svcstealer | 5667f0a7ca41474cfddd87d1e4c4757b8dbfcd420eba95c242b7e761a86bec0b

Analysis

max time kernel
65s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 05:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_de6ba18c8283a1c8484172f4a9d1bd16_cobalt-strike_icedid_satacom_vidar.exe
Size 32.1MB
Sample260817-gglp8aep8w
SHA256 5667f0a7ca41474cfddd87d1e4c4757b8dbfcd420eba95c242b7e761a86bec0b
MD5 de6ba18c8283a1c8484172f4a9d1bd16
SHA1 8002cf15658e64c8f0e311b7055aa837dbfedc3b
SHA512 6b7d7dcb530f14f08c77d9c96f1febf425224807ccd40711e433c6708df1da180b9e91d97762a3053d023d63f0e9141f46593ba9ca0d22ed69245a8d3bed19b5
SSDEEP 786432:QBUiVe3nJYonLbeLCGMAJSBy+RKCUe3q+Q:SEbBT4ij
TLSH
T1817733AD372830FBEEFA12F2465177057221E13C25545B3FB8751484AE2935A8BB6BB0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader execution svcstealer installer persistence privilege_escalation spyware stealer

Malware Config

Signatures

Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Detects SvcStealer Payload 2 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
behavioral2/files/0x000e00000001c42d-4.dat	family_svcstealer
behavioral2/files/0x000d00000001c432-20.dat	family_svcstealer

Detect binaries embedding considerable number of MFA browser extension IDs. 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c42d-4.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/files/0x000d00000001c432-20.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c42d-4.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/files/0x000d00000001c432-20.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
behavioral2/memory/4376-21-0x00000174B0EE0000-0x00000174B0EE2000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c42d-4.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x000d00000001c432-20.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c42d-4.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/files/0x000d00000001c432-20.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing common artifacts observed in infostealers 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c42d-4.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x000d00000001c432-20.dat	INDICATOR_SUSPICIOUS_GENInfoStealer

Detects executables referencing many IR and analysis tools 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c42d-4.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/files/0x000d00000001c432-20.dat	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c42d-4.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/files/0x000d00000001c432-20.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Downloads MZ/PE file 3 IoCs

flow	pid	Process
14	3264	pykhtpcx.exe
14	3264	pykhtpcx.exe
16	3264	pykhtpcx.exe

Executes dropped EXE 18 IoCs

pid	Process
3264	pykhtpcx.exe
1852	q4pgpk3l.exe
5448	4zy59vvf.exe
2124	eboc4b1q.exe
3872	wlrmdr.exe
4580	7sw1l3yp.exe
2528	9kbllz6h.exe
5812	7sw1l3yp.exe
5764	cryptsvcbet.exe
5524	RUTE.exe
5340	ocaw.exe
4456	ocaw.exe
4904	3B101F360BDC41ADBF59.exe
2520	215ECDE2D68C47EE9AEA.exe
3484	215ECDE2D68C47EE9AEA.tmp
3368	3B101F360BDC41ADBF59.exe
2408	242A4ED68E144B27AD8E.exe
1720	242A4ED68E144B27AD8E.tmp

Loads dropped DLL 3 IoCs

pid	Process
3484	215ECDE2D68C47EE9AEA.tmp
3484	215ECDE2D68C47EE9AEA.tmp
1720	242A4ED68E144B27AD8E.tmp

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\cryptsvcbet.exe"	eboc4b1q.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7sw1l3yp.exe"	7sw1l3yp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7sw1l3yp.exe"	7sw1l3yp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\ocaw.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Yxypix\\ocaw.exe"	ocaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3B101F360BDC41ADBF59.exe"	3B101F360BDC41ADBF59.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3B101F360BDC41ADBF59.exe"	3B101F360BDC41ADBF59.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4580 set thread context of 4376	4580	7sw1l3yp.exe	59
PID 5812 set thread context of 4376	5812	7sw1l3yp.exe	59
PID 4904 set thread context of 4444	4904	3B101F360BDC41ADBF59.exe	60
PID 3368 set thread context of 4444	3368	3B101F360BDC41ADBF59.exe	60

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3428	cmd.exe
4236	cmd.exe
3208	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	215ECDE2D68C47EE9AEA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	215ECDE2D68C47EE9AEA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	242A4ED68E144B27AD8E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	242A4ED68E144B27AD8E.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x001100000001c443-404.dat	innosetup
behavioral2/files/0x000e00000001c445-420.dat	innosetup

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
1852	q4pgpk3l.exe
1852	q4pgpk3l.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe
3264	pykhtpcx.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5936	explorer.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeSecurityPrivilege	2528	9kbllz6h.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe
Token: SeShutdownPrivilege	5936	explorer.exe
Token: SeCreatePagefilePrivilege	5936	explorer.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 3264	1384	2026-08-17_de6ba18c8283a1c8484172f4a9d1bd16_cobalt-strike_icedid_satacom_vidar.exe	89
PID 1384 wrote to memory of 1852	1384	2026-08-17_de6ba18c8283a1c8484172f4a9d1bd16_cobalt-strike_icedid_satacom_vidar.exe	90
PID 1852 wrote to memory of 4376	1852	q4pgpk3l.exe	59
PID 1852 wrote to memory of 4444	1852	q4pgpk3l.exe	60
PID 1852 wrote to memory of 4564	1852	q4pgpk3l.exe	81
PID 1852 wrote to memory of 5936	1852	q4pgpk3l.exe	82
PID 5936 wrote to memory of 2880	5936	explorer.exe
PID 1384 wrote to memory of 5448	1384	2026-08-17_de6ba18c8283a1c8484172f4a9d1bd16_cobalt-strike_icedid_satacom_vidar.exe	92
PID 1384 wrote to memory of 2124	1384	2026-08-17_de6ba18c8283a1c8484172f4a9d1bd16_cobalt-strike_icedid_satacom_vidar.exe	94
PID 1384 wrote to memory of 4580	1384	2026-08-17_de6ba18c8283a1c8484172f4a9d1bd16_cobalt-strike_icedid_satacom_vidar.exe	96
PID 5936 wrote to memory of 124	5936	explorer.exe
PID 5936 wrote to memory of 248	5936	explorer.exe
PID 1384 wrote to memory of 2528	1384	2026-08-17_de6ba18c8283a1c8484172f4a9d1bd16_cobalt-strike_icedid_satacom_vidar.exe	99
PID 4580 wrote to memory of 4376	4580	7sw1l3yp.exe	59
PID 5812 wrote to memory of 4376	5812	7sw1l3yp.exe	59
PID 1384 wrote to memory of 5524	1384	2026-08-17_de6ba18c8283a1c8484172f4a9d1bd16_cobalt-strike_icedid_satacom_vidar.exe	102
PID 2528 wrote to memory of 5340	2528	9kbllz6h.exe	106
PID 5340 wrote to memory of 5936	5340	ocaw.exe	82
PID 2528 wrote to memory of 3428	2528	9kbllz6h.exe	107
PID 5936 wrote to memory of 3388	5936	explorer.exe
PID 3264 wrote to memory of 5740	3264	pykhtpcx.exe	112
PID 3264 wrote to memory of 5740	3264	pykhtpcx.exe	112
PID 3264 wrote to memory of 2756	3264	pykhtpcx.exe	115
PID 3264 wrote to memory of 2756	3264	pykhtpcx.exe	115
PID 3264 wrote to memory of 4236	3264	pykhtpcx.exe	116
PID 4236 wrote to memory of 5688	4236	cmd.exe	118
PID 3264 wrote to memory of 4904	3264	pykhtpcx.exe	119
PID 3264 wrote to memory of 2520	3264	pykhtpcx.exe	120
PID 5936 wrote to memory of 3932	5936	explorer.exe
PID 4904 wrote to memory of 4444	4904	3B101F360BDC41ADBF59.exe	60
PID 2520 wrote to memory of 3484	2520	215ECDE2D68C47EE9AEA.exe	122
PID 3264 wrote to memory of 2408	3264	pykhtpcx.exe	124
PID 3368 wrote to memory of 4444	3368	3B101F360BDC41ADBF59.exe	60
PID 2408 wrote to memory of 1720	2408	242A4ED68E144B27AD8E.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4376

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4444

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4564
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Users\Admin\AppData\Local\Temp\2026-08-17_de6ba18c8283a1c8484172f4a9d1bd16_cobalt-strike_icedid_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_de6ba18c8283a1c8484172f4a9d1bd16_cobalt-strike_icedid_satacom_vidar.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\pykhtpcx.exe
      "C:\Users\Admin\AppData\Local\Temp\pykhtpcx.exe"
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3264
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox
        5⤵
        
        PID:5740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox
        5⤵
        
        PID:2756
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\" 2>nul"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4236
      - C:\Windows\system32\netsh.exe
        
        netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\"
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\3B101F360BDC41ADBF59.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3B101F360BDC41ADBF59.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\215ECDE2D68C47EE9AEA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\215ECDE2D68C47EE9AEA.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\is-0VY89FOCIF.tmp\215ECDE2D68C47EE9AEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-0VY89FOCIF.tmp\215ECDE2D68C47EE9AEA.tmp" /SL5="$110084,2775941,905728,C:\Users\Admin\AppData\Local\Temp\215ECDE2D68C47EE9AEA.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\242A4ED68E144B27AD8E.exe
        
        "C:\Users\Admin\AppData\Local\Temp\242A4ED68E144B27AD8E.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\is-A73X42C8DF.tmp\242A4ED68E144B27AD8E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-A73X42C8DF.tmp\242A4ED68E144B27AD8E.tmp" /SL5="$500B2,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\242A4ED68E144B27AD8E.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\q4pgpk3l.exe
      "C:\Users\Admin\AppData\Local\Temp\q4pgpk3l.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\4zy59vvf.exe
      "C:\Users\Admin\AppData\Local\Temp\4zy59vvf.exe"
      4⤵
      Executes dropped EXE
      PID:5448
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox
        5⤵
        
        PID:6068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox
        5⤵
        
        PID:2768
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\" 2>nul"
        5⤵
        Executes a command shell one-liner
        
        PID:3208
      - C:\Windows\system32\netsh.exe
        
        netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\"
        6⤵
        
        PID:1420
  - - C:\Users\Admin\AppData\Local\Temp\eboc4b1q.exe
      "C:\Users\Admin\AppData\Local\Temp\eboc4b1q.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\7sw1l3yp.exe
      "C:\Users\Admin\AppData\Local\Temp\7sw1l3yp.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\9kbllz6h.exe
      "C:\Users\Admin\AppData\Local\Temp\9kbllz6h.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\Users\Admin\AppData\Roaming\Yxypix\ocaw.exe
        
        "C:\Users\Admin\AppData\Roaming\Yxypix\ocaw.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:5340
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpaaa71c8c.bat"
        5⤵
        Executes a command shell one-liner
        
        PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\RUTE.exe
      "C:\Users\Admin\AppData\Local\Temp\RUTE.exe"
      4⤵
      Executes dropped EXE
      PID:5524

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
1⤵
- Executes dropped EXE
PID:3872

C:\Users\Admin\AppData\Local\Temp\7sw1l3yp.exe
C:\Users\Admin\AppData\Local\Temp\7sw1l3yp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5812

C:\Users\Admin\AppData\Roaming\cryptsvcbet.exe
C:\Users\Admin\AppData\Roaming\cryptsvcbet.exe
1⤵
- Executes dropped EXE
PID:5764

C:\Users\Admin\AppData\Roaming\Yxypix\ocaw.exe
C:\Users\Admin\AppData\Roaming\Yxypix\ocaw.exe
1⤵
- Executes dropped EXE
PID:4456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5192

C:\Users\Admin\AppData\Local\Temp\3B101F360BDC41ADBF59.exe
C:\Users\Admin\AppData\Local\Temp\3B101F360BDC41ADBF59.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

215ECDE2D68C47EE9AEA.exe

Path C:\Users\Admin\AppData\Local\Temp\215ECDE2D68C47EE9AEA.exe
Size 11.8MB
SHA256 6c555cf90603114a43bdea6966bc6562de8187678ffafa0e50544561e5c32061
MD5 f6481e5a46c72784eca66dd60dcd7e70
SHA1 a1e9b0b4b00cb91af02801ac12761e1215270551
SHA512 244a4e059692936bbc4c9567ad5186e6d3fcd669d87563dd15858692fead88eba400a0dc58296d2aadf2057be6762b4987dda29283c99d0b7815f806e3f959ea
SSDEEP 98304:E5OkH+3qndcIM57t775sQdfTQn1gTTXeP8ElMIxo:gC3qnu575rTY2eP8
TLSH
T156C6F17BA18BBDBAE07B15353EB2A210553B6B5065124C029BECC44DDF250B92F3E787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

242A4ED68E144B27AD8E.exe

Path C:\Users\Admin\AppData\Local\Temp\242A4ED68E144B27AD8E.exe
Size 13.1MB
SHA256 42d3f82fdc329abbfea289482b70b0a93adee02963306d6680cc047140dd794a
MD5 988c557adf7da2bb023305f07c5cceac
SHA1 8e32ccb260cb531aa8de8c9f585bc765841d566a
SHA512 a73835bd2ef2131a22da20d0121681a65e5dcdaa39afdb564041e61e5e4af50d0fad69a1f7fffa177b7d85249eb2338d9465383ce1c00d0443318215422796e1
SSDEEP 98304:voJJqPg6ziVAQhCydt9JuQcpF4JorePYPAMo7Bmpbn5RjQC73I1jw6NeHAFMSj:6eg6zoAQXdVyyPgfo70pbngCLI1c6w
TLSH
T155D60233A189602AE06D563745B79285853B6E687C218D1DA7F03D5CFB3F3603927B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4zy59vvf.exe

Path C:\Users\Admin\AppData\Local\Temp\4zy59vvf.exe
Size 2.3MB
SHA256 f36e78186fbd277bf7fde60d795dee4ec10531ae28ce63f46312a2a20d9da901
MD5 c509dc68dee52fa310a763a3e2510643
SHA1 0c8dab58bb0fb421089c06ceed5df21ec35ffbff
SHA512 5eb12373223e3fec7d74ad2ed57b99d3a8eedef6eff8a6654d6ca20357c1960c78d762664620d0170a1b6fea4962668cf942ae114ef4cb9f1d8f83e21a282347
SSDEEP 49152:4e2n/GN8i6JmPXcjgR2Z3Au/PJvTs6xBC:nCgRa/54
TLSH
T177B59E4AA3A802FDE0FBD274C9165A07D7B2B8461674D79F13D0479A2F23B715E2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7sw1l3yp.exe

Path C:\Users\Admin\AppData\Local\Temp\7sw1l3yp.exe
Size 1.1MB
SHA256 4acd7adff5c2193e7b0b9a6f8235534d67772ff3d7fa59b1215de011d7455ad9
MD5 5397d935f89da936fe739139a99c7b47
SHA1 27adcb8fc4c6685c35819569895a8afac75f1b1d
SHA512 32fcb9db51cb8ff24f47897535dea5ca671e79ed207e9f3083e83034ad523e8a628831f9ebc0b61aa5f3025b3a395e887c24f257918ef2a86913f1a7c6ec158f
SSDEEP 12288:RPhnbZIqgm1W6GTt/nUWxwsLkzEc3lktyamaghtXhDmZA83bTe6rbBpcYm:DnbZVs6G3NLkzEGlu6zWrTeobBpc
TLSH
T184359E2AFED25111DD7ED3B3BD30FE189646200583522E7A279F4EC46813C96ADA335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9kbllz6h.exe

Path C:\Users\Admin\AppData\Local\Temp\9kbllz6h.exe
Size 216KB
SHA256 f5552210d30af1847134a532d8046b1d979b16cafaa2afe4b898feb453b753d4
MD5 2078a0901a9237757094fe3597c184ec
SHA1 308a2ea223ccf2d50b827ed2dc2b293abfa12d52
SHA512 af27f2442fdbbc17c6985b437979820d4ecf109830b4ae043b8127d9d0e79703eb757bb84728ad5709c911360efa18983c45104a8226d5761a1124745c80c930
SSDEEP 3072:2Au/wJ+GbVssPjKuBUm9qUPKZADspagfZ+ix1FdxETc5ZHxj3pX:2A4wJxbVssP2uBJ93PKZnrnxEsZ/X
TLSH
T176249E1AB5E45BB8F9AFD135C5857A26C1B2744A5B30D38F22B4CE962F13332E12D342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RUTE.exe

Path C:\Users\Admin\AppData\Local\Temp\RUTE.exe
Size 25.9MB
SHA256 91c7a2b3c010046ec847d5891a5d401fa787ad9e1534d197bfa6003d862fd913
MD5 827dc294ae3413bab43854d646d25a65
SHA1 964a0db2b1707ff8b5317c1bb4d715b3d5c052e0
SHA512 ab12d8b70810d4e347ac4e0af84e9b7c0bf299b203b37f993aa433ecef1210b73356dce723029210d3b0d449390e9746bea794204e4f1ca22bab874e905d7ea7
SSDEEP 393216:xXAocj8P59iWP9jaqQqA9eZxVccwe6Gs7qd9gwpaHu4Lj21ViR:xXcjwZayGwIHu4L
TLSH
T12F57AE1A93950A72D82BDA38C696C333DAB17DA15636C20F091DF6011FB7972CF6F612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eboc4b1q.exe

Path C:\Users\Admin\AppData\Local\Temp\eboc4b1q.exe
Size 166KB
SHA256 fcbe9f2d0f07f6c40b258228148fb61e94f4dc59962f2fd4e3ed3051d90cfa3b
MD5 b61499aed9660923cde55a2cd3c88cc5
SHA1 8b1260a28e06c9c0c2d5ae48195aab24926901d3
SHA512 ee96b28539d8a6f75a0e3678420f8e764f26ec36a91c07e1b66421bbd2d723ed818a3ed7dd756a0d70aaac8a1c73960f67f1888ca9cfd99750a465af1ba8461d
SSDEEP 3072:btJ2fCsQiuzYJ8WreWgxgjIFafthDCMfCvOvHXrbl5STd:bwCszCYJ8OcgsaftB
TLSH
T1FDF37D4A73E510FDE1778139C9551A05F372782207209BAF07A047BA9F272E1AD3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

215ECDE2D68C47EE9AEA.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-0VY89FOCIF.tmp\215ECDE2D68C47EE9AEA.tmp
Size 4.2MB
SHA256 3a62ca6296bbb01dea01d20db87eb23ece3ba0360ac5d9174d5ef68bbe31d2ff
MD5 e2419d34fbcb35ebf8022e5bf423befd
SHA1 94bf494102ad88f4d53bcea2d1b230dcf89478ea
SHA512 562e629c4a082d7b4cf33505859ef0e8bf60b28762e6888d5502ea5a18491cbc7b7d67c01e28c02d394dacacdcd7de73cca09d9cdcd0a1fa9c9ba36b9830191b
SSDEEP 98304:w9SZUvl30aj90ZFcvdQ0hdgvminQLMj+J8333H:HItJj90Z6RgKwJ
TLSH
T18D168E13B388793AE4B71A3A8C3FA250593F7A213916CD4B6BF4095C4F396417E2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

242A4ED68E144B27AD8E.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-A73X42C8DF.tmp\242A4ED68E144B27AD8E.tmp
Size 4.3MB
SHA256 8a71d9a7963fbb1904e8d43ec3aaec927c1a94ed78376baf8fdd8fa46f7533ef
MD5 33453f6a4881d9959e8f964a185e1e04
SHA1 5adb5722c611dbeceba40d753c766211bc461787
SHA512 2572420402140eec620b219d7db73e05f4ef210ffe9cc0608edd399c42ec9d1a990330bcace4653156f0f389a4d72acb77d2f6817744672d46a96bf71283a789
SSDEEP 49152:6eGyzK5YtS9+SmpPvOwUNSdi1NsF+QxvCs7F5uhJBP4ji2333DneQ:6eGwK5YHCNmi16F+QxvCeFLm2333zB
TLSH
T148267E13B688753ED4A71A3B483BA684983B7E213A11CC4B7BF42D4C9E3D740AD26757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-PBV3DD91VC.tmp\_isetup\_isdecmp.dll
Size 34KB
SHA256 31d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26
MD5 c6ae924ad02500284f7e4efa11fa7cfc
SHA1 2a7770b473b0a7dc9a331d017297ff5af400fed8
SHA512 f321e4820b39d1642fc43bf1055471a323edcc0c4cbd3ddd5ad26a7b28c4fb9fc4e57c00ae7819a4f45a3e0bb9c7baa0ba19c3ceedacf38b911cdf625aa7ddae
SSDEEP 768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
TLSH
T11EF23AA1BDED1F53DA8A0A3056C994235C31E1D44B0008F7D5D9CA672A8E3A75FB329F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-QUG4V7W7AO.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pykhtpcx.exe

Path C:\Users\Admin\AppData\Local\Temp\pykhtpcx.exe
Size 2.3MB
SHA256 ea449d04d3a664eadbff4e054b1717ce36db82c40d27f179833cf15118de9e73
MD5 158a748771be8a06b496a410516d63a9
SHA1 a5926b439887f3f8d4f6b2686c5d4081673ff862
SHA512 491f1f18dc0f03261b5984255036e37c930cf368d7c11df4aead335a2feb8dcae366b575d4d2f3114d53e396568bdd1b940a20749ff562614dfb746d261b46bc
SSDEEP 49152:Lp2n/GN8i6JmPXcjxR2Z3Au/PJvTs6EBC:xCxRa/54
TLSH
T1FAB59E4AA3A802FDE0FBD274C9165A07D7B2B8461674D79F13D0479A2F23B715E2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

q4pgpk3l.exe

Path C:\Users\Admin\AppData\Local\Temp\q4pgpk3l.exe
Size 54KB
SHA256 985ead812b8b99573d2567169d73968a3754b4fbea16447bea2ac878974e6110
MD5 26b59bc7336133a5e2f3c696584a9cb9
SHA1 bc2f26426ab52186449688d6e56326a4ef65de27
SHA512 6292a2c4e44449cd7f02aebb2b3f3f6c6b9425c851b75946575004a84b075ab9a26dd2cd705b5dbd41d9eaf672217ed7c0e611b6c99bd0190e3a001986085b36
SSDEEP 1536:KP2AunwYLdkqx4sOLsWz129UXMRRpUafq8LECJu:znXfqLsWJ2LRJfq8Lbu
TLSH
T1ED43082653A213B9D9EAC636C9F4533BF1F07542BA26931F0378F6281B73742751CAA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaaa71c8c.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpaaa71c8c.bat
Size 195B
SHA256 0af2cacaade31c9381a2119fe40e0e22c934eba91a4001de56486ccfcda6fa7b
MD5 9d8e1afc1c29a3d9691fc8b9573f7879
SHA1 1077b5134a875830ec8590db200b4c181ba9505d
SHA512 050eed092a8a8710ff2ebb8fd74328eafe9fc8803306e31fcdd81578a510fbc9adc28cc206fa80c7514d1e6d108d2a92b6967e502805c1b3485a8c70807271ea
TLSH
T119D0220741C3C75A1848A02B4AA5218DC07C0C583FCAB7384220CC8C71E382DF5C7341
MD5 SHA1 SHA512 TLSH

Submit Download

ocaw.exe

Path C:\Users\Admin\AppData\Roaming\Yxypix\ocaw.exe
Size 216KB
SHA256 51c2789f3490ae840f243f0034fed27a3cff6ea009b01026c99dc471073a4a84
MD5 a27536c7bfe636cc9aca743490810a61
SHA1 d2db5712fc3cf56ab2e438643c74fd6fb79e184d
SHA512 e9fe41a0d42ad53251ed61d23f85b4d306c7559fa9ab16c0f851e2bc9bf3d75f50f1613263f650853940ff5d700ba526e631c06973db114fe33db2da919a3acf
SSDEEP 3072:2Au/wJ+GbVssPjKuBUm9qUPKZADspagfZ+ix1FdxETc5ZHxj3pL:2A4wJxbVssP2uBJ93PKZnrnxEsZ/L
TLSH
T1FA249E1AB5E45BB8F9AFD135C5857A26C1B2744A5B31D3CF22B4CE962F13332A12D342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2528-123-0x0000000004260000-0x0000000004286000-memory.dmp

Download

memory/2528-114-0x0000000002870000-0x00000000028B8000-memory.dmp

Download

memory/2528-124-0x0000000004A30000-0x000000000525A000-memory.dmp

Download

memory/2528-125-0x0000000004340000-0x0000000004413000-memory.dmp

Download

memory/2528-90-0x0000000000490000-0x0000000000557000-memory.dmp

Download

memory/2528-91-0x00000000006B0000-0x0000000000A51000-memory.dmp

Download

memory/2528-92-0x0000000000B40000-0x0000000000BDD000-memory.dmp

Download

memory/2528-93-0x0000000000CE0000-0x0000000000EA3000-memory.dmp

Download

memory/2528-95-0x0000000000FB0000-0x000000000100D000-memory.dmp

Download

memory/2528-126-0x0000000004430000-0x0000000004465000-memory.dmp

Download

memory/2528-94-0x0000000000EF0000-0x0000000000FA2000-memory.dmp

Download

memory/2528-98-0x0000000000EB0000-0x0000000000EB8000-memory.dmp

Download

memory/2528-96-0x0000000001010000-0x0000000001706000-memory.dmp

Download

memory/2528-100-0x0000000001A90000-0x0000000001B04000-memory.dmp

Download

memory/2528-102-0x0000000000EC0000-0x0000000000ECD000-memory.dmp

Download

memory/2528-101-0x0000000001B10000-0x0000000001C86000-memory.dmp

Download

memory/2528-99-0x0000000001740000-0x00000000018D9000-memory.dmp

Download

memory/2528-107-0x0000000001960000-0x000000000198A000-memory.dmp

Download

memory/2528-108-0x0000000001F50000-0x0000000001FF9000-memory.dmp

Download

memory/2528-111-0x0000000002280000-0x00000000023CB000-memory.dmp

Download

memory/2528-112-0x00000000023D0000-0x00000000024E6000-memory.dmp

Download

memory/2528-113-0x00000000024F0000-0x000000000286C000-memory.dmp

Download

memory/2528-122-0x00000000042A0000-0x0000000004339000-memory.dmp

Download

memory/2528-103-0x0000000001C90000-0x0000000001F13000-memory.dmp

Download

memory/2528-121-0x0000000004250000-0x000000000425C000-memory.dmp

Download

memory/2528-120-0x0000000004210000-0x0000000004248000-memory.dmp

Download

memory/2528-115-0x00000000028C0000-0x00000000029E1000-memory.dmp

Download

memory/2528-119-0x0000000002170000-0x000000000218C000-memory.dmp

Download

memory/2528-118-0x00000000020F0000-0x000000000211F000-memory.dmp

Download

memory/2528-117-0x00000000020D0000-0x00000000020DD000-memory.dmp

Download

memory/2528-116-0x00000000020B0000-0x00000000020CB000-memory.dmp

Download

memory/2528-104-0x00000000018E0000-0x00000000018FA000-memory.dmp

Download

memory/2528-110-0x00000000021D0000-0x0000000002273000-memory.dmp

Download

memory/2528-109-0x0000000002000000-0x00000000020A7000-memory.dmp

Download

memory/2528-106-0x0000000001930000-0x0000000001957000-memory.dmp

Download

memory/2528-105-0x0000000001900000-0x000000000190B000-memory.dmp

Download

memory/4376-63-0x00000174B2360000-0x00000174B2392000-memory.dmp

Download

memory/4376-22-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/4376-21-0x00000174B0EE0000-0x00000174B0EE2000-memory.dmp

Download

memory/5340-143-0x0000000001DB0000-0x0000000001DBB000-memory.dmp

Download

memory/5340-134-0x0000000000FB0000-0x000000000100D000-memory.dmp

Download

memory/5340-130-0x00000000006E0000-0x0000000000A81000-memory.dmp

Download

memory/5340-129-0x0000000000610000-0x00000000006D7000-memory.dmp

Download

memory/5340-131-0x0000000000B70000-0x0000000000C0D000-memory.dmp

Download

memory/5340-136-0x00000000004D0000-0x00000000004D8000-memory.dmp

Download

memory/5340-137-0x0000000001740000-0x00000000018D9000-memory.dmp

Download

memory/5340-146-0x0000000001E50000-0x0000000001EF9000-memory.dmp

Download

memory/5340-139-0x00000000019A0000-0x0000000001B16000-memory.dmp

Download

memory/5340-145-0x0000000001DF0000-0x0000000001E1A000-memory.dmp

Download

memory/5340-144-0x0000000001DC0000-0x0000000001DE7000-memory.dmp

Download

memory/5340-138-0x0000000001920000-0x0000000001994000-memory.dmp

Download

memory/5340-142-0x00000000018F0000-0x000000000190A000-memory.dmp

Download

memory/5340-140-0x00000000018E0000-0x00000000018ED000-memory.dmp

Download

memory/5340-133-0x0000000000EF0000-0x0000000000FA2000-memory.dmp

Download

memory/5340-132-0x0000000000D10000-0x0000000000ED3000-memory.dmp

Download

memory/5936-88-0x00000000034F0000-0x0000000003532000-memory.dmp

Download

memory/5936-86-0x00000000034F0000-0x0000000003532000-memory.dmp

Download

memory/5936-127-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Download

memory/5936-87-0x00000000034F0000-0x0000000003532000-memory.dmp

Download

memory/5936-59-0x0000000002D80000-0x0000000002D81000-memory.dmp

Download

memory/5936-60-0x0000000002E90000-0x0000000002E91000-memory.dmp

Download

memory/5936-33-0x0000000002D50000-0x0000000002D51000-memory.dmp

Download

memory/5936-85-0x00000000034F0000-0x0000000003532000-memory.dmp

Download

memory/5936-84-0x00000000034F0000-0x0000000003532000-memory.dmp

Download