Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 06:02

General

  • Target
    2026-08-12_c3fa3976962218e94f38a7911a9209c3_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 10.8MB
  • Sample260813-grpvmack8s
  • SHA256 beeb6dc25b2331c1568c296b8fbacb9348af5986b7ab835c11a06ceee11299a4
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Loads dropped DLL 50 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_c3fa3976962218e94f38a7911a9209c3_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_c3fa3976962218e94f38a7911a9209c3_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5644
    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_c3fa3976962218e94f38a7911a9209c3_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_c3fa3976962218e94f38a7911a9209c3_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5696
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:5388
  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_c3fa3976962218e94f38a7911a9209c3_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-12_c3fa3976962218e94f38a7911a9209c3_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4892
    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_c3fa3976962218e94f38a7911a9209c3_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-12_c3fa3976962218e94f38a7911a9209c3_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5636
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:4608

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        INSTALLER

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\pyWinhook-1.6.2.dist-info\INSTALLER
        • Size 4B
        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
        • MD5 SHA1 SHA512

        Maseru

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Africa\Maseru
        • Size 190B
        • SHA256 d19aebe2435c4e84bf7ae65533d23a9d440f98162e5b4d69c73f783e02299ec8
        • MD5 SHA1 SHA512 TLSH

        ComodRivadavia

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\America\Argentina\ComodRivadavia
        • Size 708B
        • SHA256 502d1fc71ed93e68cfc370f404afb9bdaa7e735701cdb811dbddcc76611f3b1d
        • MD5 SHA1 SHA512 TLSH

        Atka

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\America\Atka
        • Size 969B
        • SHA256 abfb1980e20d5f84ec5fd881c7580d77a5c6c019f30a383aaa97404212b489e0
        • MD5 SHA1 SHA512 TLSH

        Cordoba

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\America\Cordoba
        • Size 708B
        • SHA256 f488f75a34fd99630a438dcb792508a90b836fdcd2dc54a51d83d535025315fd
        • MD5 SHA1 SHA512 TLSH

        Creston

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\America\Creston
        • Size 240B
        • SHA256 ae11453c21d08984de75f2efec04dc93178a7b4e23c5e52f2098b8bd45ccb547
        • MD5 SHA1 SHA512 TLSH

        Ensenada

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\America\Ensenada
        • Size 1KB
        • SHA256 3065abfbab680d16ab8cc5d36a23885a004558d6f0ee51ef89d2ee3ca1717c8a
        • MD5 SHA1 SHA512 TLSH

        Fort_Wayne

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\America\Fort_Wayne
        • Size 531B
        • SHA256 e678f42a13efbd7be0f26a9ce53e04b1c28a582eab05611cb01c16836432f07b
        • MD5 SHA1 SHA512 TLSH

        Knox_IN

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\America\Knox_IN
        • Size 1016B
        • SHA256 2890b35dcb7c093308b552d82d8781a8ce9a4fa6f9de058283a6836ec1f9f282
        • MD5 SHA1 SHA512 TLSH

        Rio_Branco

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\America\Rio_Branco
        • Size 418B
        • SHA256 563b9052bebaf2986ae5b707e34afde013e7641287cc97ff31005f33a0dbf7a5
        • MD5 SHA1 SHA512 TLSH

        Winnipeg

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\America\Winnipeg
        • Size 1KB
        • SHA256 00dcf0606054d4f927416e0b47e1fdda2e5ce036fde4b53e51084f8566428c3a
        • MD5 SHA1 SHA512 TLSH

        Yellowknife

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\America\Yellowknife
        • Size 970B
        • SHA256 0eada6c5c48d59984c591ab1c30b4c71aab000818cc243b3cfe996f1f26c715f
        • MD5 SHA1 SHA512 TLSH

        McMurdo

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Antarctica\McMurdo
        • Size 1KB
        • SHA256 0e06e7e55aedbc92ef5b3d106e7c392ab1628cfd8a428b20e92e99028a0bfbb9
        • MD5 SHA1 SHA512 TLSH

        Syowa

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Antarctica\Syowa
        • Size 133B
        • SHA256 46853e94276af2eea8e86c2f152a871c092df195dc51273b8fc7091faa4b461c
        • MD5 SHA1 SHA512 TLSH

        Bangkok

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Asia\Bangkok
        • Size 152B
        • SHA256 cdc8e2c282d8bc9a5e9c3caf2fc45ff4e9e5cd18f5dec8cb873340ad7c584d64
        • MD5 SHA1 SHA512 TLSH

        Dubai

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Asia\Dubai
        • Size 133B
        • SHA256 0d9ea5053e83188032a6fb4d301d5db688f43011e5b6b1f917a11b71a0da7b16
        • MD5 SHA1 SHA512 TLSH

        Singapore

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Asia\Singapore
        • Size 256B
        • SHA256 0954b2d9a301d94f4348024606a71bbcb2fa24d3cd3709f5bc8bca605039785d
        • MD5 SHA1 SHA512 TLSH

        Tel_Aviv

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Asia\Tel_Aviv
        • Size 1KB
        • SHA256 9fcde8d584dea0585f5c8727aaf35f48a149e0dbd3a83bf6cef8bca9c14021e3
        • MD5 SHA1 SHA512 TLSH

        Ulaanbaatar

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Asia\Ulaanbaatar
        • Size 594B
        • SHA256 fbe23c3fafdee01b5121edf009290fb701cebbf93dacfb30f8aa90287242f6f3
        • MD5 SHA1 SHA512 TLSH

        Yangon

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Asia\Yangon
        • Size 187B
        • SHA256 e89d835c811d4da44aa8b386782ce8828df085aa0ee8f25661a9881d2f00e90c
        • MD5 SHA1 SHA512 TLSH

        ACT

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Australia\ACT
        • Size 904B
        • SHA256 820d45a868a88f81c731d5b2c758b4ed000039b6260a80433f8e0f094a604b59
        • MD5 SHA1 SHA512 TLSH

        Hobart

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Australia\Hobart
        • Size 1003B
        • SHA256 d4801581fd00037b013d71616b119fbbd510fdca5de06369b10f718a8da5e32d
        • MD5 SHA1 SHA512 TLSH

        CST6CDT

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\CST6CDT
        • Size 1KB
        • SHA256 c27b739ff46a7df0594e120d725b439217e11e44ea9a50cdc49130383b5482e7
        • MD5 SHA1 SHA512 TLSH

        EST5EDT

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\EST5EDT
        • Size 1KB
        • SHA256 d7f2206b3a45989fc9ad63d558922532fa7352280d5f87176bf1db79cb1d1fa9
        • MD5 SHA1 SHA512 TLSH

        Istanbul

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Europe\Istanbul
        • Size 1KB
        • SHA256 2a7163b16b94806f69991348e7d0a60c46eb61b1f0305f5f4b83f613db10806f
        • MD5 SHA1 SHA512 TLSH

        Kiev

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Europe\Kiev
        • Size 558B
        • SHA256 0589e80ddecebf9d3077898c12975d2be7393df2856ee9926c534763e1e26bf2
        • MD5 SHA1 SHA512 TLSH

        San_Marino

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Europe\San_Marino
        • Size 947B
        • SHA256 86bd26a06fe3057b36cf29dd7a338f2524aff8116ef08d005aa2114ea6122869
        • MD5 SHA1 SHA512 TLSH

        Vaduz

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Europe\Vaduz
        • Size 497B
        • SHA256 199062b1c30cfeb2375ec84c56df52be51891986a6293b7a124d3a62509f45e9
        • MD5 SHA1 SHA512 TLSH

        HST

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\HST
        • Size 221B
        • SHA256 1daa5729aa1e0f32cd44be112d01ad4cc567a9fe76d87dcbb9182be8d2c88ff0
        • MD5 SHA1 SHA512 TLSH

        PST8PDT

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\PST8PDT
        • Size 1KB
        • SHA256 200d05754f6d83a371cf408d7085125797657b3b0bebeba1e508cffe86a3e5c8
        • MD5 SHA1 SHA512 TLSH

        Midway

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Pacific\Midway
        • Size 146B
        • SHA256 650d918751366590553063cd681592fdca8a09957e0ce2c18d6697ec385ef796
        • MD5 SHA1 SHA512 TLSH

        Pohnpei

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Pacific\Pohnpei
        • Size 134B
        • SHA256 522f0f374b61e2c6f5fa7d19f1c7acccd09e4a213462ee3b42c90d32bf2bf18c
        • MD5 SHA1 SHA512 TLSH

        Portugal

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48922\tzdata\zoneinfo\Portugal
        • Size 1KB
        • SHA256 44d2f6cf84737e6a1e0daf914109e94256beca40b40c9a11b7a04e8bddaee4ec
        • MD5 SHA1 SHA512 TLSH

        VCRUNTIME140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\VCRUNTIME140.dll
        • Size 95KB
        • SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VCRUNTIME140_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\VCRUNTIME140_1.dll
        • Size 36KB
        • SHA256 34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _asyncio.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\_asyncio.pyd
        • Size 35KB
        • SHA256 aed83fbd7266e9511fe2ea160853fda6da3a37e569b2408bd39809637eaab3f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _bz2.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\_bz2.pyd
        • Size 47KB
        • SHA256 69d181c25797e994a9961c9f40dc57d04f8391c4fd83d412d23162fb4beb4fd7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _cffi_backend.cp310-win_amd64.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\_cffi_backend.cp310-win_amd64.pyd
        • Size 71KB
        • SHA256 803969a018b78e0ca670c0cf2c7b8ff62efd7dcbdc049070f0109d1147453cea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _cpyHook.cp310-win_amd64.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\_cpyHook.cp310-win_amd64.pyd
        • Size 18KB
        • SHA256 30113b737e283b497a9c6bfa53119a32c5133a8f528bc847b449488e4627fade
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _ctypes.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\_ctypes.pyd
        • Size 58KB
        • SHA256 067ecceb2548c05b8dec8d755f756c9fd1a3bf806f911a7fb23fa6edd2649d5c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _decimal.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\_decimal.pyd
        • Size 106KB
        • SHA256 23d9216d09abe0dcf7f9d31db37239f2bcdcda1954ebe0e8fe094c905f071c1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-console-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-console-l1-1-0.dll
        • Size 11KB
        • SHA256 8f8b79150e850acc92fd6aab614f6e3759bea875134a62087d5dd65581e3001f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-datetime-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-datetime-l1-1-0.dll
        • Size 11KB
        • SHA256 913eaaa7997a6aee53574cffb83f9c9c1700b1d8b46744a5e12d76a1e53376fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-debug-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-debug-l1-1-0.dll
        • Size 11KB
        • SHA256 58a8d69df60ecbee776cd9a74b2a32b14bf2b0bd92d527ec5f19502a0d3eb8e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-errorhandling-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 11KB
        • SHA256 46079c0a1b660fc187aafd760707f369d0b60d424d878c57685545a3fce95819
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-file-l1-1-0.dll
        • Size 14KB
        • SHA256 5c9bc70586ad538b0df1fcf5d6f1f3527450ae16935aa34bd7eb494b4f1b2db9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-file-l1-2-0.dll
        • Size 11KB
        • SHA256 629e52ba4e2dca91b10ef7729a1722888e01284eed7dda6030d0a1ec46c94086
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l2-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-file-l2-1-0.dll
        • Size 11KB
        • SHA256 dac867476caa42ff8df8f5dfe869ffd56a18dadee17d47889afb69ed6519afbf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-handle-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-handle-l1-1-0.dll
        • Size 11KB
        • SHA256 0b3dfb8554ead94d5da7859a12db353942406f9d1dfe3fac3d48663c233ea99d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-heap-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-heap-l1-1-0.dll
        • Size 11KB
        • SHA256 c43075b1d2386a8a262de628c93a65350e52eae82582b27f879708364b978e29
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-interlocked-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 11KB
        • SHA256 c23fe8d5c3ca89189d11ec8df983cc144d168cb54d9eab5d9532767bcb2f1fa3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-libraryloader-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 12KB
        • SHA256 f320f9c0463de641b396ce7561af995de32211e144407828b117088cf289df91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-localization-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-localization-l1-2-0.dll
        • Size 14KB
        • SHA256 8664222823e122fca724620fd8b72187fc5336c737d891d3cef85f4f533b8de2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-memory-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-memory-l1-1-0.dll
        • Size 11KB
        • SHA256 5d9767d8cca0fbfd5801bff2e0c2adddd1baaaa8175543625609abce1a9257bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-namedpipe-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 11KB
        • SHA256 8e015cdf2561450ed9a0773be1159463163c19eab2b6976155117d16c36519da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processenvironment-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 12KB
        • SHA256 058eb7ce88c22d2ff7d3e61e6593ca4e3d6df449f984bf251d9432665e1517d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processthreads-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 13KB
        • SHA256 a5b733e3dce21ab62bd4010f151b3578c6f1246da4a96d51ac60817865648dd3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processthreads-l1-1-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 11KB
        • SHA256 1ef06c600c451e66e744b2ca356b7f4b7b88ba2f52ec7795858d21525848ac8c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-profile-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-profile-l1-1-0.dll
        • Size 11KB
        • SHA256 e63550608dd58040304ea85367e9e0722038ba8e7dc7bf9d91c4d84f0ec65887
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-rtlsupport-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 11KB
        • SHA256 91508ab353b90b30ff2551020e9755d7ab0e860308f16c2f6417dfb2e9a75014
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-string-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-string-l1-1-0.dll
        • Size 11KB
        • SHA256 f3a7a9c98ebe915b1b57c16e27fffd4ddf31a82f0f21c06fe292878e48f5883e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-synch-l1-1-0.dll
        • Size 13KB
        • SHA256 d6708d1254ed88a948871771d6d1296945e1aa3aeb7e33e16cc378f396c61045
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-synch-l1-2-0.dll
        • Size 11KB
        • SHA256 72c639d1afda32a65143bcbe016fe5d8b46d17924f5f5190eb04efe954c1199a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-sysinfo-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 12KB
        • SHA256 76d8e4ed946deefeefa0d0012c276f0b61f3d1c84af00533f4931546cbb2f99e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-timezone-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-timezone-l1-1-0.dll
        • Size 11KB
        • SHA256 b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-util-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-core-util-l1-1-0.dll
        • Size 11KB
        • SHA256 f28a8fe2cd7e8e00b6d2ec273c16db6e6eea9b6b16f7f69887154b6228af981e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-conio-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-crt-conio-l1-1-0.dll
        • Size 12KB
        • SHA256 e677497c1baefffb33a17d22a99b76b7fa7ae7a0c84e12fda27d9be5c3d104cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-convert-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-crt-convert-l1-1-0.dll
        • Size 15KB
        • SHA256 5cf5bbb861608131b5f560cbf34a3292c80886b7c75357acc779e0bf98e16639
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-environment-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-crt-environment-l1-1-0.dll
        • Size 11KB
        • SHA256 b7ee468f5b6c650dada7db3ad9e115a0e97135b3df095c3220dfd22ba277b607
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-filesystem-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 13KB
        • SHA256 7102f8d9d0f3f689129d7fe071b234077fba4dd3687071d1e2aeaa137b123f86
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-heap-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-crt-heap-l1-1-0.dll
        • Size 12KB
        • SHA256 f5183b8d7462c01031992267fe85680ab9c5b279bedc0b25ab219f7c2184766f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-locale-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-crt-locale-l1-1-0.dll
        • Size 11KB
        • SHA256 2eb96422375f1a7b687115b132a4005d2e7d3d5dc091fb0eb22a6471e712848e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-math-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-crt-math-l1-1-0.dll
        • Size 20KB
        • SHA256 a768339f0b03674735404248a039ec8591fcba6ff61a3c6812414537badd23b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-process-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-crt-process-l1-1-0.dll
        • Size 12KB
        • SHA256 3af38920e767bd9ebc08f88eaf2d08c748a267c7ec60eab41c49b3f282a4cf65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-runtime-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 15KB
        • SHA256 d899c2f061952b3b97ab9cdbca2450290b0f005909ddd243ed0f4c511d32c198
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-stdio-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 17KB
        • SHA256 f9d3f380023a4c45e74170fe69b32bca506ee1e1fbe670d965d5b50c616da0cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-string-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-crt-string-l1-1-0.dll
        • Size 17KB
        • SHA256 1a916c0db285deb02c0b9df4d08dad5ea95700a6a812ea067bd637a91101a9f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-time-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-crt-time-l1-1-0.dll
        • Size 13KB
        • SHA256 b56bc94e8539603dd2f0fea2f25efd17966315067442507db4bffafcbc2955b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-utility-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\api-ms-win-crt-utility-l1-1-0.dll
        • Size 11KB
        • SHA256 dd14133adf5c534539298422f6c4b52739f80aca8c5a85ca8c966dea9964ceb1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base_library.zip

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\base_library.zip
        • Size 859KB
        • SHA256 64dfc4067a99c71094b4a9aa8e50344e7d42ea9a0d376cbcd419c04e53384285
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libcrypto-1_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\libcrypto-1_1.dll
        • Size 1.1MB
        • SHA256 7214cd7099c0bf4e8261ba0009fc2a9fe9163efbb53850dae9b7524b820faf39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libffi-7.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\libffi-7.dll
        • Size 23KB
        • SHA256 ddfd0755e011ea0df26d77cf3628e2cc59653aee02bf241b54b6b08561520453
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libssl-1_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\libssl-1_1.dll
        • Size 204KB
        • SHA256 1d8b3ec881b4bf24d5425322159af98c773f37c328229e06a3f5a5b2a3f82737
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pyexpat.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\pyexpat.pyd
        • Size 87KB
        • SHA256 c91016393059729debc009ca678e3132d970099283b11a35d9208361ba9fc96e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python3.DLL

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\python3.DLL
        • Size 64KB
        • SHA256 dc909eb798a23ba8ee9f8e3f307d97755bc0d2dc0cb342cedae81fbbad32a8a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python310.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\python310.dll
        • Size 1.4MB
        • SHA256 8503edb23e050affeb895fe647253493a172a5aeff5062aad2fa3c8c4dcaae93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        select.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\select.pyd
        • Size 25KB
        • SHA256 3f22ccd295ae81f5515b6256bda7ad97889fe2cf0a4c4ee8b4cc8fde79998314
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sqlite3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\sqlite3.dll
        • Size 622KB
        • SHA256 6fec78acdd4bda3a400bed8a8cb4a5c8a0e9a5a0fe450317268dbb1d8207b92c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Conakry

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\tzdata\zoneinfo\Africa\Conakry
        • Size 130B
        • SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
        • MD5 SHA1 SHA512 TLSH

        Djibouti

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\tzdata\zoneinfo\Africa\Djibouti
        • Size 191B
        • SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
        • MD5 SHA1 SHA512 TLSH

        Kigali

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\tzdata\zoneinfo\Africa\Kigali
        • Size 131B
        • SHA256 910c97c091cd34ae7427c83226234ce7b4f2f425c5822d6669c24be62010a792
        • MD5 SHA1 SHA512 TLSH

        Lagos

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\tzdata\zoneinfo\Africa\Lagos
        • Size 180B
        • SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
        • MD5 SHA1 SHA512 TLSH

        Curacao

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\tzdata\zoneinfo\America\Curacao
        • Size 177B
        • SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
        • MD5 SHA1 SHA512 TLSH

        Toronto

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\tzdata\zoneinfo\America\Toronto
        • Size 1KB
        • SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
        • MD5 SHA1 SHA512 TLSH

        EST

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\tzdata\zoneinfo\EST
        • Size 149B
        • SHA256 a78d73067ba3cbd94f8a23dfdd6aa8b68cb33b18484bc17b4e20ea1aec2f0a81
        • MD5 SHA1 SHA512 TLSH

        Greenwich

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\tzdata\zoneinfo\Etc\Greenwich
        • Size 111B
        • SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
        • MD5 SHA1 SHA512

        London

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\tzdata\zoneinfo\Europe\London
        • Size 1KB
        • SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
        • MD5 SHA1 SHA512 TLSH

        Oslo

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\tzdata\zoneinfo\Europe\Oslo
        • Size 705B
        • SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
        • MD5 SHA1 SHA512 TLSH

        Skopje

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\tzdata\zoneinfo\Europe\Skopje
        • Size 478B
        • SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
        • MD5 SHA1 SHA512 TLSH

        MET

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\tzdata\zoneinfo\MET
        • Size 1KB
        • SHA256 b10f9542a8509f0a63ebca78e3d80432dd86b8ea296400280febd9cfa76e8288
        • MD5 SHA1 SHA512 TLSH

        PRC

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\tzdata\zoneinfo\PRC
        • Size 393B
        • SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
        • MD5 SHA1 SHA512 TLSH

        Wallis

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\tzdata\zoneinfo\Pacific\Wallis
        • Size 134B
        • SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
        • MD5 SHA1 SHA512 TLSH

        Yap

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\tzdata\zoneinfo\Pacific\Yap
        • Size 154B
        • SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
        • MD5 SHA1 SHA512 TLSH

        UCT

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\tzdata\zoneinfo\UCT
        • Size 111B
        • SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
        • MD5 SHA1 SHA512

        Mountain

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\tzdata\zoneinfo\US\Mountain
        • Size 1KB
        • SHA256 9bb703920eca4b6119e81a105583a4f6ca220651f13b418479ab7cd56c413f3e
        • MD5 SHA1 SHA512 TLSH

        ucrtbase.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\ucrtbase.dll
        • Size 1011KB
        • SHA256 6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unicodedata.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56442\unicodedata.pyd
        • Size 289KB
        • SHA256 a753e10a438b5646851be2c07d6c97e5868c4828d0db1d041e11b5ca45af4d3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/5636-1526-0x00007FFB80060000-0x00007FFB8008C000-memory.dmp

        memory/5636-1641-0x00007FFB79910000-0x00007FFB79D76000-memory.dmp

        memory/5636-2081-0x00007FFB79910000-0x00007FFB79D76000-memory.dmp

        memory/5636-2041-0x00007FFB79910000-0x00007FFB79D76000-memory.dmp

        memory/5636-2001-0x00007FFB79910000-0x00007FFB79D76000-memory.dmp

        memory/5636-1961-0x00007FFB79910000-0x00007FFB79D76000-memory.dmp

        memory/5636-1921-0x00007FFB79910000-0x00007FFB79D76000-memory.dmp

        memory/5636-1881-0x00007FFB79910000-0x00007FFB79D76000-memory.dmp

        memory/5636-1841-0x00007FFB79910000-0x00007FFB79D76000-memory.dmp

        memory/5636-1801-0x00007FFB79910000-0x00007FFB79D76000-memory.dmp

        memory/5636-1761-0x00007FFB79910000-0x00007FFB79D76000-memory.dmp

        memory/5636-1722-0x00007FFB839C0000-0x00007FFB839E4000-memory.dmp

        memory/5636-1721-0x00007FFB79910000-0x00007FFB79D76000-memory.dmp

        memory/5636-1728-0x00007FFB86A00000-0x00007FFB86A10000-memory.dmp

        memory/5636-1681-0x00007FFB79910000-0x00007FFB79D76000-memory.dmp

        memory/5636-1660-0x00007FFB7FFF0000-0x00007FFB80000000-memory.dmp

        memory/5636-1601-0x00007FFB79910000-0x00007FFB79D76000-memory.dmp

        memory/5636-1560-0x00007FFB79910000-0x00007FFB79D76000-memory.dmp

        memory/5636-1578-0x00007FFB7DFC0000-0x00007FFB7E07C000-memory.dmp

        memory/5636-1566-0x00007FFB79590000-0x00007FFB79909000-memory.dmp

        memory/5636-1580-0x00007FFB80000000-0x00007FFB8002E000-memory.dmp

        memory/5636-1567-0x00007FFB86A00000-0x00007FFB86A10000-memory.dmp

        memory/5636-1559-0x00007FFB7D910000-0x00007FFB7DA28000-memory.dmp

        memory/5636-1558-0x00007FFB80030000-0x00007FFB80057000-memory.dmp

        memory/5636-1536-0x00007FFB80120000-0x00007FFB801D8000-memory.dmp

        memory/5636-1537-0x00007FFB7FFF0000-0x00007FFB80000000-memory.dmp

        memory/5636-1535-0x00007FFB7DFC0000-0x00007FFB7E07C000-memory.dmp

        memory/5636-1507-0x00007FFB79910000-0x00007FFB79D76000-memory.dmp

        memory/5636-1508-0x00007FFB839C0000-0x00007FFB839E4000-memory.dmp

        memory/5636-1509-0x00007FFB8AEB0000-0x00007FFB8AEBF000-memory.dmp

        memory/5636-1534-0x00007FFB82950000-0x00007FFB8297E000-memory.dmp

        memory/5636-1511-0x00007FFB83980000-0x00007FFB83999000-memory.dmp

        memory/5636-1512-0x00007FFB87110000-0x00007FFB8711D000-memory.dmp

        memory/5636-1514-0x00007FFB829A0000-0x00007FFB829B5000-memory.dmp

        memory/5636-1532-0x00007FFB86A00000-0x00007FFB86A10000-memory.dmp

        memory/5636-1516-0x00007FFB79590000-0x00007FFB79909000-memory.dmp

        memory/5636-1533-0x00007FFB80000000-0x00007FFB8002E000-memory.dmp

        memory/5636-1517-0x00007FFB86A00000-0x00007FFB86A10000-memory.dmp

        memory/5636-1518-0x00007FFB82950000-0x00007FFB8297E000-memory.dmp

        memory/5636-1519-0x00007FFB80120000-0x00007FFB801D8000-memory.dmp

        memory/5636-1521-0x00007FFB80090000-0x00007FFB80117000-memory.dmp

        memory/5636-1520-0x00007FFB79910000-0x00007FFB79D76000-memory.dmp

        memory/5636-1523-0x00007FFB84490000-0x00007FFB8449D000-memory.dmp

        memory/5636-1522-0x00007FFB839C0000-0x00007FFB839E4000-memory.dmp

        memory/5636-1524-0x00007FFB807F0000-0x00007FFB80808000-memory.dmp

        memory/5636-1525-0x00007FFB83980000-0x00007FFB83999000-memory.dmp

        memory/5636-1530-0x00007FFB79590000-0x00007FFB79909000-memory.dmp

        memory/5636-1527-0x00007FFB829F0000-0x00007FFB829FB000-memory.dmp

        memory/5636-1529-0x00007FFB80030000-0x00007FFB80057000-memory.dmp

        memory/5636-1528-0x00007FFB829A0000-0x00007FFB829B5000-memory.dmp

        memory/5636-1531-0x00007FFB7D910000-0x00007FFB7DA28000-memory.dmp

        memory/5696-713-0x00007FFB79D80000-0x00007FFB7A1E6000-memory.dmp

        memory/5696-1515-0x00007FFB801E0000-0x00007FFB8029C000-memory.dmp

        memory/5696-1513-0x00007FFB87DF0000-0x00007FFB87E1E000-memory.dmp

        memory/5696-1510-0x00007FFB87E20000-0x00007FFB87E47000-memory.dmp

        memory/5696-774-0x00007FFB94990000-0x00007FFB9499F000-memory.dmp

        memory/5696-775-0x00007FFB8C660000-0x00007FFB8C679000-memory.dmp

        memory/5696-777-0x00007FFB8C640000-0x00007FFB8C655000-memory.dmp

        memory/5696-1545-0x00007FFB8D9A0000-0x00007FFB8D9B0000-memory.dmp

        memory/5696-1538-0x00007FFB79D80000-0x00007FFB7A1E6000-memory.dmp

        memory/5696-1544-0x00007FFB81D90000-0x00007FFB82109000-memory.dmp

        memory/5696-778-0x00007FFB81D90000-0x00007FFB82109000-memory.dmp

        memory/5696-776-0x00007FFB925A0000-0x00007FFB925AD000-memory.dmp

        memory/5696-779-0x00007FFB8D9A0000-0x00007FFB8D9B0000-memory.dmp

        memory/5696-780-0x00007FFB8C610000-0x00007FFB8C63E000-memory.dmp

        memory/5696-781-0x00007FFB8AF20000-0x00007FFB8AFD8000-memory.dmp

        memory/5696-783-0x00007FFB839F0000-0x00007FFB83A77000-memory.dmp

        memory/5696-782-0x00007FFB79D80000-0x00007FFB7A1E6000-memory.dmp

        memory/5696-1581-0x00007FFB79D80000-0x00007FFB7A1E6000-memory.dmp

        memory/5696-785-0x00007FFB8D980000-0x00007FFB8D98D000-memory.dmp

        memory/5696-1640-0x00007FFB8C590000-0x00007FFB8C5A0000-memory.dmp

        memory/5696-1621-0x00007FFB79D80000-0x00007FFB7A1E6000-memory.dmp

        memory/5696-786-0x00007FFB8C5F0000-0x00007FFB8C608000-memory.dmp

        memory/5696-722-0x00007FFB8C8E0000-0x00007FFB8C904000-memory.dmp

        memory/5696-1662-0x00007FFB8C8E0000-0x00007FFB8C904000-memory.dmp

        memory/5696-1661-0x00007FFB79D80000-0x00007FFB7A1E6000-memory.dmp

        memory/5696-787-0x00007FFB8C660000-0x00007FFB8C679000-memory.dmp

        memory/5696-1708-0x00007FFB8D9A0000-0x00007FFB8D9B0000-memory.dmp

        memory/5696-1701-0x00007FFB79D80000-0x00007FFB7A1E6000-memory.dmp

        memory/5696-789-0x00007FFB8C5B0000-0x00007FFB8C5BB000-memory.dmp

        memory/5696-791-0x00007FFB87E20000-0x00007FFB87E47000-memory.dmp

        memory/5696-792-0x00007FFB81D90000-0x00007FFB82109000-memory.dmp

        memory/5696-1741-0x00007FFB79D80000-0x00007FFB7A1E6000-memory.dmp

        memory/5696-794-0x00007FFB87DF0000-0x00007FFB87E1E000-memory.dmp

        memory/5696-1781-0x00007FFB79D80000-0x00007FFB7A1E6000-memory.dmp

        memory/5696-793-0x00007FFB80810000-0x00007FFB80928000-memory.dmp

        memory/5696-1821-0x00007FFB79D80000-0x00007FFB7A1E6000-memory.dmp

        memory/5696-798-0x00007FFB8C590000-0x00007FFB8C5A0000-memory.dmp

        memory/5696-1861-0x00007FFB79D80000-0x00007FFB7A1E6000-memory.dmp

        memory/5696-797-0x00007FFB8AF20000-0x00007FFB8AFD8000-memory.dmp

        memory/5696-1901-0x00007FFB79D80000-0x00007FFB7A1E6000-memory.dmp

        memory/5696-796-0x00007FFB801E0000-0x00007FFB8029C000-memory.dmp

        memory/5696-1941-0x00007FFB79D80000-0x00007FFB7A1E6000-memory.dmp

        memory/5696-795-0x00007FFB8C610000-0x00007FFB8C63E000-memory.dmp

        memory/5696-1981-0x00007FFB79D80000-0x00007FFB7A1E6000-memory.dmp

        memory/5696-790-0x00007FFB8C640000-0x00007FFB8C655000-memory.dmp

        memory/5696-2021-0x00007FFB79D80000-0x00007FFB7A1E6000-memory.dmp

        memory/5696-788-0x00007FFB8C5C0000-0x00007FFB8C5EC000-memory.dmp

        memory/5696-2061-0x00007FFB79D80000-0x00007FFB7A1E6000-memory.dmp

        memory/5696-784-0x00007FFB8C8E0000-0x00007FFB8C904000-memory.dmp