lockbit | 180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38.exe
Size 691KB
Sample260702-e9v39abx9x
SHA256 180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38
MD5 5e1f61b9c1c27cad3b7a81c804ac7b86
SHA1 c1888ba296f57e87a84411ddfce3cabc4536b142
SHA512 cc3fb6954fe4d1754c816c9bbd05ba1ec320d2a71410993026c02137629edf5abb1d6b46ba45b6ce460f58b9d8e62214d9600785a79ef0571390db8779bc7c31
SSDEEP 12288:0LxxJniMoRpKP9W1u19Ol9tyHDdZIYTbviWYbn8wBNsavTduK14UqMs5XRhazKj:0LIJvyHDPVXahbnNBNgfUjs5Xuz
TLSH
T129E4DFADED0699A0C453F1BCFE0BB4D053157EA44F3AB2A7781915E20A738E43A753C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery lockbit ransomware stealer

Malware Config

Extracted

Path

C:\ProgramData\ReadMeForDecrypt.txt

lockbit

Ransom Note

~~~ You have been attacked by LockBit 5.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~ >>>>> You must pay us. Tor Browser link where the stolen infortmation will be published: http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion >>>>> What is the guarantee that we won't scam you? We are the oldest extortion gang on the planet and nothing is more important to us than our reputation. We are not a politically motivated group and want nothing but financial rewards for our work. If we defraud even one client, other clients will not pay us. In 5 years, not a single client has been left dissatisfied after making a deal with us. If you pay the ransom, we will fulfill all the terms we agreed upon during the negotiation process. Treat this situation simply as a paid training session for your system administrators, because it was the misconfiguration of your corporate network that allowed us to attack you. Our pentesting services should be paid for the same way you pay your system administrators' salaries. You can get more information about us on wikipedia https://en.wikipedia.org/wiki/LockBit >>>>> Warning! Do not delete or modify encrypted files, it will lead to irreversible problems with decryption of files! >>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you. They will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die. >>>>> When buying bitcoin, do not tell anyone the true purpose of the purchase. Some brokers, especially in the US, do not allow you to buy bitcoin to pay ransom. Communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for Donald Trump to win the election, buying bitcoin to participate in ICO and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. Also you can use adequate cryptocurrency brokers who do not ask questions for what you buy cryptocurrency. >>>>> After buying cryptocurrency from a broker, store the cryptocurrency on a cold wallet, such as https://electrum.org/ or any other cold cryptocurrency wallet, more details on https://bitcoin.org By paying the ransom from your personal cold cryptocurrency wallet, you will avoid any problems from regulators, police and brokers. >>>>> Don't be afraid of any legal consequences, you were very scared, that's why you followed all our instructions, it's not your fault if you are very scared. Not a single company that paid us has had issues. Any excuses are just for insurance company to not pay on their obligation. >>>>> You need to contact us via TOR sites with your personal ID Download and install Tor Browser https://www.torproject.org/ Write to the chat room and wait for an answer, we'll guarantee a response from us. If you need a unique ID for correspondence with us that no one will know about, ask it in the chat, we will generate a secret chat for you and give you ID via private one-time memos service, no one can find out this ID but you. Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack hundreds of companies around the world. Tor Browser link for chat with us: http://lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Your personal identifier to communicate with us ID: 8860A4A3F44571A48B4ACFF707242FA9 <<<<< >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Advertising: Want a lamborghini, a ferrari and lots of titty girls? Sign up and start your pentester billionaire journey in 5 minutes with us. http://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion After registration, you will receive the most flawless and reliable tools for encrypting almost all operating systems on the planet and a platform for negotiating with attacked companies. Version: ChuongDong v1.01 | x64

URLs

http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion
http://lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion
http://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion

Signatures

Family: Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Deletes itself 1 IoCs

pid	Process
4936	180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\ReadMeForDecrypt.txt	defrag.exe

Drops desktop.ini file(s) 31 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	defrag.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	defrag.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-204488895-2999877624-296153668-1000\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	defrag.exe
File opened for modification	C:\Program Files\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	defrag.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	defrag.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	defrag.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	defrag.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	defrag.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	defrag.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	defrag.exe
File opened for modification	C:\Users\Public\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	defrag.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	defrag.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	defrag.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	defrag.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	defrag.exe
File opened (read-only)	\??\G:	defrag.exe
File opened (read-only)	\??\L:	defrag.exe
File opened (read-only)	\??\N:	defrag.exe
File opened (read-only)	\??\F:	defrag.exe
File opened (read-only)	\??\Q:	defrag.exe
File opened (read-only)	\??\H:	defrag.exe
File opened (read-only)	\??\J:	defrag.exe
File opened (read-only)	\??\K:	defrag.exe
File opened (read-only)	\??\B:	defrag.exe
File opened (read-only)	\??\M:	defrag.exe
File opened (read-only)	\??\T:	defrag.exe
File opened (read-only)	\??\U:	defrag.exe
File opened (read-only)	\??\I:	defrag.exe
File opened (read-only)	\??\V:	defrag.exe
File opened (read-only)	\??\D:	defrag.exe
File opened (read-only)	\??\W:	defrag.exe
File opened (read-only)	\??\E:	defrag.exe
File opened (read-only)	\??\A:	defrag.exe
File opened (read-only)	\??\S:	defrag.exe
File opened (read-only)	\??\Z:	defrag.exe
File opened (read-only)	\??\X:	defrag.exe
File opened (read-only)	\??\R:	defrag.exe
File opened (read-only)	\??\Y:	defrag.exe
File opened (read-only)	\??\O:	defrag.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4936 set thread context of 2416	4936	180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38.exe	87

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar	defrag.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html.35121c5b631cac2c	defrag.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\ReadMeForDecrypt.txt	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\plugin.js.83b0828735a6d656	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\en-gb\ui-strings.js	defrag.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	defrag.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui	defrag.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.sig.9936bca4b46c5cdd	defrag.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\nl_FEMININE.pak	defrag.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Trust Protection Lists\Mu\Analytics.08d3ffc4e3d8c848	defrag.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-fr\ReadMeForDecrypt.txt	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\ui-strings.js.e37c029b05748b0b	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\it-it\ui-strings.js.f1c9e850836b3bb8	defrag.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-BR_FEMININE.pak	defrag.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\manifest.json.20bb75ef025747c8	defrag.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\TransparentAdvertisers	defrag.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png.b474e37858f20282	defrag.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\ReadMeForDecrypt.txt	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_removeme-default_18.svg.2b87e56f25cd5cdd	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_checkbox_unselected_18.svg	defrag.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README.txt.3a146c105100f170	defrag.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\edge_feedback\ReadMeForDecrypt.txt	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp.f4aa5b1a1cbb0c8b	defrag.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\az.pak.DATA.bd548b7b1ae01191	defrag.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README_en_GB.txt.28bb58569eb3a32c	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\tool-search-2x.png	defrag.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-gb\ReadMeForDecrypt.txt	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\ui-strings.js.cbbd492b17e979f9	defrag.exe
File created	C:\Program Files (x86)\Common Files\System\ado\en-US\ReadMeForDecrypt.txt	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviewers.gif.08d3ffc4e3d8c848	defrag.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ReadMeForDecrypt.txt	defrag.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\he-il\ReadMeForDecrypt.txt	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\vscroll-thumb.png	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_newfolder_dark_18.svg	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\selector.js.83b0828735a6d656	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\PlayStore_icon.svg	defrag.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo.56e7f15d1e83d350	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\ui-strings.js.56e7f15d1e83d350	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.0195ff147c9444cb	defrag.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\MEIPreload\ReadMeForDecrypt.txt	defrag.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml	defrag.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\ReadMeForDecrypt.txt	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\ui-strings.js	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\ui-strings.js.3a146c105100f170	defrag.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\warning.gif.125d5f1a0903d252	defrag.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe.sig.40bce0928d619212	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-hover_32.svg	defrag.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nl-nl\ReadMeForDecrypt.txt	defrag.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-cn\ReadMeForDecrypt.txt	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\ui-strings.js.cbbd492b17e979f9	defrag.exe
File created	C:\Program Files (x86)\Windows Media Player\uk-UA\ReadMeForDecrypt.txt	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\ui-strings.js	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pl-pl\ui-strings.js	defrag.exe
File created	C:\Program Files (x86)\Windows Media Player\en-US\ReadMeForDecrypt.txt	defrag.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_100_percent.pak.e46790b3a354c444	defrag.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\te_FEMININE.pak	defrag.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo.bdfc241a7cf50584	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\close.svg.0dfe2fcd12f949ca	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\ui-strings.js	defrag.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg	defrag.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\it-IT\WMPMediaSharing.dll.mui	defrag.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\edge_game_assist\ReadMeForDecrypt.txt	defrag.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\nb.pak	defrag.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe
2416	defrag.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4936	180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	defrag.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 2416	4936	180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38.exe	87
PID 4936 wrote to memory of 2416	4936	180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38.exe	87
PID 4936 wrote to memory of 2416	4936	180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38.exe	87
PID 4936 wrote to memory of 2416	4936	180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38.exe	87
PID 4936 wrote to memory of 2416	4936	180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38.exe	87
PID 4936 wrote to memory of 2416	4936	180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38.exe	87
PID 4936 wrote to memory of 2416	4936	180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38.exe	87

C:\Users\Admin\AppData\Local\Temp\180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38.exe
"C:\Users\Admin\AppData\Local\Temp\180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38.exe"
1⤵
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\system32\defrag.exe
  C:\Windows\system32\defrag.exe
  2⤵
  - Drops startup file
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Windows Credential Manager

T1555.004

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ad-selection-attestations.dat.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\AdSelectionAttestationsPreloaded\ad-selection-attestations.dat.DATA
Size 351B
SHA256 40fa50b01eae0ed95757c56ea9cee3c672612b6726a4da30c873da6fa873fc0d
MD5 8c77ed027aa02181865597e12fb0ff59
SHA1 d903f665e9966ea02da30622c164d97a520b9cba
SHA512 7e801e3c95f736071997669714bcefdf501ebc98bc7707c478380b54457c7f25b002c505d622a038af8451ed2c7ef7dceba2833aeadf7824df096a9fc2c64cb1
TLSH
T186E0C05089D599ACD796383CC708400014446436AFE843A67655408592E4CC8E9AAC78
MD5 SHA1 SHA512 TLSH

Submit Download

es-419.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\es-419.pak.DATA
Size 1.1MB
SHA256 81f007db293ba41aaf37b6a8bae0f540f84f2fa5aa7cd986a14d946f9d7279b5
MD5 9f22d4735c12d7e1e9f74b0ad6f4e825
SHA1 06219ecad46d1e4bd2b3f78db7ba6895d4d4cb29
SHA512 badb7ec949aa6b91d6bbf519227bdda30d8afd7ccc9c82aabc2f912320df9c7480ec7d25fe614920220f54697efdc15ce3f26d733100908761eb03e3ccad2e84
SSDEEP 24576:xASFmu2AGXfLGMJqa4CSvsvzIZukKU2kiAB:xAWEzcancBBiAB
TLSH
T1D235331C54D9C0BDF6A5851972F3B393DA9B2D744382872E4BFC8622288FF48C56E09D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kk.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\kk.pak.DATA
Size 1.7MB
SHA256 ac57c7ebc2b7651d42d1492d0b3655719c3bddb74ff0dda0744025a63f7959cf
MD5 6219b26316fb50287f3f71736c74cb88
SHA1 eb4f77da71f75da215a486fc587dc49049bdf061
SHA512 fc3468880973855a9c1f9d0c0c5087701189867be92afd318c23457ca1f3e678326e2be68a0c4ee2a77e39832c0c0b471445266d49c07e6fe9b67d1d7464e0cd
SSDEEP 49152:Ouk5/1lUk2khNJnz1Vwmdad5E8pqFujcRS:OuC/UTcjnzz488pAS
TLSH
T1DD85336AB3D7E84E0C92BC526D0CEF404BD1798816E1953C100C48E7BD6675F6EA7E8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\ms.pak.DATA
Size 1012KB
SHA256 3d2446f9ae3c51700bf152e6f35f41daabd2d63c017cc8b2267d37d2e2ec4be7
MD5 2caff653bff1aae6ebd949fa07fceda7
SHA1 a5b6508756c3279f1fa985615512372e85c1b2cb
SHA512 56a77bde37bc0e43ad854121306a9815e700059de9abc020faa9978a28ecf9a497755f3b768eb0174b45f5516a14fec4759195e8a099b78c9a93540c640c38ea
SSDEEP 24576:NNLKI437mIN9t8feOT83WAk81DrZ/0uG/AwjF7Ifzc7zs69XR7ph/+1o:GIGmIN9tmek8mAk8Zt/Q/AsF7uOz9XJN
TLSH
T1F425335E8AAAF1AD8FDB4A6FD534BF6C3D0609BB52368C8F9436131004E752F1D88476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\pt-PT.pak.DATA
Size 1.1MB
SHA256 3075bd58b3c073b9f44ffcebeb2f325a05ac72687743b933b3cfde18069699e0
MD5 b9d3d8be8feb0f55fcea8b48afca7f3a
SHA1 21e35646e23e7b344e05c222c62881f888119c55
SHA512 a291a8e9e061bafecced28d79eaeabc589f7835ac05d3283efe844d0c86c98d017ad74ab864a3d85aa5a015af61e2217930e500a4627d3dc650be4798c0d68d7
SSDEEP 24576:R6BM/J4araXq9RJjqPiyzseACkdUhuoIdBM0n+Z78DXCtRMAg:j/Nyq9RJjjdtQBknnegX+KF
TLSH
T1D73533BB256524BD31A885C5CAA7E6DCCABD9923290F260673F316E24AD0C70355FCD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tt.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\tt.pak.DATA
Size 1.6MB
SHA256 881f8ac0a7d430e97b9f88fc312c94d9da6ad25370ae093da40607873a054343
MD5 c172d1d358cf87347ea56f5fda282265
SHA1 dbc80814271c5b5ade3787a240a2483eed19dbef
SHA512 6d6843397e411aabdcfb386e4281d9d58fbec916fa58acb95ee71977b65fd5b5c2306aacfa7649200c64392f1eae5fec50bf532a725279a43c46a8125ecf503a
SSDEEP 49152:h5Hl5vPcVDXvwit85Xl6+exAMUbC603LiTvdsfF:hdl56r4u+mF3LsvGN
TLSH
T1768533CDBAC5DAB6CA600FBDB7A4CB300A0C8441B7DC5019E8FF9B51598146EAE21F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\uk.pak.DATA
Size 1.7MB
SHA256 79e1307a0bc9c01027188bd47ef0b99f393c3ac7b016e2fb778a0ab8cbc4e75f
MD5 eab1ad92d808a9b182447bb58ae95839
SHA1 84f97fc2a40496beaa1c5984dfc1a199f37f5015
SHA512 dc196d651c4859a6c3d75b679a2a8a93c18dddc2d452880adc7aaa988b26fbda0b679f41fa7b91b10abde3e8d1d1ee81b6080aec3716d76ea38f6a53f8d78da7
SSDEEP 24576:AxbQqp7wMgH0H29U3p/SS/GCgvRWMG71GmVKyRYjPgXn7kYLy7BqvPPn/YSqRej9:+bQa7wMg63g/Cgr9yGgHv3/4MjSZMpN
TLSH
T17F85338F4D2B6F72ADD36DE6FBA207415E9B116AA258C26482C6F5F3301E311FDC9805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\ur.pak.DATA
Size 1.5MB
SHA256 333dc2ce705bc529d01c7d84f6bdcf809ef723aa2c06577091cf9aa73345e683
MD5 826d50f4075205efab7dbc7663fa697d
SHA1 3739bc0358e14bacff8dd376e9c6d02129feb0c0
SHA512 ab21479d5041e65ccafcc87c9eaf9b5a08285a7401049c98c83c734064ff466d3201714cae60599f6b2bcf2063da1bf567b657aa825ab802d7151ca0da866295
SSDEEP 49152:dSf1gaS+B7je08LOWvMz7aZ5d3qIMn2G2:dSf1gaSojgLN5d3qIO0
TLSH
T12475338C29503BF31E2A239DB155A862465FE563C3F0FBE8374A0BF7B6097A54E06117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\vi.pak.DATA
Size 1.2MB
SHA256 a31fc16749fc4f1268d864717a4eb68decc1d1372abef9e4ebe7f64a01057967
MD5 823dfbb59b5063f561e68727ffe4459e
SHA1 bc6aceb27127ef505ce37e873565a278eb9848b4
SHA512 bbf7c9ed5eee5b22b0838ca4305bc6c203052d44b586403302f7190f6c53889f946c2183bccb2a3106ab969432293942797177ae4116654c8e08f5129bb72f60
SSDEEP 24576:KOSIPDgg6A3gFYDQYq8jQaDAkV8b1ebEarTqu/wNgwHyvADkTT9/zBbh5TL:KuB/wFkDBj1DAk8b1kb9/xmkTTnl5TL
TLSH
T1C845335F0828E9F3697786A034D451FFE4E229716A1B6F33579ED81423BBE9710608F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\zh-CN.pak.DATA
Size 859KB
SHA256 204438d8989b3a677ccade3a906645e7406a11ed668b1c2458d4467d7a918a9c
MD5 25365bbb5d076c2400e60d10c0561edb
SHA1 4f8962f875796a6ddca87426169533298932d37b
SHA512 47c92777372543d79724c1d8dc7c156709209b21cef383430bb0c9c585cd059abe304f1b3dcabd1055e00ca02d8b3161a4df5245b1df15efaf5b7e0080581173
SSDEEP 24576:ZPPRouLWn+BChDSSuxkmV7NNPQkL++wsCjIgi/HAXSJ:pZoBn+y3wJVokwVYIXc
TLSH
T1E01533ADEE522583C14C0EBCED1A82E6A52FC8554D46ABEDEF2587FD30C2D7A3502C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\icudtl.dat.DATA
Size 11.4MB
SHA256 7f9da4865839ac35643acefda45173bd3e8ccf106413d5fa1155e9ad78256b2b
MD5 06bce4047b9826503092ec2cb24ff893
SHA1 82945867bd383b6a3015c4d2234e59a073532a5f
SHA512 1d9b5b4de877c70a286c83338fbcddcfe70ed7b2fb5cd528204de4035b951f3129b6d25d1c937a938dfa5fdc700f124da5f3a70ceea3eb1b278787f4fecd4e9b
SSDEEP 196608:KactwrwaXK0+msGKQ29dD9pdHLb5xbXMAgddbNKkvf8SNOsIIBFl9vpt1Tox5W0T:KRAHFsRTLrdrbjoddJK08SNlxBF3NT4D
TLSH
T172C633C722C5CA22DE14EB49647475776C647FED7E3C7B732AC62A286738648107C38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_100_percent.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\msedge_100_percent.pak.DATA
Size 1.5MB
SHA256 a48087d40ec480e34e65cad18ff77dea384ccfc9203606ff49dd2aed667c4c81
MD5 4ac706b1dcfbb440f3903329851fd725
SHA1 f771c2bc010d7c8eed28c508e80c02295e7be4e7
SHA512 52882180390a26b07e64bff6a6c082ecf746ebf117c2a1a10b31deb559dcd2b5fb55e328b193d8f0206d0d723f37e5b990ba309477dc919cffc2bffb87c813a4
SSDEEP 24576:FfWCLx3jmXv7MtvW+bPMB/ebpuIcsyvQQTiA+5F60ZOJ4iL0MeHhjhOSxqp425z:9WCLx+7OWUKmbhcsuQQGvHvY4iLZeBto
TLSH
T1806533F70D9E4D824E8BCA800D719DA68BCF2109E6452D272C7775AC8C7E1161ABFC5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\cs.pak.DATA
Size 1.1MB
SHA256 f1669deaeba5e8d1187ca3f698d6521b4b0787d93dc5632bc9a7f9bdd3445cd7
MD5 9b4375fbcbffdeb06eb06fcb1b0f3973
SHA1 d6a4860ecbe5371d64712de7b89720d017187622
SHA512 7cd7ee4c59efa225ba8bc939fee4cd9038481f8d370a6bf7467b5afa1b259bc760d4f958b17d94504a2cc011369cfb259d04a93b873eb9c94345e7f75dc9fdca
SSDEEP 24576:er14nOTOFTec5Kf66X59SV9PxgNjHlc3nhEd6fgIk:F5Fac5Kflp9uPg5S3nhRfm
TLSH
T16D3533DF475200B926F437C3C5E262A3EA442E2563127B539668EEDB982431FE1FF458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cy.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\cy.pak.DATA
Size 1.1MB
SHA256 46491fa36f0195a47a6da7fe3eb54bf7643fc2c4089abbe111ffc945085a4e11
MD5 1e1818d096d1d06c8beef0da75ef3e7f
SHA1 195c54aac9e3ec52197abe7ed57d78d44224f2d0
SHA512 00e65cc037bdb1aeb8786ae2c9c6e362f4c03c849f362e55d6bd1cee1da75b0fccec27b72477248698549b9339705399517107c4a7f98ef02773bdeb60724bb0
SSDEEP 24576:FjG1039rtzmeCFebB1io70ipX6wQ1E+GtLiT:dG1YnzUeF1F0ipqwb+GK
TLSH
T1C63523F31E19DCEC7A5205914BA59ECCB30A1629F2027397D2BC55CDDF5A0ECE6BA084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr-CA.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\fr-CA.pak.DATA
Size 1.2MB
SHA256 cf788f1682f6c430690496668266948ac185936bc8c75262bd72c02b17c319ce
MD5 cd1573ee4a7afc8d5f7455a3e5d38180
SHA1 06a056d793df27ebf6ae709ef2efe0fd060214d9
SHA512 13c690b7323599dffa32a990839ebb693e9a3c7161cbf81b32d3fc0841a8bbf7b93d834b733507a5bca3ff5e818280b81d0ea36e36a7536df55833b5ac711003
SSDEEP 24576:IlYHf9IhMPfKeQHPdUPWdXSa/a42jfgR8SUXF29SUB3BHLSzuxqa2:j/91ZCdUudXSaU/XQ9DFBHLSzux52
TLSH
T19645330394287CF6EF8A194A3EBC60464F6FDF5A1639E72C2FCE61B0935660C719E548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\it.pak.DATA
Size 1.1MB
SHA256 1375f64a31d18219ee52d8501207eebc5e61b146d69299d3be28ed2434108606
MD5 f92e17110cdd332665e2c12151725511
SHA1 92e2bbe6b4020de4195aa36ef6da02bf67373fa9
SHA512 e7793f6f3631d2fdd8a1ff28cc2a87e911e2341612e9e86d9431181828ab87acc737afe138d1487aaa5b864d381138cac9c4c417d04be05c411f98431fe8d820
SSDEEP 24576:d6Ejd8oL0uQxSg3AUwaALJJXilsmwXylWmZt+UcQQBlE:TZ8oguQxSVUPALfSlstXlmZt+UTQ8
TLSH
T17335339EA890DCD61AE8D3556EC9A30F5FFD6578C1C0C62DD971341032A69CA88BB0DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\uk.pak.DATA
Size 1.7MB
SHA256 de8646ef1f4d62196e496d9da33729fb6b6348d5bb475438dfcc5f68e9ddf9f5
MD5 2c2e1bbc8d13b7548c49826285c01f32
SHA1 0e2d7e4f10d2d5c707f8c5627d77d4002b43e418
SHA512 9cd83ecfb4a5abf45a387c5add8fea3ec3d8c9dd1c684696d2cb5fbe0527ba12218094854eca355a5472af84ad67e79ddc6f320f3a5a4751b53f7e2d1e6ccb1d
SSDEEP 49152:xnQyhsoisCiQ8IfJLHqX5tBjD6l32gqxt4i9kft1:xQxcCiGRHMxHM32Hz19m7
TLSH
T1DF8533604C69E16B0DDE217C1AF1366B00694E53E4F867C60CD8E3EABDB512BD5F18B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\zh-TW.pak.DATA
Size 901KB
SHA256 8ac01ff35741529c29ecfbc23d80d27991c1f831ab32fb6539b896473dd28c45
MD5 623dd8d5c88a50db5141b85967fd9707
SHA1 01bcfcfb0503e20f7b559b1674ea494ec4d25f51
SHA512 118ac7aa541caa8db4e2d28663deabb601b68bad229af480b6ed1d0cf04b67d88ba7b46b84bc8fc6d229fda9be4100cfae58d20c660b5da92248dc893c91b59c
SSDEEP 24576:z4cpLeZ5irpFmZvt/uL+pYxKHo0AYAcqV0ja2Kor:zXLeZ5ypFmht/uL+pYxpLTl2Kor
TLSH
T169153311918BF99DC0DC63E3854A05032EE96EDEE24797D39A94FB7A913836278C0D4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe.manifest.3d2cc7815455a52a

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.manifest.3d2cc7815455a52a
Size 1KB
SHA256 f4f47f46b28a0ec1986cac85febef05d3d57a9073298d6cfcf13ade4d367c651
MD5 464ff0b6d524b72ba0e9a6c52a09a97c
SHA1 d8b753850114e5c0a496f8c1e59a3f822e54ca6c
SHA512 65512a47afc6646f82376e5038a6e0055b9008c4ffdd7d4082be24b309f82ac49dea5e966adb367a3cd7d871a38ad56f4698e08299897e9a91999a7ee0517d6d
TLSH
T13B31F8B1CE70A54CD153D1880B1729E620E7B38FB9D96091C5D9234C6C34D0A770881E
MD5 SHA1 SHA512 TLSH

Submit Download

ReadMeForDecrypt.txt

Path C:\ProgramData\ReadMeForDecrypt.txt
Size 4KB
SHA256 7395feb5d8b19685ecb4e0667ded08eb4a04270147fcd4e258c5b209d994c69b
MD5 dd3a7108cdcbfb036cf52c42696ce73b
SHA1 8f8b61329dcca2192eb130234b8f95ea5ab2ea3c
SHA512 1941cee615a934e20e276799a9f3853c46e0beb04e311c0f0a6c1b0e95670043d5ca4eb8f999eb835e6510fa5f67f648b349bb6b5aa8a261fd422f17d1c02fca
SSDEEP 96:m713ouruxnN8TMLdFMWpox5EgABzPnWKwDL7O3:mtouKN8IdOWpowgAl/QXE
TLSH
T12691951F670E137446D112A1327F98E5EB2B422C3221C2B92999D02D13BC67E4B3A5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2416-62-0x0000017C19670000-0x0000017C19671000-memory.dmp

Download

memory/2416-53-0x0000017C195D0000-0x0000017C195D1000-memory.dmp

Download

memory/2416-2284-0x0000000140000000-0x000000014013C000-memory.dmp

Download

memory/2416-64-0x0000017C19690000-0x0000017C19691000-memory.dmp

Download

memory/2416-29-0x0000017C17A20000-0x0000017C17A21000-memory.dmp

Download

memory/2416-28-0x0000017C17A10000-0x0000017C17A11000-memory.dmp

Download

memory/2416-27-0x0000017C17A00000-0x0000017C17A01000-memory.dmp

Download

memory/2416-26-0x0000017C179F0000-0x0000017C179F1000-memory.dmp

Download

memory/2416-25-0x0000017C179A0000-0x0000017C179A1000-memory.dmp

Download

memory/2416-24-0x0000000140000000-0x000000014013C000-memory.dmp

Download

memory/2416-30-0x0000017C17A30000-0x0000017C17A31000-memory.dmp

Download

memory/2416-31-0x0000017C17A40000-0x0000017C17A41000-memory.dmp

Download

memory/2416-32-0x0000017C17A50000-0x0000017C17A51000-memory.dmp

Download

memory/2416-33-0x0000017C17A60000-0x0000017C17A61000-memory.dmp

Download

memory/2416-34-0x0000017C17A70000-0x0000017C17A71000-memory.dmp

Download

memory/2416-35-0x0000017C17C50000-0x0000017C17C51000-memory.dmp

Download

memory/2416-36-0x0000017C19480000-0x0000017C19481000-memory.dmp

Download

memory/2416-37-0x0000017C194D0000-0x0000017C194D1000-memory.dmp

Download

memory/2416-38-0x0000017C194E0000-0x0000017C194E1000-memory.dmp

Download

memory/2416-39-0x0000017C194F0000-0x0000017C194F1000-memory.dmp

Download

memory/2416-41-0x0000017C19510000-0x0000017C19511000-memory.dmp

Download

memory/2416-40-0x0000017C19500000-0x0000017C19501000-memory.dmp

Download

memory/2416-42-0x0000017C19520000-0x0000017C19521000-memory.dmp

Download

memory/2416-43-0x0000017C19530000-0x0000017C19531000-memory.dmp

Download

memory/2416-44-0x0000017C19540000-0x0000017C19541000-memory.dmp

Download

memory/2416-45-0x0000017C19550000-0x0000017C19551000-memory.dmp

Download

memory/2416-46-0x0000017C19560000-0x0000017C19561000-memory.dmp

Download

memory/2416-47-0x0000017C19570000-0x0000017C19571000-memory.dmp

Download

memory/2416-48-0x0000017C19580000-0x0000017C19581000-memory.dmp

Download

memory/2416-49-0x0000017C19590000-0x0000017C19591000-memory.dmp

Download

memory/2416-50-0x0000017C195A0000-0x0000017C195A1000-memory.dmp

Download

memory/2416-51-0x0000017C195B0000-0x0000017C195B1000-memory.dmp

Download

memory/2416-52-0x0000017C195C0000-0x0000017C195C1000-memory.dmp

Download

memory/2416-63-0x0000017C19680000-0x0000017C19681000-memory.dmp

Download

memory/2416-54-0x0000017C195E0000-0x0000017C195E1000-memory.dmp

Download

memory/2416-55-0x0000017C19600000-0x0000017C19601000-memory.dmp

Download

memory/2416-56-0x0000017C19610000-0x0000017C19611000-memory.dmp

Download

memory/2416-57-0x0000017C19620000-0x0000017C19621000-memory.dmp

Download

memory/2416-58-0x0000017C19630000-0x0000017C19631000-memory.dmp

Download

memory/2416-59-0x0000017C19640000-0x0000017C19641000-memory.dmp

Download

memory/2416-60-0x0000017C19650000-0x0000017C19651000-memory.dmp

Download

memory/2416-61-0x0000017C19660000-0x0000017C19661000-memory.dmp

Download

memory/4936-19-0x0000026BA0200000-0x0000026BA0201000-memory.dmp

Download

memory/4936-11-0x0000026BA0030000-0x0000026BA0031000-memory.dmp

Download

memory/4936-5-0x0000026B9FFD0000-0x0000026B9FFD1000-memory.dmp

Download

memory/4936-8-0x0000026BA0000000-0x0000026BA0001000-memory.dmp

Download

memory/4936-23-0x00007FF67A0C0000-0x00007FF67A67C000-memory.dmp

Download

memory/4936-10-0x0000026BA0020000-0x0000026BA0021000-memory.dmp

Download

memory/4936-18-0x0000026BA01F0000-0x0000026BA01F1000-memory.dmp

Download

memory/4936-12-0x0000026BA0140000-0x0000026BA0141000-memory.dmp

Download

memory/4936-13-0x0000026BA0160000-0x0000026BA0161000-memory.dmp

Download

memory/4936-16-0x0000026BA01D0000-0x0000026BA01D1000-memory.dmp

Download

memory/4936-1-0x0000026B9FF90000-0x0000026B9FF91000-memory.dmp

Download

memory/4936-17-0x0000026BA01E0000-0x0000026BA01E1000-memory.dmp

Download

memory/4936-14-0x0000026BA0170000-0x0000026BA0171000-memory.dmp

Download

memory/4936-22-0x0000026BA0230000-0x0000026BA0231000-memory.dmp

Download

memory/4936-20-0x0000026BA0210000-0x0000026BA0211000-memory.dmp

Download

memory/4936-21-0x0000026BA0220000-0x0000026BA0221000-memory.dmp

Download

memory/4936-6-0x0000026B9FFE0000-0x0000026B9FFE1000-memory.dmp

Download

memory/4936-15-0x0000026BA0180000-0x0000026BA0181000-memory.dmp

Download

memory/4936-9-0x0000026BA0010000-0x0000026BA0011000-memory.dmp

Download

memory/4936-7-0x0000026B9FFF0000-0x0000026B9FFF1000-memory.dmp

Download

memory/4936-0-0x0000026B9FE60000-0x0000026B9FE61000-memory.dmp

Download

memory/4936-2-0x0000026B9FFA0000-0x0000026B9FFA1000-memory.dmp

Download

memory/4936-3-0x0000026B9FFB0000-0x0000026B9FFB1000-memory.dmp

Download

memory/4936-4-0x0000026B9FFC0000-0x0000026B9FFC1000-memory.dmp

Download