agenttesla | 35359cb734c354cee6252a34a02891fa6c499b9387b06694b573bfa31230a91a

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_5bbecdb932c4c1bd576b298c42f37074_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos.exe
Size 1.3MB
Sample260716-eajwyacv8r
SHA256 35359cb734c354cee6252a34a02891fa6c499b9387b06694b573bfa31230a91a
MD5 5bbecdb932c4c1bd576b298c42f37074
SHA1 555d81153857286162c85888739ba9de25c1043d
SHA512 fd602d422718ac66a9fcdbd9b0357f13f55bccf04291c092c2dec5eb8f8e92e1dc88ce6168590620c859384e824a0bd2a7ddbc0a5afbfaf52efd12070c92630a
SSDEEP 24576:dAHnh+eWsN3skA4RV1Hom2KXMmHaOpOfjJI6K9ioqHXq2Zi5:8h+ZkldoPK8YaOpII6K9ioqHXqR
TLSH
T12E55BE0273D19076FFAB92735B7AB64946BD7D294133841F12983D79BA701B2233E623
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Attributes

app_add_startup
false
delete_backspace
false
enable_clipboard_logger
false
enable_contacts
false
enable_cookies
false
enable_keylogger
false
enable_screen_logger
false
enable_torpanel
false
hide_file_startup
false
keylogger_interval
20
log_type
1
pc_state
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
public_ip_address_grab
false
public_user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
screen_interval
20
smtp_attach
false
smtp_ssl
true
startup_directory_name
ugFvXz
startup_env_name
appdata
startup_installation_name
ugFvXz.exe
startup_reg_name
ugFvXz
tor_pid
false

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 63 IoCs

resource	yara_rule
behavioral2/memory/3712-14-0x0000000003160000-0x00000000031B4000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-17-0x0000000005820000-0x0000000005872000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-20-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-30-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-34-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-48-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-52-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-54-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-64-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-76-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-90-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-100-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-110-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-114-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-28-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-19-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-138-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-136-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-134-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-132-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-130-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-128-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-126-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-124-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-122-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-120-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-118-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-46-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-45-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-39-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-116-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-112-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-108-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-106-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-104-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-102-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-99-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-96-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-94-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-92-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-88-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-87-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-84-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-82-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-80-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-78-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-74-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-72-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-70-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-68-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-66-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-62-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-60-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-58-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-56-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-50-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-43-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-41-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-37-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-32-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-26-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-24-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral2/memory/3712-22-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 63 IoCs

resource	yara_rule
behavioral2/memory/3712-14-0x0000000003160000-0x00000000031B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-17-0x0000000005820000-0x0000000005872000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-20-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-30-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-34-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-48-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-52-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-54-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-64-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-76-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-90-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-100-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-110-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-114-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-28-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-19-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-138-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-136-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-134-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-132-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-130-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-128-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-126-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-124-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-122-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-120-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-118-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-46-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-45-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-39-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-116-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-112-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-108-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-106-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-104-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-102-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-99-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-96-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-94-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-92-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-88-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-87-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-84-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-82-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-80-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-78-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-74-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-72-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-70-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-68-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-66-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-62-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-60-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-58-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-56-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-50-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-43-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-41-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-37-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-32-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-26-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-24-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3712-22-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 63 IoCs

resource	yara_rule
behavioral2/memory/3712-14-0x0000000003160000-0x00000000031B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-17-0x0000000005820000-0x0000000005872000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-20-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-30-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-34-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-48-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-52-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-54-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-64-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-76-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-90-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-100-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-110-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-114-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-28-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-19-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-138-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-136-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-134-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-132-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-130-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-128-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-126-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-124-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-122-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-120-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-118-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-46-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-45-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-39-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-116-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-112-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-108-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-106-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-104-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-102-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-99-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-96-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-94-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-92-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-88-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-87-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-84-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-82-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-80-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-78-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-74-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-72-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-70-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-68-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-66-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-62-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-60-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-58-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-56-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-50-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-43-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-41-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-37-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-32-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-26-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-24-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/3712-22-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 63 IoCs

resource	yara_rule
behavioral2/memory/3712-14-0x0000000003160000-0x00000000031B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-17-0x0000000005820000-0x0000000005872000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-20-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-30-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-34-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-48-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-52-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-54-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-64-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-76-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-90-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-100-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-110-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-114-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-28-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-19-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-138-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-136-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-134-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-132-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-130-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-128-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-126-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-124-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-122-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-120-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-118-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-46-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-45-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-39-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-116-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-112-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-108-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-106-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-104-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-102-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-99-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-96-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-94-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-92-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-88-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-87-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-84-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-82-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-80-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-78-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-74-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-72-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-70-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-68-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-66-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-62-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-60-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-58-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-56-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-50-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-43-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-41-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-37-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-32-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-26-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-24-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3712-22-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information steale 63 IoCs

resource	yara_rule
behavioral2/memory/3712-14-0x0000000003160000-0x00000000031B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-17-0x0000000005820000-0x0000000005872000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-20-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-30-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-34-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-48-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-52-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-54-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-64-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-76-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-90-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-100-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-110-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-114-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-28-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-19-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-138-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-136-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-134-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-132-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-130-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-128-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-126-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-124-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-122-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-120-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-118-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-46-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-45-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-39-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-116-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-112-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-108-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-106-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-104-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-102-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-99-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-96-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-94-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-92-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-88-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-87-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-84-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-82-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-80-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-78-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-74-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-72-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-70-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-68-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-66-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-62-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-60-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-58-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-56-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-50-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-43-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-41-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-37-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-32-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-26-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-24-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3712-22-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 63 IoCs

resource	yara_rule
behavioral2/memory/3712-14-0x0000000003160000-0x00000000031B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-17-0x0000000005820000-0x0000000005872000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-20-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-30-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-34-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-48-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-52-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-54-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-64-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-76-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-90-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-100-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-110-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-114-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-28-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-19-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-138-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-136-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-134-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-132-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-130-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-128-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-126-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-124-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-122-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-120-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-118-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-46-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-45-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-39-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-116-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-112-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-108-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-106-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-104-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-102-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-99-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-96-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-94-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-92-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-88-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-87-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-84-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-82-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-80-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-78-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-74-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-72-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-70-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-68-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-66-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-62-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-60-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-58-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-56-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-50-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-43-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-41-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-37-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-32-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-26-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-24-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3712-22-0x0000000005820000-0x000000000586D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5892 set thread context of 3712	5892	2026-07-16_5bbecdb932c4c1bd576b298c42f37074_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_5bbecdb932c4c1bd576b298c42f37074_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3712	RegSvcs.exe
3712	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5892	2026-07-16_5bbecdb932c4c1bd576b298c42f37074_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3712	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5892	2026-07-16_5bbecdb932c4c1bd576b298c42f37074_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos.exe
5892	2026-07-16_5bbecdb932c4c1bd576b298c42f37074_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5892	2026-07-16_5bbecdb932c4c1bd576b298c42f37074_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos.exe
5892	2026-07-16_5bbecdb932c4c1bd576b298c42f37074_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5892 wrote to memory of 3712	5892	2026-07-16_5bbecdb932c4c1bd576b298c42f37074_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos.exe	87

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-16_5bbecdb932c4c1bd576b298c42f37074_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_5bbecdb932c4c1bd576b298c42f37074_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5892
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-16_5bbecdb932c4c1bd576b298c42f37074_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  PID:3712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3712-9-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3712-11-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3712-10-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3712-12-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3712-13-0x0000000073CA2000-0x0000000073CA3000-memory.dmp

Download

memory/3712-14-0x0000000003160000-0x00000000031B4000-memory.dmp

Download

memory/3712-15-0x0000000073C90000-0x000000007444C000-memory.dmp

Download

memory/3712-16-0x0000000005DE0000-0x000000000639A000-memory.dmp

Download

memory/3712-17-0x0000000005820000-0x0000000005872000-memory.dmp

Download

memory/3712-18-0x0000000073C90000-0x000000007444C000-memory.dmp

Download

memory/3712-20-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-30-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-34-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-48-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-52-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-54-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-64-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-76-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-90-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-100-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-110-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-114-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-28-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-19-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-138-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-136-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-134-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-132-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-130-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-128-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-126-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-124-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-122-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-120-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-118-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-46-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-45-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-39-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-116-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-112-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-108-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-106-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-104-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-102-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-99-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-96-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-94-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-92-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-88-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-87-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-84-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-82-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-80-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-78-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-74-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-72-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-70-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-68-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-66-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-62-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-60-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-58-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-56-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-50-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-43-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-41-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-37-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-32-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-26-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-24-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-22-0x0000000005820000-0x000000000586D000-memory.dmp

Download

memory/3712-1050-0x0000000005A30000-0x0000000005A96000-memory.dmp

Download

memory/3712-1049-0x0000000073C90000-0x000000007444C000-memory.dmp

Download

memory/3712-1051-0x00000000069A0000-0x00000000069F0000-memory.dmp

Download

memory/3712-1052-0x0000000006A90000-0x0000000006B22000-memory.dmp

Download

memory/3712-1053-0x00000000069F0000-0x00000000069FA000-memory.dmp

Download

memory/3712-1054-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3712-1055-0x0000000073CA2000-0x0000000073CA3000-memory.dmp

Download

memory/3712-1056-0x0000000073C90000-0x000000007444C000-memory.dmp

Download

memory/5892-8-0x0000000001080000-0x0000000001084000-memory.dmp

Download