a42ead8ab0fabb39e376ef1ec193229609d393db6b5c41084d9bd31b63b0e5c2

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_1bad62ccf251e3bb7584b4f1d0067efe_icedid_stealc.exe
Size 17.8MB
Sample260507-mbcs1sbv41
SHA256 a42ead8ab0fabb39e376ef1ec193229609d393db6b5c41084d9bd31b63b0e5c2
MD5 1bad62ccf251e3bb7584b4f1d0067efe
SHA1 b6159d151f8adca8b63cf4bac5f472ecfd9dae96
SHA512 e634439d9bd10c85f842e544912b7fa163f3625d2cdfeb996d280b4f18ddfe12041236f8db64e9b96113c29d6ac5a798277903d67652c505fe5f1be2e564971c
SSDEEP 393216:t3Wfrpw0PohZoLMhxWLkBv/b0dgkWZUfLFWRQcPQfvqL:4Dpw+K2OMXcPQfq
TLSH
T1071733C3E799D0EAE05588FBA5041204FB59AC76770CCFB112E878AE6D091D85F6BD23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3544	romlaunch.exe
1084	ROMServer.exe
1576	ROMFUSClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\Run\ROMScreenLauncher = "\"C:\\Users\\Admin\\AppData\\Roaming\\screen\\romlaunch.exe\""	2026-05-07_1bad62ccf251e3bb7584b4f1d0067efe_icedid_stealc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROMServer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROMFUSClient.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
5728	taskkill.exe
3400	taskkill.exe
3888	taskkill.exe
2772	taskkill.exe
2124	taskkill.exe
1576	taskkill.exe
5920	taskkill.exe
5368	taskkill.exe
4732	taskkill.exe
2744	taskkill.exe
5312	taskkill.exe
5004	taskkill.exe
5484	taskkill.exe
3184	taskkill.exe
584	taskkill.exe
4828	taskkill.exe
3416	taskkill.exe
4336	taskkill.exe
3940	taskkill.exe
5136	taskkill.exe
3164	taskkill.exe
1704	taskkill.exe
4476	taskkill.exe
2772	taskkill.exe
4296	taskkill.exe
4944	taskkill.exe
2532	taskkill.exe
3728	taskkill.exe
4852	taskkill.exe
3380	taskkill.exe
3124	taskkill.exe
2024	taskkill.exe
2548	taskkill.exe
3968	taskkill.exe
220	taskkill.exe
5844	taskkill.exe
2076	taskkill.exe
3696	taskkill.exe
3300	taskkill.exe
1900	taskkill.exe
3864	taskkill.exe
2484	taskkill.exe
5336	taskkill.exe
5480	taskkill.exe
4708	taskkill.exe
2612	taskkill.exe
4988	taskkill.exe
1292	taskkill.exe
5628	taskkill.exe
3108	taskkill.exe
4564	taskkill.exe
1336	taskkill.exe
916	taskkill.exe
1984	taskkill.exe
5936	taskkill.exe
2028	taskkill.exe
4204	taskkill.exe
1672	taskkill.exe
1760	taskkill.exe
5068	taskkill.exe
5428	taskkill.exe
3068	taskkill.exe
4592	taskkill.exe
1012	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe
3544	romlaunch.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3544	romlaunch.exe
Token: SeDebugPrivilege	3828	taskkill.exe
Token: SeTcbPrivilege	1084	ROMServer.exe
Token: SeDebugPrivilege	2980	taskkill.exe
Token: SeDebugPrivilege	2212	taskkill.exe
Token: SeDebugPrivilege	3164	taskkill.exe
Token: SeDebugPrivilege	5844	taskkill.exe
Token: SeDebugPrivilege	5136	taskkill.exe
Token: SeDebugPrivilege	5628	taskkill.exe
Token: SeDebugPrivilege	5936	taskkill.exe
Token: SeDebugPrivilege	3372	taskkill.exe
Token: SeDebugPrivilege	5332	taskkill.exe
Token: SeDebugPrivilege	2820	taskkill.exe
Token: SeDebugPrivilege	5960	taskkill.exe
Token: SeDebugPrivilege	5612	taskkill.exe
Token: SeDebugPrivilege	4336	taskkill.exe
Token: SeDebugPrivilege	2744	taskkill.exe
Token: SeDebugPrivilege	2076	taskkill.exe
Token: SeDebugPrivilege	584	taskkill.exe
Token: SeDebugPrivilege	4592	taskkill.exe
Token: SeDebugPrivilege	3300	taskkill.exe
Token: SeDebugPrivilege	4160	taskkill.exe
Token: SeDebugPrivilege	3004	taskkill.exe
Token: SeDebugPrivilege	3940	taskkill.exe
Token: SeDebugPrivilege	5992	taskkill.exe
Token: SeDebugPrivilege	1292	taskkill.exe
Token: SeDebugPrivilege	4732	taskkill.exe
Token: SeDebugPrivilege	220	taskkill.exe
Token: SeDebugPrivilege	4852	taskkill.exe
Token: SeDebugPrivilege	2028	taskkill.exe
Token: SeDebugPrivilege	3888	taskkill.exe
Token: SeDebugPrivilege	4692	taskkill.exe
Token: SeDebugPrivilege	2772	taskkill.exe
Token: SeDebugPrivilege	916	taskkill.exe
Token: SeDebugPrivilege	4828	taskkill.exe
Token: SeDebugPrivilege	3076	taskkill.exe
Token: SeDebugPrivilege	5004	taskkill.exe
Token: SeDebugPrivilege	5312	taskkill.exe
Token: SeDebugPrivilege	5480	taskkill.exe
Token: SeDebugPrivilege	484	taskkill.exe
Token: SeDebugPrivilege	5272	taskkill.exe
Token: SeDebugPrivilege	2436	taskkill.exe
Token: SeDebugPrivilege	5728	taskkill.exe
Token: SeDebugPrivilege	3164	taskkill.exe
Token: SeDebugPrivilege	5368	taskkill.exe
Token: SeDebugPrivilege	3108	taskkill.exe
Token: SeDebugPrivilege	5532	taskkill.exe
Token: SeDebugPrivilege	1900	taskkill.exe
Token: SeDebugPrivilege	2772	taskkill.exe
Token: SeDebugPrivilege	3968	taskkill.exe
Token: SeDebugPrivilege	572	taskkill.exe
Token: SeDebugPrivilege	5892	taskkill.exe
Token: SeDebugPrivilege	4204	taskkill.exe
Token: SeDebugPrivilege	2484	taskkill.exe
Token: SeDebugPrivilege	5224	taskkill.exe
Token: SeDebugPrivilege	2592	taskkill.exe
Token: SeDebugPrivilege	3864	taskkill.exe
Token: SeDebugPrivilege	576	taskkill.exe
Token: SeDebugPrivilege	4708	taskkill.exe
Token: SeDebugPrivilege	2124	taskkill.exe
Token: SeDebugPrivilege	3204	taskkill.exe
Token: SeDebugPrivilege	3380	taskkill.exe
Token: SeDebugPrivilege	928	taskkill.exe
Token: SeDebugPrivilege	1672	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 3544	6112	2026-05-07_1bad62ccf251e3bb7584b4f1d0067efe_icedid_stealc.exe	79
PID 3544 wrote to memory of 1084	3544	romlaunch.exe	80
PID 3544 wrote to memory of 3828	3544	romlaunch.exe	81
PID 3544 wrote to memory of 2980	3544	romlaunch.exe	84
PID 1084 wrote to memory of 1576	1084	ROMServer.exe	86
PID 3544 wrote to memory of 2212	3544	romlaunch.exe	87
PID 3544 wrote to memory of 3164	3544	romlaunch.exe	89
PID 3544 wrote to memory of 5844	3544	romlaunch.exe	91
PID 3544 wrote to memory of 5136	3544	romlaunch.exe	93
PID 3544 wrote to memory of 5628	3544	romlaunch.exe	95
PID 3544 wrote to memory of 5936	3544	romlaunch.exe	97
PID 3544 wrote to memory of 3372	3544	romlaunch.exe	99
PID 3544 wrote to memory of 5332	3544	romlaunch.exe	101
PID 3544 wrote to memory of 2820	3544	romlaunch.exe	103
PID 3544 wrote to memory of 5960	3544	romlaunch.exe	105
PID 3544 wrote to memory of 5612	3544	romlaunch.exe	107
PID 3544 wrote to memory of 4336	3544	romlaunch.exe	109
PID 3544 wrote to memory of 2744	3544	romlaunch.exe	111
PID 3544 wrote to memory of 2076	3544	romlaunch.exe	113
PID 3544 wrote to memory of 584	3544	romlaunch.exe	115
PID 3544 wrote to memory of 4592	3544	romlaunch.exe	117
PID 3544 wrote to memory of 3300	3544	romlaunch.exe	119
PID 3544 wrote to memory of 4160	3544	romlaunch.exe	121
PID 3544 wrote to memory of 3004	3544	romlaunch.exe	123
PID 3544 wrote to memory of 3940	3544	romlaunch.exe	125
PID 3544 wrote to memory of 5992	3544	romlaunch.exe	127
PID 3544 wrote to memory of 1292	3544	romlaunch.exe	129
PID 3544 wrote to memory of 4732	3544	romlaunch.exe	131
PID 3544 wrote to memory of 220	3544	romlaunch.exe	133
PID 3544 wrote to memory of 4852	3544	romlaunch.exe	135
PID 3544 wrote to memory of 2028	3544	romlaunch.exe	137
PID 3544 wrote to memory of 3888	3544	romlaunch.exe	139
PID 3544 wrote to memory of 4692	3544	romlaunch.exe	141
PID 3544 wrote to memory of 2772	3544	romlaunch.exe	143
PID 3544 wrote to memory of 916	3544	romlaunch.exe	145
PID 3544 wrote to memory of 4828	3544	romlaunch.exe	147
PID 3544 wrote to memory of 3076	3544	romlaunch.exe	149
PID 3544 wrote to memory of 5004	3544	romlaunch.exe	151
PID 3544 wrote to memory of 5312	3544	romlaunch.exe	153
PID 3544 wrote to memory of 5480	3544	romlaunch.exe	155
PID 3544 wrote to memory of 484	3544	romlaunch.exe	157
PID 3544 wrote to memory of 5272	3544	romlaunch.exe	159
PID 3544 wrote to memory of 2436	3544	romlaunch.exe	161
PID 3544 wrote to memory of 5728	3544	romlaunch.exe	163
PID 3544 wrote to memory of 3164	3544	romlaunch.exe	165
PID 3544 wrote to memory of 5368	3544	romlaunch.exe	167
PID 3544 wrote to memory of 3108	3544	romlaunch.exe	169
PID 3544 wrote to memory of 5532	3544	romlaunch.exe	171
PID 3544 wrote to memory of 1900	3544	romlaunch.exe	173
PID 3544 wrote to memory of 2772	3544	romlaunch.exe	175
PID 3544 wrote to memory of 3968	3544	romlaunch.exe	177
PID 3544 wrote to memory of 572	3544	romlaunch.exe	179
PID 3544 wrote to memory of 5892	3544	romlaunch.exe	181
PID 3544 wrote to memory of 4204	3544	romlaunch.exe	183
PID 3544 wrote to memory of 2484	3544	romlaunch.exe	185
PID 3544 wrote to memory of 5224	3544	romlaunch.exe	187
PID 3544 wrote to memory of 2592	3544	romlaunch.exe	189
PID 3544 wrote to memory of 3864	3544	romlaunch.exe	191
PID 3544 wrote to memory of 576	3544	romlaunch.exe	193
PID 3544 wrote to memory of 4708	3544	romlaunch.exe	195
PID 3544 wrote to memory of 2124	3544	romlaunch.exe	197
PID 3544 wrote to memory of 3204	3544	romlaunch.exe	199
PID 3544 wrote to memory of 3380	3544	romlaunch.exe	201
PID 3544 wrote to memory of 928	3544	romlaunch.exe	203

C:\Users\Admin\AppData\Local\Temp\2026-05-07_1bad62ccf251e3bb7584b4f1d0067efe_icedid_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_1bad62ccf251e3bb7584b4f1d0067efe_icedid_stealc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Users\Admin\AppData\Roaming\screen\romlaunch.exe
  "C:\Users\Admin\AppData\Roaming\screen\romlaunch.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Users\Admin\AppData\Roaming\screen\ROMServer.exe
    "C:\Users\Admin\AppData\Roaming\screen\ROMServer.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Users\Admin\AppData\Roaming\screen\ROMFUSClient.exe
      C:\Users\Admin\AppData\Roaming\screen\ROMFUSClient.exe /tray
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1576
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3828
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2980
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2212
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3164
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5844
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5136
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5628
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5936
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3372
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5332
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2820
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5960
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5612
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2076
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:584
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3300
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4160
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3004
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3940
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5992
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1292
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4732
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:220
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3888
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2772
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:916
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4828
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3076
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5004
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5312
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5480
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:484
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5272
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2436
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5728
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3164
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5368
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3108
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5532
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2772
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3968
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:572
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5892
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5224
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3864
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:576
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2124
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3204
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3380
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:928
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:2304
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:3124
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:3696
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:2872
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:2520
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:4456
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:3056
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:4296
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:2112
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:4564
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:1576
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:2024
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:2212
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:3964
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:4484
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:6088
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:1984
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:1680
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:4360
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:4944
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:5420
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:1760
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:3216
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:4968
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:4560
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:4632
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:5068
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:1704
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:4996
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:5428
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:5336
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:2024
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:3416
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:688
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:2488
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:5484
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:3068
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:1060
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:2532
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:3940
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:3400
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:2548
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:4476
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:3728
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:1012
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:5444
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:5004
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:5448
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    PID:5972
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:2612
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:3184
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:4988
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:1336
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
    3⤵
    - Kills process with taskkill
    PID:5920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.xml

Path C:\Users\Admin\AppData\Roaming\screen\Config.xml
Size 164KB
SHA256 1198f6c0ad9847798211d4c7ccf7a843bda9014c998b33ddccb4da180d1a2461
MD5 2e395e8b4f2635c340e0dd47317c896f
SHA1 ef7d848aa82f17defc9eeab86bd2aec4be86a2d5
SHA512 acaa7ba3fefd55b427657ce37c96803d4dcdfe13b02cf82bbebf2a29fa706afdb9c92dcab2e486517ddd18215a3dc1020977fe57b370b885abfbcab66ee9096b
SSDEEP 1536:i3FatHmxa6a9/a6aH0afpa4ajOa4aQadaaaHa34acAacaawadaYaEbawaDNaoSa0:3ltwYqT9Nq
TLSH
T161F30279ADDF50BD2223EB517FD47DEFCA8FA677611DB8AA148103070612D80EB52938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.lg

Path C:\Users\Admin\AppData\Roaming\screen\English.lg
Size 87KB
SHA256 20db884523da62c20f80b8a3bb71e11091b90a443b83c06d8fe2a1bbc00c1c33
MD5 b1c96ef24061bf294cac6c4c9cbf7757
SHA1 5d1b1934091e257b5f1c69b13f5fc1e424348584
SHA512 6e90562fd804f91ddadef2310551063d34b859ff1cc6e58a41667e9cda062dca851c8455882ef47cf3e1a8ec21ebd9f0761f15e54174cc4a95427238cb39ba14
SSDEEP 768:YvozCzKUNNfMnuQhgdXT0Z2BPshK+4aCWpQJ3OEInKDcbztlXnpQbbMv3PI:Yvoz4TXTI2pQCWOJvgXnpQbS3PI
TLSH
T18193FE4227FD5208F5F76B94E9B990604E77BCE9AC38C21C5292005E66F1F85C8B2777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ROMFUSClient.exe

Path C:\Users\Admin\AppData\Roaming\screen\ROMFUSClient.exe
Size 6.0MB
SHA256 33d1a34fec88ce59beb756f5a274ff451caf171a755aae12b047e678929e8023
MD5 63d0964168b927d00064aa684e79a300
SHA1 b4b9b0e3d92e8a3cbe0a95221b5512ded14efb64
SHA512 894d8a25e9db3165e0daae521f36bbd6f9575d4f46a2597d13dec8612705634efea636a3c4165ba1f7ca3cdc4dc7d4542d0ea9987de10d2bc5a6ed9d6e05aecb
SSDEEP 98304:NwiA/GmKEt3LQ7V8z3uHWkd49GMdqOxaB:NOGmKEt31kd2dqwaB
TLSH
T16E56AF17F3C8613BD47B0B3A4477A7A46D3F7A606E1A8C2727F4294C8F36540692A787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ROMServer.exe

Path C:\Users\Admin\AppData\Roaming\screen\ROMServer.exe
Size 7.4MB
SHA256 162061884914970a39cb80ef274ee07b0d398fab509d7c9b5dffe911b6dfbc8d
MD5 d8736410aaf99290dd68a4de47578287
SHA1 9175342609136d65c5733751ad577bf1b9df329d
SHA512 f33893bf6b0160881ac073a505d44bd41aac36652bc100aea00368e2015a50d675137e4cb8fc88e510bfacc320fa936b4c0824afa300a8cd4e474b3d0fac4183
SSDEEP 98304:S4/WZQ7lc63BJGS1VFeIEll251o7+YcMBk2VVyN/RTfCEFIqOx9I:SXQ7SIEXeMBk2V4N/NqiIqw9I
TLSH
T136767D12B2C6603FD0AB1E365837A754693F7A702A198C1B67E4094CCF76F817A2E747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Russian.lg

Path C:\Users\Admin\AppData\Roaming\screen\Russian.lg
Size 92KB
SHA256 302373d81f0ae15589206420cb01a266804c9fd1c1ff0d6e09ce6ba3fef92b64
MD5 0e204fabe68b4b65ed5e0834651fb732
SHA1 b338a6e54aa18f3f8a573580520f16c74a51f3d2
SHA512 aad76f6a76dc693d959389ce471bc585d0da72737fed99f42f219fdc7c71617c00e8003a467092e12820a359d672c6fb80d99772f3f6433923b2abb7eea40f08
SSDEEP 768:r1kyTyZFOTb6QeZGJXYbFAMrKARuZk7FRwZoFTa2n:rn+2iZGhYbK4KARpAoFTa2n
TLSH
T1D093590BB7FC5204F0F6D750DA7AC4D105BBBDE86628C29C51CF282D2164BB1A6627E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

romlaunch.exe

Path C:\Users\Admin\AppData\Roaming\screen\romlaunch.exe
Size 136KB
SHA256 4abfecf8d07a86bb021440387cb667dfdc4ebcb5f073f0ee40972607aea28b30
MD5 c1143d1a0e59005adbbb04af0bafc834
SHA1 f923720e59a7b2b5d16cce5bb2f3c6bea96a598e
SHA512 d3c533c0a732c3b72c032075297fce002eaaf186d5c63cc4a7905d337f54bbdd516b01926b4a34fadbe8b9995b765f7d613365cdf094722de566dc71497e4bdb
SSDEEP 3072:Rjl5Lq8AX0YKaRtuLCRnX0AlczanQqp6lYWy:LouMtNl0A6e5Z
TLSH
T1F1D35A27B6A670FAE16BC934C9424901DB72BC765BA0ABDF07504ED60F236D09E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-60-0x000002096C750000-0x000002096C7BF000-memory.dmp

Download

memory/484-74-0x00000280DEE40000-0x00000280DEEAF000-memory.dmp

Download

memory/572-87-0x00000173DB7E0000-0x00000173DB84F000-memory.dmp

Download

memory/576-96-0x0000025DE1830000-0x0000025DE189F000-memory.dmp

Download

memory/584-47-0x000001EE8A880000-0x000001EE8A8EF000-memory.dmp

Download

memory/916-66-0x000002F41FB80000-0x000002F41FBEF000-memory.dmp

Download

memory/1084-38-0x0000000002E90000-0x0000000002F12000-memory.dmp

Download

memory/1084-48-0x0000000000400000-0x0000000000BF2000-memory.dmp

Download

memory/1084-17-0x00000000009F6000-0x00000000009F8000-memory.dmp

Download

memory/1084-90-0x0000000000400000-0x0000000000BF2000-memory.dmp

Download

memory/1084-18-0x0000000000400000-0x0000000000BF2000-memory.dmp

Download

memory/1084-34-0x00000000009F6000-0x00000000009F8000-memory.dmp

Download

memory/1084-27-0x0000000000400000-0x0000000000BF2000-memory.dmp

Download

memory/1084-36-0x0000000000400000-0x0000000000BF2000-memory.dmp

Download

memory/1084-24-0x0000000000400000-0x0000000000BF2000-memory.dmp

Download

memory/1084-37-0x0000000000400000-0x0000000000BF2000-memory.dmp

Download

memory/1292-56-0x0000024D37A90000-0x0000024D37AFF000-memory.dmp

Download

memory/1576-26-0x0000000000400000-0x0000000000A92000-memory.dmp

Download

memory/1900-84-0x0000028658110000-0x000002865817F000-memory.dmp

Download

memory/2028-62-0x0000023E14D30000-0x0000023E14D9F000-memory.dmp

Download

memory/2076-46-0x000001FBD8260000-0x000001FBD82CF000-memory.dmp

Download

memory/2124-98-0x00000232B2D70000-0x00000232B2DDF000-memory.dmp

Download

memory/2212-29-0x000002BCAC020000-0x000002BCAC08F000-memory.dmp

Download

memory/2436-76-0x000001DB6F4C0000-0x000001DB6F52F000-memory.dmp

Download

memory/2484-92-0x0000019EB0940000-0x0000019EB09AF000-memory.dmp

Download

memory/2592-94-0x0000017C04D90000-0x0000017C04DFF000-memory.dmp

Download

memory/2744-45-0x000001DBD6560000-0x000001DBD65CF000-memory.dmp

Download

memory/2772-85-0x000001E9D9920000-0x000001E9D998F000-memory.dmp

Download

memory/2772-65-0x00000262D45C0000-0x00000262D462F000-memory.dmp

Download

memory/2820-41-0x000001DCB3BA0000-0x000001DCB3C0F000-memory.dmp

Download

memory/2980-28-0x0000015C1E230000-0x0000015C1E29F000-memory.dmp

Download

memory/3004-53-0x000001F25FB30000-0x000001F25FB9F000-memory.dmp

Download

memory/3076-70-0x0000025599900000-0x000002559996F000-memory.dmp

Download

memory/3108-82-0x000002D734760000-0x000002D7347CF000-memory.dmp

Download

memory/3164-78-0x0000019221B40000-0x0000019221BAF000-memory.dmp

Download

memory/3164-30-0x0000023941E20000-0x0000023941E8F000-memory.dmp

Download

memory/3204-99-0x00000210ADB00000-0x00000210ADB6F000-memory.dmp

Download

memory/3300-51-0x0000019E5C150000-0x0000019E5C1BF000-memory.dmp

Download

memory/3372-39-0x0000025067400000-0x000002506746F000-memory.dmp

Download

memory/3828-19-0x000002A454320000-0x000002A45438F000-memory.dmp

Download

memory/3864-95-0x00000279C1BB0000-0x00000279C1C1F000-memory.dmp

Download

memory/3888-63-0x0000022102F70000-0x0000022102FDF000-memory.dmp

Download

memory/3940-54-0x00000270D6880000-0x00000270D68EF000-memory.dmp

Download

memory/3968-86-0x000001DFC5740000-0x000001DFC57AF000-memory.dmp

Download

memory/4160-52-0x000002855A2B0000-0x000002855A31F000-memory.dmp

Download

memory/4204-89-0x0000015D8ABF0000-0x0000015D8AC5F000-memory.dmp

Download

memory/4336-44-0x0000022AF4AA0000-0x0000022AF4B0F000-memory.dmp

Download

memory/4592-50-0x00000283F1170000-0x00000283F11DF000-memory.dmp

Download

memory/4692-64-0x0000017485B80000-0x0000017485BEF000-memory.dmp

Download

memory/4708-97-0x000002B398B00000-0x000002B398B6F000-memory.dmp

Download

memory/4732-57-0x0000022B15800000-0x0000022B1586F000-memory.dmp

Download

memory/4828-67-0x0000025C975D0000-0x0000025C9763F000-memory.dmp

Download

memory/4852-61-0x0000027F735B0000-0x0000027F7361F000-memory.dmp

Download

memory/5004-71-0x000001D535770000-0x000001D5357DF000-memory.dmp

Download

memory/5136-32-0x0000026E83440000-0x0000026E834AF000-memory.dmp

Download

memory/5224-93-0x000001F932590000-0x000001F9325FF000-memory.dmp

Download

memory/5272-75-0x0000025069D10000-0x0000025069D7F000-memory.dmp

Download

memory/5312-72-0x0000017BFD880000-0x0000017BFD8EF000-memory.dmp

Download

memory/5332-40-0x0000023525950000-0x00000235259BF000-memory.dmp

Download

memory/5368-81-0x000002DEBE7D0000-0x000002DEBE83F000-memory.dmp

Download

memory/5480-73-0x000001FB22FE0000-0x000001FB2304F000-memory.dmp

Download

memory/5532-83-0x000001FCCB100000-0x000001FCCB16F000-memory.dmp

Download

memory/5612-43-0x0000016F8E2A0000-0x0000016F8E30F000-memory.dmp

Download

memory/5628-33-0x0000027608DD0000-0x0000027608E3F000-memory.dmp

Download

memory/5728-77-0x0000023001CF0000-0x0000023001D5F000-memory.dmp

Download

memory/5844-31-0x000001A113830000-0x000001A11389F000-memory.dmp

Download

memory/5892-88-0x0000019926AC0000-0x0000019926B2F000-memory.dmp

Download

memory/5936-35-0x000001901ACE0000-0x000001901AD4F000-memory.dmp

Download

memory/5960-42-0x0000025F51D40000-0x0000025F51DAF000-memory.dmp

Download

memory/5992-55-0x000002316DF80000-0x000002316DFEF000-memory.dmp

Download