x00007FFB4E9D0000-0x00007FFB4EC36000-memory.dmp

Download

memory/4668-243-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/4668-233-0x00000264F3790000-0x00000264F38DE000-memory.dmp

Download

memory/4668-244-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/4668-260-0x00007FFB4E9D0000-0x00007FFB4EC36000-memory.dmp

Download

memory/4668-231-0x00007FF78DBF0000-0x00007FF78DD44000-memory.dmp

Download

memory/5660-19-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-11-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-14-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-12-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-10-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-82-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-9-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-81-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-18-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-22-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-13-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-15-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-0-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-5-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-16-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-25-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-17-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-21-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5660-20-0x00007FF73B990000-0x00007FF73BA5C000-memory.dmp

Download

memory/5720-197-0x00000000004D0000-0x00000000005B9000-memory.dmp

Download

memory/5720-137-0x00000000004D0000-0x00000000005B9000-memory.dmp

Download

memory/5992-140-0x00000000004D0000-0x00000000005B9000-memory.dmp

Download

memory/5992-58-0x00000000004D0000-0x00000000005B9000-memory.dmp

Download