c6197cddd1ba87bc1058afb23e3951b8a845f44619c9cfc528800dad3edb0945

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Size 59.7MB
Sample260815-m6144avbpc
SHA256 c6197cddd1ba87bc1058afb23e3951b8a845f44619c9cfc528800dad3edb0945
MD5 68fa9bce1761f03b58a4b0f38420d434
SHA1 266272dc735f249db08924f2faaf25e5fa060c66
SHA512 8327130a2dfb6f7f3b17d8d85fa6d4d3cbcccb8a095204cc44b09ad40617cfffcf100394f3f64455cdc1894cd76a1138162f6c493b109e970db5ce5eb0c59dbe
SSDEEP 196608:PAQLqUlDOC9wtZVZ1kwG2QdjiXZyDmn5O5Z:YMlP9e/xG2Qs64OH
TLSH
T164D7336132460DEAF3324A3C8841D929E8327C145F77CA5F425C47796F9B6A2AD3F326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
3504	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5856	powershell.exe
2040	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5856	powershell.exe

Loads dropped DLL 17 IoCs

pid	Process
4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3656	tasklist.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c54d-25.dat	upx
behavioral2/memory/4644-29-0x00007FFB696D0000-0x00007FFB69B3E000-memory.dmp	upx
behavioral2/files/0x000c00000001c53e-31.dat	upx
behavioral2/memory/4644-34-0x00007FFB7C410000-0x00007FFB7C434000-memory.dmp	upx
behavioral2/files/0x000c00000001c54a-33.dat	upx
behavioral2/memory/4644-36-0x00007FFB82380000-0x00007FFB8238F000-memory.dmp	upx
behavioral2/files/0x000c00000001c546-37.dat	upx
behavioral2/memory/4644-40-0x00007FFB7DA30000-0x00007FFB7DA49000-memory.dmp	upx
behavioral2/files/0x000c00000001c54f-39.dat	upx
behavioral2/memory/4644-43-0x00007FFB81C70000-0x00007FFB81C7D000-memory.dmp	upx
behavioral2/files/0x000c00000001c541-48.dat	upx
behavioral2/memory/4644-50-0x00007FFB7C3E0000-0x00007FFB7C40D000-memory.dmp	upx
behavioral2/files/0x000c00000001c53d-51.dat	upx
behavioral2/memory/4644-54-0x00007FFB7C550000-0x00007FFB7C569000-memory.dmp	upx
behavioral2/files/0x000c00000001c547-53.dat	upx
behavioral2/files/0x000c00000001c550-56.dat	upx
behavioral2/memory/4644-57-0x00007FFB7C3C0000-0x00007FFB7C3DF000-memory.dmp	upx
behavioral2/memory/4644-59-0x00007FFB701F0000-0x00007FFB70359000-memory.dmp	upx
behavioral2/files/0x000c00000001c548-60.dat	upx
behavioral2/files/0x000c00000001c549-62.dat	upx
behavioral2/files/0x000c00000001c54b-64.dat	upx
behavioral2/memory/4644-63-0x00007FFB7C390000-0x00007FFB7C3BE000-memory.dmp	upx
behavioral2/memory/4644-69-0x00007FFB72270000-0x00007FFB72327000-memory.dmp	upx
behavioral2/memory/4644-72-0x00007FFB7C410000-0x00007FFB7C434000-memory.dmp	upx
behavioral2/files/0x000c00000001c551-80.dat	upx
behavioral2/memory/4644-82-0x00007FFB6FDC0000-0x00007FFB6FED8000-memory.dmp	upx
behavioral2/memory/4644-79-0x00007FFB7D440000-0x00007FFB7D44D000-memory.dmp	upx
behavioral2/memory/4644-78-0x00007FFB7DA30000-0x00007FFB7DA49000-memory.dmp	upx
behavioral2/files/0x000c00000001c545-77.dat	upx
behavioral2/memory/4644-75-0x00007FFB7C370000-0x00007FFB7C384000-memory.dmp	upx
behavioral2/files/0x000c00000001c540-74.dat	upx
behavioral2/memory/4644-71-0x00007FFB69350000-0x00007FFB696C7000-memory.dmp	upx
behavioral2/memory/4644-68-0x00007FFB696D0000-0x00007FFB69B3E000-memory.dmp	upx
behavioral2/memory/4644-89-0x00007FFB7C3E0000-0x00007FFB7C40D000-memory.dmp	upx
behavioral2/memory/4644-101-0x00007FFB7C3C0000-0x00007FFB7C3DF000-memory.dmp	upx
behavioral2/memory/4644-102-0x00007FFB701F0000-0x00007FFB70359000-memory.dmp	upx
behavioral2/memory/4644-103-0x00007FFB7C390000-0x00007FFB7C3BE000-memory.dmp	upx
behavioral2/memory/4644-104-0x00007FFB72270000-0x00007FFB72327000-memory.dmp	upx
behavioral2/memory/4644-106-0x00007FFB69350000-0x00007FFB696C7000-memory.dmp	upx
behavioral2/memory/4644-108-0x00007FFB7C410000-0x00007FFB7C434000-memory.dmp	upx
behavioral2/memory/4644-107-0x00007FFB696D0000-0x00007FFB69B3E000-memory.dmp	upx
behavioral2/memory/4644-121-0x00007FFB6FDC0000-0x00007FFB6FED8000-memory.dmp	upx
behavioral2/memory/4644-123-0x00007FFB7C410000-0x00007FFB7C434000-memory.dmp	upx
behavioral2/memory/4644-129-0x00007FFB7C3C0000-0x00007FFB7C3DF000-memory.dmp	upx
behavioral2/memory/4644-131-0x00007FFB7C390000-0x00007FFB7C3BE000-memory.dmp	upx
behavioral2/memory/4644-135-0x00007FFB7D440000-0x00007FFB7D44D000-memory.dmp	upx
behavioral2/memory/4644-136-0x00007FFB6FDC0000-0x00007FFB6FED8000-memory.dmp	upx
behavioral2/memory/4644-133-0x00007FFB69350000-0x00007FFB696C7000-memory.dmp	upx
behavioral2/memory/4644-134-0x00007FFB7C370000-0x00007FFB7C384000-memory.dmp	upx
behavioral2/memory/4644-132-0x00007FFB72270000-0x00007FFB72327000-memory.dmp	upx
behavioral2/memory/4644-130-0x00007FFB701F0000-0x00007FFB70359000-memory.dmp	upx
behavioral2/memory/4644-128-0x00007FFB7C550000-0x00007FFB7C569000-memory.dmp	upx
behavioral2/memory/4644-127-0x00007FFB7C3E0000-0x00007FFB7C40D000-memory.dmp	upx
behavioral2/memory/4644-126-0x00007FFB81C70000-0x00007FFB81C7D000-memory.dmp	upx
behavioral2/memory/4644-125-0x00007FFB7DA30000-0x00007FFB7DA49000-memory.dmp	upx
behavioral2/memory/4644-124-0x00007FFB82380000-0x00007FFB8238F000-memory.dmp	upx
behavioral2/memory/4644-122-0x00007FFB696D0000-0x00007FFB69B3E000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1432	cmd.exe
6048	cmd.exe
5048	cmd.exe
6004	cmd.exe
5680	cmd.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2040	powershell.exe
2040	powershell.exe
1336	WMIC.exe
1336	WMIC.exe
1336	WMIC.exe
1336	WMIC.exe
5856	powershell.exe
5856	powershell.exe
2040	powershell.exe
5856	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeIncreaseQuotaPrivilege	1336	WMIC.exe
Token: SeSecurityPrivilege	1336	WMIC.exe
Token: SeTakeOwnershipPrivilege	1336	WMIC.exe
Token: SeLoadDriverPrivilege	1336	WMIC.exe
Token: SeSystemProfilePrivilege	1336	WMIC.exe
Token: SeSystemtimePrivilege	1336	WMIC.exe
Token: SeProfSingleProcessPrivilege	1336	WMIC.exe
Token: SeIncBasePriorityPrivilege	1336	WMIC.exe
Token: SeCreatePagefilePrivilege	1336	WMIC.exe
Token: SeBackupPrivilege	1336	WMIC.exe
Token: SeRestorePrivilege	1336	WMIC.exe
Token: SeShutdownPrivilege	1336	WMIC.exe
Token: SeDebugPrivilege	1336	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1336	WMIC.exe
Token: SeRemoteShutdownPrivilege	1336	WMIC.exe
Token: SeUndockPrivilege	1336	WMIC.exe
Token: SeManageVolumePrivilege	1336	WMIC.exe
Token: 33	1336	WMIC.exe
Token: 34	1336	WMIC.exe
Token: 35	1336	WMIC.exe
Token: 36	1336	WMIC.exe
Token: SeDebugPrivilege	3656	tasklist.exe
Token: SeDebugPrivilege	5856	powershell.exe
Token: SeIncreaseQuotaPrivilege	1336	WMIC.exe
Token: SeSecurityPrivilege	1336	WMIC.exe
Token: SeTakeOwnershipPrivilege	1336	WMIC.exe
Token: SeLoadDriverPrivilege	1336	WMIC.exe
Token: SeSystemProfilePrivilege	1336	WMIC.exe
Token: SeSystemtimePrivilege	1336	WMIC.exe
Token: SeProfSingleProcessPrivilege	1336	WMIC.exe
Token: SeIncBasePriorityPrivilege	1336	WMIC.exe
Token: SeCreatePagefilePrivilege	1336	WMIC.exe
Token: SeBackupPrivilege	1336	WMIC.exe
Token: SeRestorePrivilege	1336	WMIC.exe
Token: SeShutdownPrivilege	1336	WMIC.exe
Token: SeDebugPrivilege	1336	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1336	WMIC.exe
Token: SeRemoteShutdownPrivilege	1336	WMIC.exe
Token: SeUndockPrivilege	1336	WMIC.exe
Token: SeManageVolumePrivilege	1336	WMIC.exe
Token: 33	1336	WMIC.exe
Token: 34	1336	WMIC.exe
Token: 35	1336	WMIC.exe
Token: 36	1336	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2040	powershell.exe
Token: SeSecurityPrivilege	2040	powershell.exe
Token: SeTakeOwnershipPrivilege	2040	powershell.exe
Token: SeLoadDriverPrivilege	2040	powershell.exe
Token: SeSystemProfilePrivilege	2040	powershell.exe
Token: SeSystemtimePrivilege	2040	powershell.exe
Token: SeProfSingleProcessPrivilege	2040	powershell.exe
Token: SeIncBasePriorityPrivilege	2040	powershell.exe
Token: SeCreatePagefilePrivilege	2040	powershell.exe
Token: SeBackupPrivilege	2040	powershell.exe
Token: SeRestorePrivilege	2040	powershell.exe
Token: SeShutdownPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeSystemEnvironmentPrivilege	2040	powershell.exe
Token: SeRemoteShutdownPrivilege	2040	powershell.exe
Token: SeUndockPrivilege	2040	powershell.exe
Token: SeManageVolumePrivilege	2040	powershell.exe
Token: 33	2040	powershell.exe
Token: 34	2040	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 4644	4288	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	89
PID 4644 wrote to memory of 5048	4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	90
PID 4644 wrote to memory of 6048	4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	91
PID 4644 wrote to memory of 6004	4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	92
PID 4644 wrote to memory of 1432	4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	96
PID 4644 wrote to memory of 5680	4644	2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	98
PID 5048 wrote to memory of 2040	5048	cmd.exe	100
PID 6048 wrote to memory of 5856	6048	cmd.exe	101
PID 1432 wrote to memory of 3656	1432	cmd.exe	102
PID 5680 wrote to memory of 1336	5680	cmd.exe	103
PID 6004 wrote to memory of 1772	6004	cmd.exe	104
PID 6048 wrote to memory of 3504	6048	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Users\Admin\AppData\Local\Temp\2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-15_68fa9bce1761f03b58a4b0f38420d434_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5856
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:3504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('32 BITS NOT AVAILABLE', 0, 'WARNING ERROR', 0+16);close()""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6004
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('32 BITS NOT AVAILABLE', 0, 'WARNING ERROR', 0+16);close()"
      4⤵
      PID:1772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5680
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Process Discovery

T1057

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\VCRUNTIME140.dll
Size 96KB
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
SSDEEP 1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
TLSH
T1E0A37D4A77A542BBC06ED274C1A39906F7B0B840877063CF07B5466A5F23BE19E3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\_bz2.pyd
Size 46KB
SHA256 fe3ececf82cdd471e61ac61923b7ecf9cf4df8f3a1116e8cf3a282d8d065df3a
MD5 f5f4d231a7c611f417d4541c1aae4c10
SHA1 f0c7b2073568bd1b4d4a68c68e397d1c4c0de5d4
SHA512 a31075c212f26f8be0598aecf44f936cf507f229c500f823951cd902fe03c2dc8cf66295a823c463299bae6a52117feb45dda1983ab0867df148daf327403fec
SSDEEP 768:ArsYCUY3dtaJYS61Vs9Psq+G8O4g+jvqpUvIStVkeyYiSyvb0eEd4:AYjUOdtA61EPsBNG+RvIStVkh7Sywk
TLSH
T1EC23D0634660ACACC873497034D89A1CEF72BE919D7187DB309C1229AFA57012B657FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\_ctypes.pyd
Size 56KB
SHA256 47b601a4354fde1024b732d220631f09fda9c1820a2a65c15c02a0b066deb278
MD5 b8887b1c0030c9b63028d493dde34d74
SHA1 b03c6444c1842dadccfd9b4054d34929dbccdf04
SHA512 846fb6319085e53d3c768c82248b65e516818e8c3e0e697e0bf77f589d4125d8387617e4e88e83e871ab4a483293036954df8c33539f7dba7ff35451eb3e9c72
SSDEEP 1536:bWPrCicAPoX7sZfiAr7R+kJDtYmNyL7Xnwr8hISQPEa7SyLPR:bQrRciRfiI7DtYmNyHXkaISQPEaFPR
TLSH
T1E943E0D34676F964C4735D7230C85D207E367A636A008A9B315E953B8BA13813FE73B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\_hashlib.pyd
Size 33KB
SHA256 ebb44a13a343af88883fe3048437c7c6934f22126129086f6e386eaf59b746b8
MD5 ed2f19b39c926534a3f66804a72b0d53
SHA1 fca2296347f7dcd436a286f1e908988b0c43d2d5
SHA512 a3b5e39227f912b199b6332484a64dc83745768362a1e8c790396c50dae8fc51350263e7f4349595ed774f48f9e3e3cf57cef4de91348f1701d4fcd0a01ccee6
SSDEEP 768:sJczXhtCeLBWOv3U83AwPUZpSHIS5IBTYiSyvc9eEdB:sCUOvEgA4UOHIS5IBT7Sy+V
TLSH
T13BE2B0A387B0D838D8534D7234D0AD19AEB0F5928590C3FF3229827A4F917826FA5376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\_lzma.pyd
Size 84KB
SHA256 b3522206bf15f7fb7f649c8e1e8edbb1a0b58bce997d4f88d0878ca77c85d12e
MD5 5aec5d1bd3108bf7cd556ac901389b8c
SHA1 7e09948cabbb4b4af1bf1c72d8c7aa3afc23183e
SHA512 4a8c47f17d2799080e9acc1c99ca8706b8cc29ab6e91ee7d9c7a0b5ff0f191311ba4a5963a7f4b5ef0038076ad5830e4347b475dbccab3939f8a6e0c1cd8e4be
SSDEEP 1536:0NLDSTEgnRQKnL1AUdElTyZ8wqrw7xTwtDssqkMiCQapJkJQRBFBZe1jISe1PF7M:uPSTXaKnLbdAk8RrExTEsdkpxxi/CISt
TLSH
T17783016796F1849CE9255EB175D88F387E30B763B4F48BA3215C923A6F403E09F75222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\_queue.pyd
Size 24KB
SHA256 93104cd9274050d69ab7c1d1fbfc847e07a1faf9d392f5b46b2e40f1dca9bcf4
MD5 ed684af77b17b6166ea94cb4c9831908
SHA1 db77252fd37079020b4fee9d68ea1fabf900b06c
SHA512 306bb228d9cf4f9aafaf8c6e10fb5ee60fc21e8f7b05d43dab4e82c2d0852ab5d6d266303cebc51d75557aea09e30386a6197ad8b09f9f02b5d5715411feb499
SSDEEP 768:x7UQsghpqwpBjIS7URpYiSyvAEYeEdSiD:txphwmjIS7URp7Sy9YLD
TLSH
T106B2BEF381B09818EDA38E7134D89D25EE31BDD3551143D7325CA26A8F927422BB53BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\_socket.pyd
Size 41KB
SHA256 7d16e42e65c99fe3ae755045c1e4abd049bfd7e6f4ee7f366b776b365d82f2a2
MD5 83fa71bcfcdd78e9b21e4c002af9db47
SHA1 7bb246c21fac4d125942c0b017763595e475936b
SHA512 f02209e669cd0fe72cd2d8060f34a1ad559413179acab80769db026203b614b8b3415612831f89c11bd86bd00dbd91f8b04fd6d4f276311f09ba0877e6bc81cd
SSDEEP 768:13IA46skB8OIXt7U7m3VZiCuSTKFgOAUWrIpEbFISQwkmwYiSyvIsmeEdUI:yA4rkfI9briCuvsdDbFISQwkmw7SyML
TLSH
T19813D16381A5A85CDD328EF034D08D15FBB0B996AC50C7EB325DC76D4F617826AA3372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\_sqlite3.pyd
Size 48KB
SHA256 4c4556f046de77ec05804eb54c3ef15d5b284d360199432379a3b87b25dba2fd
MD5 bc8a7ed0a49a3c7cfee84692b236914b
SHA1 ba4a07b4d3f303a90a60bc8b9cfc0984fb14f32b
SHA512 587ff5b6777c663ae5a08fc73ffc46ef5bcff25d35b39c16f94bc4ec6f21f0b18840b6c49d83e5e99d2d550bcdafe00e981f2b5ee2e7309384728b1a66b5a789
SSDEEP 1536:A8MdxwjmZd+PMnJe4e0ek6NIS5Q0j7Syce:7gxj+knJD/dIIS5Q0j+e
TLSH
T14223E1A345B4A858DC339672B0D9C928FE70FAD7191097E7312CC2495FA27411FB53BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\_ssl.pyd
Size 60KB
SHA256 b89b461de18660dd2ab94ab271833894c8a518252b2002096ef8eea8ee07168d
MD5 91bcf19bbbfdc276520072f276eef11e
SHA1 3627bffb0cfa326609b16cb0d4effc5fcdf06025
SHA512 06498e9ca0169e02d65823498b5bd7478a630c3fde23acf11fee94947d703c72b2ce1531b5c46cdaa95b93c66b9c314113dd348f8c37eda84510a4078a27a2b1
SSDEEP 1536:+gQevryAoLj3Z7fBOtcmmFDogUjNK8GISt7/OD7SymY:+UvrfoLFFmJAogsKpISt7/C0Y
TLSH
T1FE53F19686904C5DCC679FF231D18929FAB6BE624B1143E7214EA0260F773407A773B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\base_library.zip
Size 812KB
SHA256 0ddff00fec783e3ddb1b425ce741a9e1564acd57ae95ea5123bd642fb758dc2c
MD5 5b401d1566b6fa639fd2aff2a881ea1f
SHA1 4df0849556ef7c82d39c7ea4c34a0188677a03ac
SHA512 5f666ba89fd86847aa53aa7b51d135f820a348c1f722049b6ca2374eb1726a3255ba9b0ca7d3c8f7c1621eb3ae813abda20dc3f8be33c3e47a38240721412b13
SSDEEP 12288:PEHYKPY+WygVqFcIWUA4a2YCdbVwxDfpEn4jSRMNuc:PEHYMVg8La2JVwxDfpEn4GMNuc
TLSH
T12405398069911ED7FD09F278815F8E3C069AB33ADB89D583BA4FC2D8BF071E0199565C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\blank.aes
Size 74KB
SHA256 33f9c827b4c98ad6969d463664f5b8f229565acf08909b672ca27bca946048f1
MD5 10a20eb78349aa56d286a91c71ab0802
SHA1 a34ae851c9e98123db2aa2e38b0fec4b0732ecbe
SHA512 0e2dfb97ce581d4f267408822a298d9d8cc3ea8a77e760061f7dfa5d5f2b6222bfac04df1d3f48fdb6b2aa7cb266d57c7767d1cd75dfbe82cf2bda60f298a158
SSDEEP 1536:7/sUj97w/hq69uUmeE9ZUSRoHnkfrk/7MPmUcsT8BXMScFMHoyU:7/sY4F9uD1/M7MPmUNgIMFU
TLSH
T11D73E0A41C910FB3FAAAFBF1D4F6A04D75B9362DD72A5419200753582F22B2CED07788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\blank.aes
Size 74KB
SHA256 51d3e673fb67f9b3da63730dc6bdc57ad674862ecb040c0fe8cc28bbdac8f724
MD5 1e18abba81d142f9b46a6a431a88054d
SHA1 91560be0d451bf8d1a70cd327797dda9aea9a037
SHA512 63e2ce0b56931d1481a746ef6e099bf5f9db9958a9788043ade47b3b6dff21357b913fed1c9250e6934191f5e3e5bf8c5e823eab86a73bf5c9ec3f741e4dc5db
SSDEEP 1536:Hv+ebueOeT8ybWKOD+siYS51a0sqs6UXgS15SmzYCE:HvjbuezwyMKTLsrgS14N
TLSH
T14873125AAA08D55DA0013C7078936192BFE3CE4CA73F7F4C4FAD55AEC018EB5B98650D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\libcrypto-1_1.dll
Size 1.1MB
SHA256 adebe92032896cc3eab9d28563b129ad6910ee368dcb98997c742b4054716be9
MD5 205412dc7f3cd894644a96e97e1a3cb8
SHA1 e80a8254a3a4d7db7d3db5b18640db34c0648d3e
SHA512 22535daaa0704e3158d03f6f2890c4f6a08c3d6ca4593d9bdf4fc437b06cb03fc383d18cf9b99a230c29d36929e69bda89c558e2c09ff3ea6bfbf4b4cdad65c2
SSDEEP 24576:ik3UseOkUaIS1Ufk9yI9EBrXvkKTfropEOdo89kASpQY32Za1CPwDv3uFfJW:ik3U0aIS1Uc9yoEZlTfMpE9lT1CPwDvX
TLSH
T19335121424BF9C0FDB9A947F8E708C3B895A2700F348EFF10D3589558C19E1E5AB66DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\libffi-7.dll
Size 23KB
SHA256 85ac46f9d1fd15ab12f961e51ba281bff8c0141fa122bfa21a66e13dd4f943e7
MD5 ce7d4f152de90a24b0069e3c95fa2b58
SHA1 98e921d9dd396b86ae785d9f8d66f1dc612111c2
SHA512 7b0a1bd9fb5666fe5388cabcef11e2e4038bbdb62bdca46f6e618555c90eb2e466cb5becd7773f1136ee929f10f74c35357b65b038f51967de5c2b62f7045b1f
SSDEEP 384:BRZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:LwlGuUm2Evb1p07pWDG4yKRF
TLSH
T166B2CFD70631FCB9DE93DC7132C4C2AAFA217F9621A145BF556F81B19E91B821138205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\libssl-1_1.dll
Size 200KB
SHA256 7245ff47c2e6e39d06935060fb045c688eb8c170bfdeb0174954c0c65055923c
MD5 d879b60a4500e5a7d1779d20e43a8edc
SHA1 730a6625745639073565d66530335aae30934cbf
SHA512 fa0f0b4d42b16fbb44f0c2c0c9ad60985be796b8838217a9d756e918e17c73ffefff9353f6fa4f9ba7066a5019a888a3d2399c10b21a4079df1667e1c6df2073
SSDEEP 3072:H4A92MK5MfGhqR1qnW/Bby+h0lE4GIp8/Mgfg68oPrRHUy1oygvaO9JSj8Hrd+/g:hSMehqKnEKlEARNYRP1lgl9jHrw/BgX
TLSH
T13F14F1A3B11B5D7BC867FE74FA7161D8D36C73018306DAAB7B96C4948E6580E237C01A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\python310.dll
Size 1.4MB
SHA256 f33ed93ae4b6011c8be2802304a759a5d2de8fd14c5dc34d0232aa4f8389766b
MD5 dccf77f6ab7c6600e8b46280020b7902
SHA1 fd50cdf5dcfa34146fb82820fcc680c26b7aa64f
SHA512 42656f0f7e62454a763aa665cd31025a6bc4fb3802da4d4e3e151e2ffde3a651afce2d5e56b16c3e8215057c260248e683968d57940ff789f97ffb2d840b9a6d
SSDEEP 24576:y3mXxP7ZUnsfJHJEl1tYoo6yoS3x+97ZZq7lYpN4kxEweo1FhA/FPK54agKW:zXxPpct9RS309oINDxNeo1sFms
TLSH
T1906533F37637CC57E6A27DFC84B2F9251C362602443BCACAA5B2C257529AD205A1F31D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\select.pyd
Size 24KB
SHA256 6b4527434453393834c7e2701321a913d93ad747b3eebb8c3788d9a92576e00e
MD5 e29fac3a4f749e4d49cca9c443a67997
SHA1 dcb985390615076e0a7e58dd494c2944c2164fbc
SHA512 b53d500e95ed5d62c597f6af2940854eae67f28d49d0c9b1ab7c978ff66dd25fd30c3c20bd59d716ad546bdc66309bff50663874cf39eec9bbb70c82f6037dd8
SSDEEP 384:GIKfqQWp/gVTdgo4klZa7gJXpzWIS7GR6gIYiSy1pCQkyw24i/8E9VFL2Ut8JU:mzVTGoHp5zWIS7GRuYiSyv7VeEdH
TLSH
T1A8B29EE382A4581CED238EB030E49914FF35B6979950C3DB315D927A4F913827BA63B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\sqlite3.dll
Size 605KB
SHA256 b06d9310a46ac6ef1c6be6536fd794279790686a791b86f830abed00de2ccb5d
MD5 f1262fa91f96f16a50410c1ea489c4ca
SHA1 3de007af0ae3c22d40d7d20f46d76a7d66fd3948
SHA512 9ce16f89d3eb953b92fade0eff19f28f0d5023a38bf6a7ceae68b3d28b6e9c2b93a5b82828ad8fe3b96e500010a6f39c7b728b2580f2a56b37d6f4b570ddbfa3
SSDEEP 12288:OkGkh64OHxxstfDXj72PxiYsVbKzmNNvwPDbF32L072int5U5XtfpSbBr6:OkGknOH0Xj72PfsVb4mNMPR24xnHmdM6
TLSH
T16BD423E3101F9D2AF6D384F1A8A5D551D129E456FCF1D793E04686033FA82A4BE2F287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\unicodedata.pyd
Size 288KB
SHA256 60f811169ca85973b5253d3c5eebad20fd0b1285d7a9f1f309242cf7f2f37e24
MD5 3f17464857c1d6fc317dd37ac60f33e3
SHA1 565fa2cf2fab407fe3fbfa4c49af43efada051a5
SHA512 7fad688708762c974e043731fc92da2c0ee1e2b1f44c41cce65beae63d13c97f1216d389b14836217cab6701d550aae21c88b94a34a1c3ab3af4f601178fe1a9
SSDEEP 6144:Lm4kUN459i/3gBw0YsNcDxZtci8NNconmZ0Th7e0f:K4TyiIBw0YKif0NnmMhC0f
TLSH
T1E25423FF82E5C5A8E1673FF933C149587860B54BCEB4D16A30A442E48ED27464B23D6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_mlfwfdmw.mt2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mlfwfdmw.mt2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2040-96-0x00000224463F0000-0x00000224463FA000-memory.dmp

Download

memory/2040-95-0x000002245E6C0000-0x000002245E772000-memory.dmp

Download

memory/2040-92-0x0000022446430000-0x000002244644E000-memory.dmp

Download

memory/2040-85-0x0000022446400000-0x0000022446422000-memory.dmp

Download

memory/4644-34-0x00007FFB7C410000-0x00007FFB7C434000-memory.dmp

Download

memory/4644-103-0x00007FFB7C390000-0x00007FFB7C3BE000-memory.dmp

Download

memory/4644-72-0x00007FFB7C410000-0x00007FFB7C434000-memory.dmp

Download

memory/4644-69-0x00007FFB72270000-0x00007FFB72327000-memory.dmp

Download

memory/4644-82-0x00007FFB6FDC0000-0x00007FFB6FED8000-memory.dmp

Download

memory/4644-79-0x00007FFB7D440000-0x00007FFB7D44D000-memory.dmp

Download

memory/4644-78-0x00007FFB7DA30000-0x00007FFB7DA49000-memory.dmp

Download

memory/4644-63-0x00007FFB7C390000-0x00007FFB7C3BE000-memory.dmp

Download

memory/4644-40-0x00007FFB7DA30000-0x00007FFB7DA49000-memory.dmp

Download

memory/4644-75-0x00007FFB7C370000-0x00007FFB7C384000-memory.dmp

Download

memory/4644-36-0x00007FFB82380000-0x00007FFB8238F000-memory.dmp

Download

memory/4644-71-0x00007FFB69350000-0x00007FFB696C7000-memory.dmp

Download

memory/4644-68-0x00007FFB696D0000-0x00007FFB69B3E000-memory.dmp

Download

memory/4644-89-0x00007FFB7C3E0000-0x00007FFB7C40D000-memory.dmp

Download

memory/4644-43-0x00007FFB81C70000-0x00007FFB81C7D000-memory.dmp

Download

memory/4644-50-0x00007FFB7C3E0000-0x00007FFB7C40D000-memory.dmp

Download

memory/4644-54-0x00007FFB7C550000-0x00007FFB7C569000-memory.dmp

Download

memory/4644-59-0x00007FFB701F0000-0x00007FFB70359000-memory.dmp

Download

memory/4644-57-0x00007FFB7C3C0000-0x00007FFB7C3DF000-memory.dmp

Download

memory/4644-101-0x00007FFB7C3C0000-0x00007FFB7C3DF000-memory.dmp

Download

memory/4644-102-0x00007FFB701F0000-0x00007FFB70359000-memory.dmp

Download

memory/4644-70-0x0000026F22BC0000-0x0000026F22F37000-memory.dmp

Download

memory/4644-104-0x00007FFB72270000-0x00007FFB72327000-memory.dmp

Download

memory/4644-105-0x0000026F22BC0000-0x0000026F22F37000-memory.dmp

Download

memory/4644-106-0x00007FFB69350000-0x00007FFB696C7000-memory.dmp

Download

memory/4644-108-0x00007FFB7C410000-0x00007FFB7C434000-memory.dmp

Download

memory/4644-107-0x00007FFB696D0000-0x00007FFB69B3E000-memory.dmp

Download

memory/4644-121-0x00007FFB6FDC0000-0x00007FFB6FED8000-memory.dmp

Download

memory/4644-123-0x00007FFB7C410000-0x00007FFB7C434000-memory.dmp

Download

memory/4644-129-0x00007FFB7C3C0000-0x00007FFB7C3DF000-memory.dmp

Download

memory/4644-131-0x00007FFB7C390000-0x00007FFB7C3BE000-memory.dmp

Download

memory/4644-135-0x00007FFB7D440000-0x00007FFB7D44D000-memory.dmp

Download

memory/4644-136-0x00007FFB6FDC0000-0x00007FFB6FED8000-memory.dmp

Download

memory/4644-133-0x00007FFB69350000-0x00007FFB696C7000-memory.dmp

Download

memory/4644-29-0x00007FFB696D0000-0x00007FFB69B3E000-memory.dmp

Download

memory/4644-134-0x00007FFB7C370000-0x00007FFB7C384000-memory.dmp

Download

memory/4644-132-0x00007FFB72270000-0x00007FFB72327000-memory.dmp

Download

memory/4644-130-0x00007FFB701F0000-0x00007FFB70359000-memory.dmp

Download

memory/4644-128-0x00007FFB7C550000-0x00007FFB7C569000-memory.dmp

Download

memory/4644-127-0x00007FFB7C3E0000-0x00007FFB7C40D000-memory.dmp

Download

memory/4644-126-0x00007FFB81C70000-0x00007FFB81C7D000-memory.dmp

Download

memory/4644-125-0x00007FFB7DA30000-0x00007FFB7DA49000-memory.dmp

Download

memory/4644-124-0x00007FFB82380000-0x00007FFB8238F000-memory.dmp

Download

memory/4644-122-0x00007FFB696D0000-0x00007FFB69B3E000-memory.dmp

Download