stealc | 03f173bc98e9510816591ed10fb01186ab0ea350deb7569a7b92d07924069712

Analysis

max time kernel
31s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 03:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_0f17ac0060a5a10d156da73b697dd7dc_cobalt-strike_icedid_satacom_vidar.exe
Size 18.0MB
Sample260728-dq5mxaal21
SHA256 03f173bc98e9510816591ed10fb01186ab0ea350deb7569a7b92d07924069712
MD5 0f17ac0060a5a10d156da73b697dd7dc
SHA1 63f99e341d6c52835ce75b492ed8f99c1afffba0
SHA512 6c946d3b2e3a3135dd0821cd1f7b3df794cf2946202bdeb45ba0c9466c588cac4aa6d6b4bafd0f9ce23176cd8179fae9a2bc8a694fbc975c5a920c82ed035fa4
SSDEEP 393216:bgntnLL//SB318VRooIWSIsQWTkRmKW6xbge:bYVz2hjQWTEmKWg
TLSH
T14617332162A331E0EAB2C774485BA549E3B3F27171515F9F625283C25E0F782FD8EA74
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

run discovery downloader stealc svcstealer installer persistence pyinstaller stealer

Malware Config

Extracted

Family

stealc

Botnet

http://196.251.107.163

rc4.plain

Extracted

Family

svcstealer

http://196.251.107.186/acovp/post.php
http://192.162.199.186/usovp/post.php
http://196.251.107.163/bioxp/post.php

Attributes

build_id
Dropped
srv_delay
1
srv_retry
1

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc
Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Detects executables containing URLs to raw contents of a Github gist 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c544-96.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2224-120-0x0000024566E50000-0x00000245670F4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables packed with ConfuserEx Mod 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c544-96.dat	INDICATOR_EXE_Packed_ConfuserEx
behavioral2/memory/2224-120-0x0000024566E50000-0x00000245670F4000-memory.dmp	INDICATOR_EXE_Packed_ConfuserEx

Downloads MZ/PE file 1 IoCs

flow	pid	Process
1	3020	explorer.exe

Executes dropped EXE 13 IoCs

pid	Process
4748	4hzwk0vo.exe
3800	jtxdrgxt.exe
5844	ikj45rhj.exe
4500	x9zfub15.exe
1480	7eg3g9n7.exe
4428	DE84.tmp.exe
5088	facbabfddebebcc.exe
4536	cryptsvcxwq.exe
1716	ikj45rhj.tmp
2224	HMC_2.3.exe
856	DE84.tmp.exe
1228	jtxdrgxt.exe
2468	7eg3g9n7.exe

Loads dropped DLL 1 IoCs

pid	Process
1716	ikj45rhj.tmp

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\facbabfddebebcc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\jtxdrgxt.exe\""	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\facbabfddebebcc = "\"C:\\ProgramData\\facbabfddebebcc.exe\""	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7eg3g9n7.exe"	7eg3g9n7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DE84.tmp.exe"	DE84.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DE84.tmp.exe"	DE84.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7eg3g9n7.exe"	7eg3g9n7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\cryptsvcxwq.exe"	4hzwk0vo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\facbabfddebebcc = "\"C:\\ProgramData\\facbabfddebebcc.exe\""	jtxdrgxt.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4716 set thread context of 5752	4716	2026-07-28_0f17ac0060a5a10d156da73b697dd7dc_cobalt-strike_icedid_satacom_vidar.exe	89
PID 4428 set thread context of 4416	4428	DE84.tmp.exe	59
PID 1480 set thread context of 4416	1480	7eg3g9n7.exe	59
PID 856 set thread context of 4416	856	DE84.tmp.exe	59
PID 2468 set thread context of 4416	2468	7eg3g9n7.exe	59

Drops file in Program Files directory 36 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\wmpshare.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe.tmp~	x9zfub15.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe.tmp~	x9zfub15.exe
File created	C:\Program Files (x86)\Internet Explorer\ielowutil.exe.tmp~	x9zfub15.exe
File created	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe.tmp~	x9zfub15.exe
File created	C:\Program Files (x86)\Windows Mail\wab.exe.tmp~	x9zfub15.exe
File created	C:\Program Files (x86)\Windows Media Player\wmprph.exe.tmp~	x9zfub15.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp~	x9zfub15.exe
File created	C:\Program Files (x86)\Internet Explorer\ieinstal.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\Windows Media Player\wmprph.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\Windows Mail\wabmig.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\Windows Mail\wab.exe.tmp~	x9zfub15.exe
File created	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe.tmp~	x9zfub15.exe
File created	C:\Program Files (x86)\Windows Media Player\wmplayer.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp~	x9zfub15.exe
File created	C:\Program Files (x86)\Internet Explorer\ExtExport.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe.tmp~	x9zfub15.exe
File created	C:\Program Files (x86)\Windows Media Player\setup_wm.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\Windows Media Player\wmplayer.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe.tmp~	x9zfub15.exe
File created	C:\Program Files\Windows Media Player\wmlaunch.exe.tmp~	x9zfub15.exe
File created	C:\Program Files (x86)\Windows Mail\wabmig.exe.tmp~	x9zfub15.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000d00000001c578-282.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ikj45rhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ikj45rhj.tmp

Inno Setup is an open-source installation builder for Windows applications. 5 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000d00000001c547-34.dat	innosetup
behavioral2/memory/5844-50-0x0000000000920000-0x0000000000A26000-memory.dmp	innosetup
behavioral2/memory/5844-182-0x0000000000920000-0x0000000000A26000-memory.dmp	innosetup
behavioral2/memory/2484-246-0x0000000000E00000-0x0000000000F06000-memory.dmp	innosetup
behavioral2/memory/2484-336-0x0000000000E00000-0x0000000000F06000-memory.dmp	innosetup

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3800	jtxdrgxt.exe
3800	jtxdrgxt.exe
4428	DE84.tmp.exe
4428	DE84.tmp.exe
1480	7eg3g9n7.exe
1480	7eg3g9n7.exe
4428	DE84.tmp.exe
4428	DE84.tmp.exe
1480	7eg3g9n7.exe
1480	7eg3g9n7.exe
856	DE84.tmp.exe
856	DE84.tmp.exe
856	DE84.tmp.exe
856	DE84.tmp.exe
2468	7eg3g9n7.exe
2468	7eg3g9n7.exe
2468	7eg3g9n7.exe
2468	7eg3g9n7.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3020	explorer.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe
Token: SeShutdownPrivilege	3020	explorer.exe
Token: SeCreatePagefilePrivilege	3020	explorer.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 5752	4716	2026-07-28_0f17ac0060a5a10d156da73b697dd7dc_cobalt-strike_icedid_satacom_vidar.exe	89
PID 4716 wrote to memory of 5752	4716	2026-07-28_0f17ac0060a5a10d156da73b697dd7dc_cobalt-strike_icedid_satacom_vidar.exe	89
PID 4716 wrote to memory of 4748	4716	2026-07-28_0f17ac0060a5a10d156da73b697dd7dc_cobalt-strike_icedid_satacom_vidar.exe	90
PID 4716 wrote to memory of 3800	4716	2026-07-28_0f17ac0060a5a10d156da73b697dd7dc_cobalt-strike_icedid_satacom_vidar.exe	91
PID 3800 wrote to memory of 3020	3800	jtxdrgxt.exe	81
PID 4716 wrote to memory of 5844	4716	2026-07-28_0f17ac0060a5a10d156da73b697dd7dc_cobalt-strike_icedid_satacom_vidar.exe	92
PID 3020 wrote to memory of 5384	3020	explorer.exe
PID 3020 wrote to memory of 3124	3020	explorer.exe
PID 4716 wrote to memory of 4500	4716	2026-07-28_0f17ac0060a5a10d156da73b697dd7dc_cobalt-strike_icedid_satacom_vidar.exe	95
PID 4716 wrote to memory of 1480	4716	2026-07-28_0f17ac0060a5a10d156da73b697dd7dc_cobalt-strike_icedid_satacom_vidar.exe	96
PID 3020 wrote to memory of 4428	3020	explorer.exe	97
PID 3020 wrote to memory of 1504	3020	explorer.exe
PID 3020 wrote to memory of 4352	3020	explorer.exe
PID 3020 wrote to memory of 708	3020	explorer.exe
PID 4428 wrote to memory of 4416	4428	DE84.tmp.exe	59
PID 1480 wrote to memory of 4416	1480	7eg3g9n7.exe	59
PID 5844 wrote to memory of 1716	5844	ikj45rhj.exe	103
PID 4716 wrote to memory of 2224	4716	2026-07-28_0f17ac0060a5a10d156da73b697dd7dc_cobalt-strike_icedid_satacom_vidar.exe	104
PID 856 wrote to memory of 4416	856	DE84.tmp.exe	59
PID 2468 wrote to memory of 4416	2468	7eg3g9n7.exe	59

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4416

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Downloads MZ/PE file
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\2026-07-28_0f17ac0060a5a10d156da73b697dd7dc_cobalt-strike_icedid_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-28_0f17ac0060a5a10d156da73b697dd7dc_cobalt-strike_icedid_satacom_vidar.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\system32\notepad.exe
    C:\Windows\system32\notepad.exe
    3⤵
    PID:5752
- - C:\Users\Admin\AppData\Local\Temp\4hzwk0vo.exe
    "C:\Users\Admin\AppData\Local\Temp\4hzwk0vo.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:4748
- - C:\Users\Admin\AppData\Local\Temp\jtxdrgxt.exe
    "C:\Users\Admin\AppData\Local\Temp\jtxdrgxt.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3800
- - C:\Users\Admin\AppData\Local\Temp\ikj45rhj.exe
    "C:\Users\Admin\AppData\Local\Temp\ikj45rhj.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\is-2EP769HLCO.tmp\ikj45rhj.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-2EP769HLCO.tmp\ikj45rhj.tmp" /SL5="$50158,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\ikj45rhj.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1716
- - C:\Users\Admin\AppData\Local\Temp\x9zfub15.exe
    "C:\Users\Admin\AppData\Local\Temp\x9zfub15.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:4500
- - C:\Users\Admin\AppData\Local\Temp\7eg3g9n7.exe
    "C:\Users\Admin\AppData\Local\Temp\7eg3g9n7.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1480
- - C:\Users\Admin\AppData\Local\Temp\HMC_2.3.exe
    "C:\Users\Admin\AppData\Local\Temp\HMC_2.3.exe"
    3⤵
    - Executes dropped EXE
    PID:2224
- C:\Users\Admin\AppData\Local\Temp\DE84.tmp.exe
  C:\Users\Admin\AppData\Local\Temp\DE84.tmp.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4428
- C:\Users\Admin\AppData\Local\Temp\C962.tmp.exe
  C:\Users\Admin\AppData\Local\Temp\C962.tmp.exe
  2⤵
  PID:5744
- C:\Users\Admin\AppData\Local\Temp\B4FB.tmp.exe
  C:\Users\Admin\AppData\Local\Temp\B4FB.tmp.exe
  2⤵
  PID:52
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
    3⤵
    PID:2836
- - C:\Users\Admin\AppData\Local\Temp\taskhost.exe
    "C:\Users\Admin\AppData\Local\Temp\\taskhost.exe"
    3⤵
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\is-SLQ2ZFT0ZO.tmp\taskhost.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-SLQ2ZFT0ZO.tmp\taskhost.tmp" /SL5="$8013C,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\taskhost.exe"
      4⤵
      PID:2468
- - C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
    "C:\Users\Admin\AppData\Local\Temp\\spoolsv.exe"
    3⤵
    PID:2772
- - C:\Users\Admin\AppData\Local\Temp\winlogon.exe
    "C:\Users\Admin\AppData\Local\Temp\\winlogon.exe"
    3⤵
    PID:1404
- - C:\Users\Admin\AppData\Local\Temp\lsass.exe
    "C:\Users\Admin\AppData\Local\Temp\\lsass.exe"
    3⤵
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\lsass.exe
      "C:\Users\Admin\AppData\Local\Temp\\lsass.exe"
      4⤵
      PID:5228

C:\ProgramData\facbabfddebebcc.exe
"C:\ProgramData\facbabfddebebcc.exe"
1⤵
- Executes dropped EXE
PID:5088

C:\Users\Admin\AppData\Roaming\cryptsvcxwq.exe
C:\Users\Admin\AppData\Roaming\cryptsvcxwq.exe
1⤵
- Executes dropped EXE
PID:4536

C:\Users\Admin\AppData\Local\Temp\DE84.tmp.exe
C:\Users\Admin\AppData\Local\Temp\DE84.tmp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:856

C:\Users\Admin\AppData\Local\Temp\7eg3g9n7.exe
C:\Users\Admin\AppData\Local\Temp\7eg3g9n7.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2468

C:\Users\Admin\AppData\Local\Temp\jtxdrgxt.exe
"C:\Users\Admin\AppData\Local\Temp\jtxdrgxt.exe"
1⤵
- Executes dropped EXE
PID:1228

C:\Users\Admin\AppData\Local\Temp\B4FB.tmp.exe
C:\Users\Admin\AppData\Local\Temp\B4FB.tmp.exe
1⤵
PID:4920

C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4hzwk0vo.exe

Path C:\Users\Admin\AppData\Local\Temp\4hzwk0vo.exe
Size 166KB
SHA256 3ea66df0155ad39a658607c9eb1e035f0f8dd12dd75cc69725bdb15b73a4e5d4
MD5 878daa2275262e2d5a124d997b8f3f22
SHA1 91322a927c535b04513eb255d1238039d994b133
SHA512 a2e0473d4d5a0cb8baee3b77df636e436a3637524bd8bd3d453baad9a0c2079569241e38b6f32f46ec0c235a5b19750bae5d4695cfce181a42aafe109e7553ce
SSDEEP 3072:XtJ2fCsQiuzYJ8WreWgxgjIFaphDCMfCv6vHXrbl5STd:XwCszCYJ8OcgsaBB
TLSH
T192F37D4A73E510FDE1778239C9551A45F372782207209BAF07A047BA9F272E1AD3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7eg3g9n7.exe

Path C:\Users\Admin\AppData\Local\Temp\7eg3g9n7.exe
Size 1.1MB
SHA256 4acd7adff5c2193e7b0b9a6f8235534d67772ff3d7fa59b1215de011d7455ad9
MD5 5397d935f89da936fe739139a99c7b47
SHA1 27adcb8fc4c6685c35819569895a8afac75f1b1d
SHA512 32fcb9db51cb8ff24f47897535dea5ca671e79ed207e9f3083e83034ad523e8a628831f9ebc0b61aa5f3025b3a395e887c24f257918ef2a86913f1a7c6ec158f
SSDEEP 12288:RPhnbZIqgm1W6GTt/nUWxwsLkzEc3lktyamaghtXhDmZA83bTe6rbBpcYm:DnbZVs6G3NLkzEGlu6zWrTeobBpc
TLSH
T184359E2AFED25111DD7ED3B3BD30FE189646200583522E7A279F4EC46813C96ADA335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7eg3g9n7.exe

Path C:\Users\Admin\AppData\Local\Temp\7eg3g9n7.exe
Size 1.1MB
SHA256 2db2ef4722a80902db72de1e6c6ce34d59700f98b94844c1c923967965fe3a6c
MD5 f249ee7495dba9339b80db2d08c21a96
SHA1 f8973944696fba2717daa88afa2ec1a967144989
SHA512 e0deac8210c02758a54f368eba3768476221b87625c85c05b80d8c777057d3b7cc504ee6bf7189a7e58cd5944c033c9af026c3985b695d4d526f388d51250cdf
SSDEEP 12288:wPhnbZIqgm1W6GTt/nUWxwsLkzEc3lktyamaghtXhDmZA83bTe6rbBpcYm:MnbZVs6G3NLkzEGlu6zWrTeobBpc
TLSH
T1ED359E2AFED25111DD7ED3B3BD30FE189646200583522E7A279F4EC46813C96ADA335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B4FB.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\B4FB.tmp.exe
Size 120KB
SHA256 32b173a4a2bbc767d93bd6c645170479f1d3eb27f9ae5b47c9260ec31f739bf7
MD5 842b09509ab819c1e7edecd41d4c301b
SHA1 38efdf62dfb36898c662bb912c0e76d79e8836bf
SHA512 aa3ecddb8af12b6970fccd5106406f86bf55656193b0683da17b23ce47d3abe4cd7e64c4377206664709678f338c338d5e0ba44b193cb38b34113ea33ec29e6a
SSDEEP 1536:HlyFwDCtFe20zYrnw5p15i8VOTypRxn2KXdTY+sWLdP9dldGOIJ:HlyFPtv0kTwDxUepRx2KG6vbGOI
TLSH
T1C2C36B1777A530F8E17B823589215A16E7B378310B758B6F03A4426A6F277D09E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HMC_2.3.exe

Path C:\Users\Admin\AppData\Local\Temp\HMC_2.3.exe
Size 2.6MB
SHA256 f769c6c7fc0b250bf3b40ec9dad20c21d34694a2eb354bc75c19d40c16137185
MD5 a42cbfb70007789c48a263251360fe4e
SHA1 49c60ea8b04d329c3994a19d42d5e174c5d96d31
SHA512 d7dae6ce31e7057fd80a099b62d5efd8acb8643cf18ad2bb019500a0391e1a3b8047c1225aed9856dc54d6a1d29caedd3f601f79ffd5c42c13a1a9e45076ef2b
SSDEEP 24576:cVF3dvIxtNC+CWDU2fy6Uuri8MmOmbCYUz7PH8Zeaj0HoX8Z:cVsxa2kMOnYUvPb
TLSH
T1FCD50613A3284F6DF0C695B7B568EF3805F1E709B46B6633B8F46E253982520DC4B978
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI25282\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25282\_bz2.pyd
Size 86KB
SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
MD5 28cea50945ec6972c8ec096bf562fb9e
SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
TLSH
T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25282\_ctypes.pyd
Size 139KB
SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
MD5 fdda26bd63d43178c9aca5003f6a7e42
SHA1 48037f1f68aad29e1002573337d2357f8972d045
SHA512 f15b3b0a14c9975995d3d340c347c17b13c178c270bdebf9b153bf0df3d5eda2df8676ccc9efccc299a260fcab64afcd7b5e44809b6265f98f995003b59b05de
SSDEEP 3072:j/n1qQ8/2wN56EBZ+mwrWozIsswKRHk+HrwEIjGPfF:zn1JDm6fr5zIsfURLws
TLSH
T193D38F4B336841E6D6678138C6739E47FBB1F4521A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25282\_lzma.pyd
Size 157KB
SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
MD5 1f2c927c6f1773093e6939e0f0075997
SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
TLSH
T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25282\_zstd.pyd
Size 491KB
SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
MD5 256a79eff7505cc58fbf59d863c5c543
SHA1 343939f8652fc56fb338bf1ec4c4de3c697070fc
SHA512 993459b4b1f289be955940d6914873d190a9c3c8e646073e7603cd73fbd1d984d760f0e683ac11694b609de11a4084e6b9aa1cb755b1f63451255617f38e4605
SSDEEP 12288:JccWmYLKvveelCu30rz+Q2sTrWl939ruf:JccWJKvveelCu30rzc+f
TLSH
T1B1B48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI25282\base_library.zip
Size 1.3MB
SHA256 b12105ff668cd4f96f48a46ae9223ae3e16c47205ec7eac3241c480befa0ff2d
MD5 6a3be6e4abbb8d5174902301945dc52d
SHA1 e05203793e75edc2b6018093d5daa83e99f0d40e
SHA512 7690a007986766846d9bb958eadd8cf23065125904dac314fbf0a6ebf276bbf3a75d54972b12ceb5838845734e5ad36e2823dfbf2689f4f6d54468daad7028d7
SSDEEP 24576:WQeOdP2m2dfXJRdtRpDFaLzlbNUuUFi3x/rw:W/hRdtRzuUFi35rw
TLSH
T106552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI25282\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI25282\python314.dll
Size 6.5MB
SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
TLSH
T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ikj45rhj.exe

Path C:\Users\Admin\AppData\Local\Temp\ikj45rhj.exe
Size 13.1MB
SHA256 42d3f82fdc329abbfea289482b70b0a93adee02963306d6680cc047140dd794a
MD5 988c557adf7da2bb023305f07c5cceac
SHA1 8e32ccb260cb531aa8de8c9f585bc765841d566a
SHA512 a73835bd2ef2131a22da20d0121681a65e5dcdaa39afdb564041e61e5e4af50d0fad69a1f7fffa177b7d85249eb2338d9465383ce1c00d0443318215422796e1
SSDEEP 98304:voJJqPg6ziVAQhCydt9JuQcpF4JorePYPAMo7Bmpbn5RjQC73I1jw6NeHAFMSj:6eg6zoAQXdVyyPgfo70pbngCLI1c6w
TLSH
T155D60233A189602AE06D563745B79285853B6E687C218D1DA7F03D5CFB3F3603927B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-0TFS8M4G33.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ikj45rhj.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-2EP769HLCO.tmp\ikj45rhj.tmp
Size 4.3MB
SHA256 8a71d9a7963fbb1904e8d43ec3aaec927c1a94ed78376baf8fdd8fa46f7533ef
MD5 33453f6a4881d9959e8f964a185e1e04
SHA1 5adb5722c611dbeceba40d753c766211bc461787
SHA512 2572420402140eec620b219d7db73e05f4ef210ffe9cc0608edd399c42ec9d1a990330bcace4653156f0f389a4d72acb77d2f6817744672d46a96bf71283a789
SSDEEP 49152:6eGyzK5YtS9+SmpPvOwUNSdi1NsF+QxvCs7F5uhJBP4ji2333DneQ:6eGwK5YHCNmi16F+QxvCeFLm2333zB
TLSH
T148267E13B688753ED4A71A3B483BA684983B7E213A11CC4B7BF42D4C9E3D740AD26757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jtxdrgxt.exe

Path C:\Users\Admin\AppData\Local\Temp\jtxdrgxt.exe
Size 90KB
SHA256 706409b4cfeba987355f41d23c31e047f9b1c851ccacaf49fc243a692f7a3e22
MD5 b4994740359f6302a3047feb3e6d3453
SHA1 723990132e40adab04d65fd38e15e2d3044ceeae
SHA512 e4bdd846611147115d00368b28ce8d2d100cc4934c8000913b5bde137130ba3681d411d5f2119a68c93980770e913fe2654bdedd88dcbe3ea467724d41450254
SSDEEP 1536:/Dq9NyTUi+O2IOiJ3hP51h/SeDIiG0hL47okrNTWIxUtGsNTfqroYD4c76j:/Dq99jwx51xhDJXL4DrNTWoU7rqrfD41
TLSH
T1D293CFA7279414F5D9AAD678D5A18F23F2F3B8894A15871F03B8C9852F23362723D707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jtxdrgxt.exe

Path C:\Users\Admin\AppData\Local\Temp\jtxdrgxt.exe
Size 93KB
SHA256 1c7a1749b8587e4fa905aa6698ee50317d1d76330aec1507fc8260f8664d62f5
MD5 63a21f3e0921a7592b7d7dd6f03cdb91
SHA1 44fc43c79d422f5637cf03457f702449559998c7
SHA512 ec37e62c3f769af57929d47047a26a6d771aabecc1e39f632faa0cba11e34d3e0faeca16f62904190424f9de140b63b41e63a9c49ee0edf14f848ee6bdbebcec
SSDEEP 1536:iDq9NyTUi+O2IOiJ3hP51h/SeDIiG0hL47okrNTWIxUtGsNTfqroYD4c76j:iDq99jwx51xhDJXL4DrNTWoU7rqrfD41
TLSH
T1BF93C0A7679414F5D9AAC678D5A18B23F6F3B8895A25871F03B4C9852F33322723D703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsass.exe

Path C:\Users\Admin\AppData\Local\Temp\lsass.exe
Size 8.1MB
SHA256 62d98f765dc8bd74c921f483d9e5464c9277dd062f5d6114abdc7f030c2ce805
MD5 b2bbdf2134f086225dbe12b97f54e272
SHA1 e0f8b28f85a45085bf46ced209d4959dd7f918e8
SHA512 13fba5d51ecc148132b6d1c90194a8343900f84d327873df538473fc9c7174aff9a4a29bd5e8881c72541184a6cf08a2cae39e1901ac86a4052ac7221e4fd04d
SSDEEP 196608:qYLKbnG0OrsW4gXyTntTFqq8N3tTHsGXqr3pXFSFE7E:qYLKbGZrGtZq5XTHsGXqD7SN
TLSH
T1D486334892C019A7E897623D9AB3D556E3E1F8221B22CDDF1791132D3F73691483DBAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon.exe

Path C:\Users\Admin\AppData\Local\Temp\winlogon.exe
Size 88KB
SHA256 7afbef6873b37e6878c000a1ae7dee21899978facb69402111a3c3a248254e62
MD5 a801299383ac36137d8fd89c4301a187
SHA1 53842743560356b89c904ba26d7f3c2370d1b13a
SHA512 2562bf3583679ef9326fa3832cde85d2162678df15092b5b401c664a2172ca25eb91c17eed58434cbefdbab7f7baa5e86acae0a5826f96575599a2a94c40dae6
SSDEEP 1536:00GygBsWhz/TuMTYirB7lth/M5LAf29B6Ai428AZzjpIcJOR0fRURVX6:00GHxhUidltxwL9B6TdzaWVWRVX
TLSH
T12293C06B279425A4C9ABC171C9708B17E6F2B8191629435F07B8C9D72F63322733DB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x9zfub15.exe

Path C:\Users\Admin\AppData\Local\Temp\x9zfub15.exe
Size 100KB
SHA256 f2156f50e612756ee8a4979536e8f415cb1eb235b12590382d6da79d99b9da18
MD5 26353b907486d44c25e5aabcf6130108
SHA1 c7f517bbfdf370180fc8ebf0768d1ebafb3da892
SHA512 aa593c389934a875775921ac3a9905c52b819fdd301499cc40a426b2433e78cf376f2a9a7f1b6af11e04abb57958a4ab1e382eb59816180cd32675bff8647e6d
SSDEEP 1536:B0iro/Wtih4JRPs2C/RBHESicS48iEVi96JJMNsW+k1md09dlr3EHn:KIo/064n4BkPT48iETJOOk1MMJ3E
TLSH
T181A37B9BB7A130F9E2768238C5654A05E736F8311620DF6F03A4469A1F673D09D3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1228-128-0x00007FF6E2130000-0x00007FF6E214F000-memory.dmp

Download

memory/1228-127-0x00007FF6E2130000-0x00007FF6E214F000-memory.dmp

Download

memory/1404-276-0x00007FF68EA60000-0x00007FF68EA7E000-memory.dmp

Download

memory/1404-273-0x00007FF68EA60000-0x00007FF68EA7E000-memory.dmp

Download

memory/1480-88-0x00007FF6EC0C0000-0x00007FF6EC1D9000-memory.dmp

Download

memory/1480-123-0x00007FF6EC0C0000-0x00007FF6EC1D9000-memory.dmp

Download

memory/1716-187-0x0000000000BA0000-0x0000000001000000-memory.dmp

Download

memory/1716-185-0x0000000000BA0000-0x0000000001000000-memory.dmp

Download

memory/1716-183-0x0000000000BA0000-0x0000000001000000-memory.dmp

Download

memory/1716-207-0x0000000000BA0000-0x0000000001000000-memory.dmp

Download

memory/2224-120-0x0000024566E50000-0x00000245670F4000-memory.dmp

Download

memory/2468-337-0x0000000000220000-0x0000000000680000-memory.dmp

Download

memory/2484-246-0x0000000000E00000-0x0000000000F06000-memory.dmp

Download

memory/2484-336-0x0000000000E00000-0x0000000000F06000-memory.dmp

Download

memory/3020-275-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/3020-41-0x00000000010B0000-0x00000000010B1000-memory.dmp

Download

memory/3020-98-0x0000000003D20000-0x0000000003D21000-memory.dmp

Download

memory/3020-29-0x0000000001080000-0x00000000010A5000-memory.dmp

Download

memory/3020-28-0x0000000001080000-0x00000000010A5000-memory.dmp

Download

memory/3020-99-0x00000000067F0000-0x00000000067F1000-memory.dmp

Download

memory/3020-49-0x0000000001080000-0x00000000010A5000-memory.dmp

Download

memory/3020-226-0x0000000003850000-0x0000000003851000-memory.dmp

Download

memory/3020-46-0x0000000001080000-0x00000000010A5000-memory.dmp

Download

memory/3020-43-0x0000000001080000-0x00000000010A5000-memory.dmp

Download

memory/3020-45-0x0000000001080000-0x00000000010A5000-memory.dmp

Download

memory/3020-100-0x0000000006800000-0x0000000006801000-memory.dmp

Download

memory/3020-48-0x0000000001080000-0x00000000010A5000-memory.dmp

Download

memory/3020-42-0x00000000010C0000-0x00000000010C1000-memory.dmp

Download

memory/3020-44-0x0000000001080000-0x00000000010A5000-memory.dmp

Download

memory/3800-26-0x00007FF73D3C0000-0x00007FF73D3DE000-memory.dmp

Download

memory/3800-36-0x00007FF73D3C0000-0x00007FF73D3DE000-memory.dmp

Download

memory/4416-191-0x000002B7B8FA0000-0x000002B7B8FD1000-memory.dmp

Download

memory/4416-102-0x000002B7B8E70000-0x000002B7B8EA2000-memory.dmp

Download

memory/5088-109-0x00007FF6865D0000-0x00007FF6865EE000-memory.dmp

Download

memory/5088-104-0x00007FF6865D0000-0x00007FF6865EE000-memory.dmp

Download

memory/5752-2-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5844-50-0x0000000000920000-0x0000000000A26000-memory.dmp

Download

memory/5844-182-0x0000000000920000-0x0000000000A26000-memory.dmp

Download