c221db5e27c1145267e391f447ff9e877eef8de06f2b710abe06e0d190dea966

Analysis

max time kernel
150s
max time network
38s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 154KB
Sample260723-lacaesba68
SHA256 c221db5e27c1145267e391f447ff9e877eef8de06f2b710abe06e0d190dea966
MD5 31ff923ab2b5ad0c112a9e5823c377f9
SHA1 7538802d09cf914a75b8e8507134ac734676210c
SHA512 6640484712c42d88e005f9c5fb62c14e63dd81f4cee9ca3530a08c5895309e2b7f39de24edad251b7dcc5c1f65a7d3704b26cfbe700bff6b0d66da285ae26289
SSDEEP 3072:Cg7GRS4aEklpQQW/cgFXNJrfXWBcOyG/ON2ehjuX3KGEOj:Co4aEKpQUgX6LehKrE
TLSH
T160F35B4772E530F9E1778638C8A14616FB7378764B609B9F07A442795F23390AE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2128	powershell.exe
3488	powershell.exe
4164	powershell.exe
4164	powershell.exe
2128	powershell.exe
3488	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe\" --persisted --silent"	2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe\" --persisted --silent"	2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2128	powershell.exe
2128	powershell.exe
3488	powershell.exe
3488	powershell.exe
4164	powershell.exe
4164	powershell.exe
3488	powershell.exe
4164	powershell.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1216	2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2128	powershell.exe
Token: SeIncreaseQuotaPrivilege	2128	powershell.exe
Token: SeSecurityPrivilege	2128	powershell.exe
Token: SeTakeOwnershipPrivilege	2128	powershell.exe
Token: SeLoadDriverPrivilege	2128	powershell.exe
Token: SeSystemProfilePrivilege	2128	powershell.exe
Token: SeSystemtimePrivilege	2128	powershell.exe
Token: SeProfSingleProcessPrivilege	2128	powershell.exe
Token: SeIncBasePriorityPrivilege	2128	powershell.exe
Token: SeCreatePagefilePrivilege	2128	powershell.exe
Token: SeBackupPrivilege	2128	powershell.exe
Token: SeRestorePrivilege	2128	powershell.exe
Token: SeShutdownPrivilege	2128	powershell.exe
Token: SeDebugPrivilege	2128	powershell.exe
Token: SeSystemEnvironmentPrivilege	2128	powershell.exe
Token: SeRemoteShutdownPrivilege	2128	powershell.exe
Token: SeUndockPrivilege	2128	powershell.exe
Token: SeManageVolumePrivilege	2128	powershell.exe
Token: 33	2128	powershell.exe
Token: 34	2128	powershell.exe
Token: 35	2128	powershell.exe
Token: 36	2128	powershell.exe
Token: SeIncreaseQuotaPrivilege	2128	powershell.exe
Token: SeSecurityPrivilege	2128	powershell.exe
Token: SeTakeOwnershipPrivilege	2128	powershell.exe
Token: SeLoadDriverPrivilege	2128	powershell.exe
Token: SeSystemProfilePrivilege	2128	powershell.exe
Token: SeSystemtimePrivilege	2128	powershell.exe
Token: SeProfSingleProcessPrivilege	2128	powershell.exe
Token: SeIncBasePriorityPrivilege	2128	powershell.exe
Token: SeCreatePagefilePrivilege	2128	powershell.exe
Token: SeBackupPrivilege	2128	powershell.exe
Token: SeRestorePrivilege	2128	powershell.exe
Token: SeShutdownPrivilege	2128	powershell.exe
Token: SeDebugPrivilege	2128	powershell.exe
Token: SeSystemEnvironmentPrivilege	2128	powershell.exe
Token: SeRemoteShutdownPrivilege	2128	powershell.exe
Token: SeUndockPrivilege	2128	powershell.exe
Token: SeManageVolumePrivilege	2128	powershell.exe
Token: 33	2128	powershell.exe
Token: 34	2128	powershell.exe
Token: 35	2128	powershell.exe
Token: 36	2128	powershell.exe
Token: SeDebugPrivilege	3488	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeIncreaseQuotaPrivilege	3488	powershell.exe
Token: SeSecurityPrivilege	3488	powershell.exe
Token: SeTakeOwnershipPrivilege	3488	powershell.exe
Token: SeLoadDriverPrivilege	3488	powershell.exe
Token: SeSystemProfilePrivilege	3488	powershell.exe
Token: SeSystemtimePrivilege	3488	powershell.exe
Token: SeProfSingleProcessPrivilege	3488	powershell.exe
Token: SeIncBasePriorityPrivilege	3488	powershell.exe
Token: SeCreatePagefilePrivilege	3488	powershell.exe
Token: SeBackupPrivilege	3488	powershell.exe
Token: SeRestorePrivilege	3488	powershell.exe
Token: SeShutdownPrivilege	3488	powershell.exe
Token: SeDebugPrivilege	3488	powershell.exe
Token: SeSystemEnvironmentPrivilege	3488	powershell.exe
Token: SeRemoteShutdownPrivilege	3488	powershell.exe
Token: SeUndockPrivilege	3488	powershell.exe
Token: SeManageVolumePrivilege	3488	powershell.exe
Token: 33	3488	powershell.exe
Token: 34	3488	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 2128	1216	2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	88
PID 2984 wrote to memory of 3488	2984	2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	96
PID 612 wrote to memory of 4164	612	2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	97
PID 1216 wrote to memory of 5280	1216	2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	100
PID 2984 wrote to memory of 6004	2984	2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	105
PID 612 wrote to memory of 4924	612	2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ExclusionProcess 'Implant.exe';Set-MpPreference -DisableRealtimeMonitoring $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Windows\SYSTEM32\cmd.exe
  cmd
  2⤵
  PID:5280

C:\Users\Admin\AppData\Local\Temp\2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
C:\Users\Admin\AppData\Local\Temp\2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ExclusionProcess 'Implant.exe';Set-MpPreference -DisableRealtimeMonitoring $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3488
- C:\Windows\SYSTEM32\cmd.exe
  cmd
  2⤵
  PID:6004

C:\Users\Admin\AppData\Local\Temp\2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_31ff923ab2b5ad0c112a9e5823c377f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe" --persisted --silent
1⤵
- Suspicious use of WriteProcessMemory
PID:612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ExclusionProcess 'Implant.exe';Set-MpPreference -DisableRealtimeMonitoring $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4164
- C:\Windows\SYSTEM32\cmd.exe
  cmd
  2⤵
  PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 749a4be547891f8802d5182f4420e750fa106b6095b0780cd7ada3aae5d506da
MD5 fdf32c687308e1520890d4c6141bd3b4
SHA1 86da52f43d64cbde65dd3eda21225df2f1abfd94
SHA512 8087ed4ffacde3210ffecae682a2cf38db97d51ef8097b7fa7bcd4b8cb4f7199506dc94f4cad783d146500aeb428c21b7db2c38bd6ad4957cb22535613aa55e2
TLSH
T11D216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jo4vxmnw.nhz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jo4vxmnw.nhz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

implant_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\implant_debug.txt
Size 1KB
SHA256 e17c06571d8655c29151a705c8a27597d0fdcbbecb209ac6e29c5234cc705fa5
MD5 65879e7b142197bf5cd8e471ddc7f751
SHA1 bfec12b33e10a11e284015984bbd3d6df8a305e9
SHA512 79a81cda5256bb3570f1062e3917cfa9cc670f686c096feee6ca62c1e5264010d281a424a016ea1709d23791137bce163941601be0b1af734b38fe0f76ea46de
TLSH
T14B21C13581E95ABA6A68708F311485E6D3993E147F5D3710B3EAEC1C30D340EF5EE166
MD5 SHA1 SHA512 TLSH

Submit Download

implant_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\implant_debug.txt
Size 1KB
SHA256 f5fbe2557d830a8aacff3f2a7c2ef242a1a0570a7fa29d2f5abe4572c2eeca30
MD5 2ebf8b57d7d81504d6f72669492c1baa
SHA1 eb740e5a3d3906ea16491f3383a9d8d672214aed
SHA512 e1480f97dd33d997b12e39ef25a37a4937b12c7ee55d60b9d507e44a3b939b6a0f1fd40d3794f67bd90d70369b957068e150f663e88bd80d1c271197d5149c78
TLSH
T15521AE3581E95ABA6A6970CF311485D6D3893E14BF6D3710B3EAEC2C30D340EE5AE156
MD5 SHA1 SHA512 TLSH

Submit Download

implant_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\implant_debug.txt
Size 1KB
SHA256 9a36e78b2922c6753865197ac252bf9fbca4444cf1953823e376451456828fbb
MD5 68585a71a6926cda71ca329b864e4c59
SHA1 95839c7525984c6dcae2644a213dd2198ce403c9
SHA512 e8d62007799212188e2f40179f1340a8e625d7cd3de0145ff32b9e6d7b9c822a6608a55a34d908c39c83923abedb41dc83968a691f8049fed341ace67aef0cba
TLSH
T1B031AF3181E95BA92E6970CF311485D6D2493E14BFAD3710B3DDEC2C30D340EE5AD155
MD5 SHA1 SHA512 TLSH

Submit Download

implant_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\implant_debug.txt
Size 1KB
SHA256 4f26091da85055e97cd734aa35b7373d79ea4661d00d8b40d705a3f6a41fd734
MD5 2341ba2f83c8251bf24f2389ca19602c
SHA1 bcbbc63abd233c0d66df03434636d2530adfd721
SHA512 2da80ececd3e6ca98ec5c283702903a04d5eddb47b00a3aac9ccda27df40955f7a513932c5059ca53ad0419c5d0fdc6bd9bc36e8b9c9909836e36b70be48538e
TLSH
T14931AE3581A95AB96E64B0CF311486D6E3492E10BF6D3710B3EEE82C30D300EE5AE169
MD5 SHA1 SHA512 TLSH

Submit Download

implant_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\implant_debug.txt
Size 1KB
SHA256 85e626cbf69e505ff86040923c9a3720da60c900bb22731219a8e80ba572ae2b
MD5 69b0a6104dc72a2ad6dca8b27430f095
SHA1 84201aefae6198ba8d040d093cd891057ad421e5
SHA512 359ab29a63d40d70aab9bb6fae1ebb212d2069880d5eb1b83c9274dde6f0e8871dff7cb7ba2a5bb077a152f93f9ee387563712c6c0188502a0f008322af8785b
TLSH
T18931C23581A95AF96E64B0CF711446D6E3492E10BF6D3210B3EEEC6C30E700EE5AE169
MD5 SHA1 SHA512 TLSH

Submit Download

implant_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\implant_debug.txt
Size 1KB
SHA256 eed81774a72e958156ea8a5d6a7a2debb99f42bb97582fb808ad7aeabf9abdff
MD5 cf086bbd080e3984689aa6fab3aedc51
SHA1 2d88bf4dadd015377e87f36f79e5629bef812fdf
SHA512 13957ae623199902a393ab77b9ea8dc4786ae236e9a8977d5b7f6dc5c911e79ac6f339774b17254da574d0ba0d5706990dbfd4abc681f256b42ec90fe47f4e05
TLSH
T18B31C23482A95AF96F64B0CB710445D6E3492E10BF6D3650B3DEE86C30E700EE4AE169
MD5 SHA1 SHA512 TLSH

Submit Download

implant_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\implant_debug.txt
Size 1KB
SHA256 4ff1e5720437a4152b8905ae5e52e6e41ac0a1c2278779e8b505ec87e3da095f
MD5 ac0cb698689f680f541e99d2a30da262
SHA1 7e1cf56e9c30f933b45080c0f2cd7b93710e74bb
SHA512 6b6d2966afa62c6550e829b9a96a2d2b2e1edf7d089d4e2b0f345e32e56cc3b4e3510b8e294668c9e7a2050477d5e096b5b56bd7f13a160497fda09f4ae6263e
TLSH
T10B41D33482A95AF96F59B0CB310445D6E3492E10BF6D3650B3DAE96C30E700EE0AE16A
MD5 SHA1 SHA512 TLSH

Submit Download

implant_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\implant_debug.txt
Size 1KB
SHA256 ce98125c4671213d2e75fecf65fb9455fd0335a78cdc77c1f868cdd3483850c3
MD5 9c063f1639b71c3b2670aec064e09e0e
SHA1 05c812bcd881a26c500ce3d0aadf2410fab44581
SHA512 b7c553e39f760a0fae1f1e04c5d2da17639b67a0d7cc91198f4f963a7782c2042c4aaf9386ea4b4e1a6c91775b54261cb98a7fe04c99c0cd88cbd3c8761faa43
TLSH
T19741D33482AD5AF96F99B0CB310445D6E3497E10BF6D3650B3DAD96C30E700EE0AE166
MD5 SHA1 SHA512 TLSH

Submit Download

implant_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\implant_debug.txt
Size 1KB
SHA256 8eeebd35d09d92a2d27e9e2713a8ac7d71e94ec299f9d6c5f33466e9174cfc55
MD5 4a30d5f004094f385fb1de00c0f5ae3b
SHA1 be558c9251de338bc979551d89393cfeed66931f
SHA512 4a5a0443c77d5314627feb5db549e909ecd03311d3f85be5a11e9550c4baadf3d5316af376507a2ab633c09275591adf97048ea9c2e1d6c0a6fbd4c11841c79e
TLSH
T13A41E23482AD5BFD2F59B0CB310445D6E3496E10BF6D3650B3D9D96C30E700EE0AE56A
MD5 SHA1 SHA512 TLSH

Submit Download

implant_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\implant_debug.txt
Size 2KB
SHA256 733b78965a52e609c87b8e39dfa29692c4534ed47a53aba2df10e4fd7c79cf1c
MD5 8684a30925ad7a487d32142e88a37ea0
SHA1 fc1a0de522a00263d806209e79b0a0bba5a28a9e
SHA512 a4004a17c6cdf57203776525112ba3575cd159e69cd910dc9a0d58b84f1ff5520226375725eacca50f7d5527b219ee0e102d45dc3df1cade59c716e9833d5168
TLSH
T16F41F33482AC27FE2F59B0CB310445D6E3496A10BF6D3550B3E9D96C30E700DE0BD56A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/612-92-0x00007FF758F40000-0x00007FF758F6D000-memory.dmp

Download

memory/1216-37-0x00000215532A0000-0x00000215532A1000-memory.dmp

Download

memory/1216-87-0x00007FF758F40000-0x00007FF758F6D000-memory.dmp

Download

memory/2128-17-0x00000168EF960000-0x00000168EF96A000-memory.dmp

Download

memory/2128-18-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/2128-26-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/2128-28-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/2128-24-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/2128-23-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/2128-22-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/2128-21-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/2128-5-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/2128-20-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/2128-19-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/2128-25-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/2128-4-0x00007FF914D7F000-0x00007FF914D80000-memory.dmp

Download

memory/2128-14-0x00000168EF940000-0x00000168EF95E000-memory.dmp

Download

memory/2128-16-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/2128-15-0x00000168EFA20000-0x00000168EFAD2000-memory.dmp

Download

memory/2128-11-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/2128-10-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/2128-6-0x00000168EF530000-0x00000168EF552000-memory.dmp

Download

memory/2128-7-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/2984-91-0x00007FF758F40000-0x00007FF758F6D000-memory.dmp

Download

memory/3488-54-0x000001F9410C0000-0x000001F941172000-memory.dmp

Download