7eba4c13f13dc0b7d74c863405cdc6ba6b9c354798a6ecd96165d442358c1e76

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe
Size 10.3MB
Sample260723-d8js6adm7v
SHA256 7eba4c13f13dc0b7d74c863405cdc6ba6b9c354798a6ecd96165d442358c1e76
MD5 d6b5805c4eeac7f3ce892a3d57b92472
SHA1 008f7b32a56606dd105667b1b1db179fb7b65937
SHA512 872669df57ae6a1bc4b22b51cfe3aa2193a37f7640de4d7a153c32a746e3e20e2a12ded53ae09d9ccad107d1e4bb07c16d5dc79c045d77a32f90e8cc9e0779c2
SSDEEP 98304:Ul4pxGHXQ9eCSOLYGl2f0B1QR+JY+uJ2+sgvfmIGrVIJaSf9pajUM2S:qEJYGlieJNuJ2a+IrJakCo
TLSH
T1DBB6BE03F78251E4D8CBC0BC43DAA73FAE3974584720A9E746D416B09E25AE06F3E765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 4 IoCs

resource	yara_rule
behavioral2/memory/3260-38-0x00007FF785BE0000-0x00007FF78663A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/files/0x000d00000001c4df-36.dat	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/1760-46-0x00007FF789EF0000-0x00007FF78A1C7000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/1760-90-0x00007FF789EF0000-0x00007FF78A1C7000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2548	powershell.exe
8	2548	powershell.exe
14	4632	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1176	powershell.exe
1660	powershell.exe
4708	powershell.exe
4100	powershell.exe
2548	powershell.exe
4632	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Deletes itself 1 IoCs

pid	Process
1176	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
1760	EventHandler.exe
2856	EventScheduler.exe
5380	BusDaemon.exe
6080	BusDaemon.exe
2960	BusDaemon.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\EventBus\bus\logs\search.log	BusDaemon.exe
File created	C:\Windows\INF\EventBus\bus\logs\nginx.pid	BusDaemon.exe
File opened for modification	C:\Windows\INF\EventBus\bus\logs\error.log	BusDaemon.exe
File opened for modification	C:\Windows\INF\EventBus\credentials.crt	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_21h3iyjt.xsw.psm1	powershell.exe
File opened for modification	C:\Windows\INF\EventBus\bus\conf\nginx.conf	powershell.exe
File opened for modification	C:\Windows\INF\EventBus\bus\logs\error.log	BusDaemon.exe
File opened for modification	C:\Windows\INF\EventBus\bus\conf\nginx.conf	powershell.exe
File opened for modification	C:\Windows\INF\EventBus\bus\logs\search.full.log	BusDaemon.exe
File opened for modification	C:\Windows\INF\EventBus\bus\logs\search.log	BusDaemon.exe
File opened for modification	C:\Windows\INF\EventBus\EventScheduler.exe	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe
File opened for modification	C:\Windows\INF\EventBus\EventHandler.exe	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_a3t40wws.4mc.ps1	powershell.exe
File opened for modification	C:\Windows\INF\EventBus\bus\logs\search.full.log	BusDaemon.exe
File opened for modification	C:\Windows\INF\EventBus\bus\BusDaemon.exe	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe
File opened for modification	C:\Windows\INF\EventBus\bus\reinitialize.cmd	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe
File opened for modification	C:\Windows\INF\EventBus\bus\conf\bus.conf.base	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe
File opened for modification	C:\Windows\INF\EventBus\bus\conf\cert.pem	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe
File opened for modification	C:\Windows\INF\EventBus\bus\conf\mime.types	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_le4bwu5m.25t.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_5bxuwyzq.aas.psm1	powershell.exe
File opened for modification	C:\Windows\INF\EventBus\bus\logs\error.log	BusDaemon.exe
File opened for modification	C:\Windows\INF\EventBus\bus\conf\cert.key	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_yt2om2el.t3t.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xvfjkffh.vn4.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vyy50gie.bjd.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_q0klh2aj.2bf.psm1	powershell.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5176	sc.exe
2104	sc.exe
5756	sc.exe
5888	sc.exe
2952	sc.exe
3272	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4428	cmd.exe
5680	cmd.exe
1124	cmd.exe
716	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BusDaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BusDaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BusDaemon.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
480	ipconfig.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4556	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4100	powershell.exe
4100	powershell.exe
1176	powershell.exe
1176	powershell.exe
1176	powershell.exe
2548	powershell.exe
2548	powershell.exe
2548	powershell.exe
1176	powershell.exe
1176	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
4632	powershell.exe
4632	powershell.exe
4632	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeIncreaseQuotaPrivilege	4100	powershell.exe
Token: SeSecurityPrivilege	4100	powershell.exe
Token: SeTakeOwnershipPrivilege	4100	powershell.exe
Token: SeLoadDriverPrivilege	4100	powershell.exe
Token: SeSystemProfilePrivilege	4100	powershell.exe
Token: SeSystemtimePrivilege	4100	powershell.exe
Token: SeProfSingleProcessPrivilege	4100	powershell.exe
Token: SeIncBasePriorityPrivilege	4100	powershell.exe
Token: SeCreatePagefilePrivilege	4100	powershell.exe
Token: SeBackupPrivilege	4100	powershell.exe
Token: SeRestorePrivilege	4100	powershell.exe
Token: SeShutdownPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeSystemEnvironmentPrivilege	4100	powershell.exe
Token: SeRemoteShutdownPrivilege	4100	powershell.exe
Token: SeUndockPrivilege	4100	powershell.exe
Token: SeManageVolumePrivilege	4100	powershell.exe
Token: 33	4100	powershell.exe
Token: 34	4100	powershell.exe
Token: 35	4100	powershell.exe
Token: 36	4100	powershell.exe
Token: SeDebugPrivilege	4556	taskkill.exe
Token: SeDebugPrivilege	1176	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 4100	3260	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe	89
PID 3260 wrote to memory of 816	3260	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe	92
PID 3260 wrote to memory of 480	3260	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe	94
PID 3260 wrote to memory of 268	3260	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe	96
PID 3260 wrote to memory of 4556	3260	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe	98
PID 3260 wrote to memory of 2952	3260	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe	101
PID 3260 wrote to memory of 5888	3260	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe	103
PID 3260 wrote to memory of 5756	3260	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe	105
PID 3260 wrote to memory of 2104	3260	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe	108
PID 3260 wrote to memory of 5176	3260	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe	110
PID 3260 wrote to memory of 3272	3260	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe	112
PID 2856 wrote to memory of 4428	2856	EventScheduler.exe	115
PID 3260 wrote to memory of 1176	3260	2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe	117
PID 4428 wrote to memory of 5680	4428	cmd.exe	119
PID 5680 wrote to memory of 2548	5680	cmd.exe	120
PID 4428 wrote to memory of 1660	4428	cmd.exe	122
PID 4428 wrote to memory of 5380	4428	cmd.exe	123
PID 2856 wrote to memory of 1124	2856	EventScheduler.exe	124
PID 1124 wrote to memory of 716	1124	cmd.exe	126
PID 716 wrote to memory of 4632	716	cmd.exe	127
PID 1124 wrote to memory of 4708	1124	cmd.exe	128
PID 1124 wrote to memory of 6080	1124	cmd.exe	129
PID 6080 wrote to memory of 2960	6080	BusDaemon.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe"
1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\INF\EventBus\
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- C:\Windows\system32\certutil.exe
  "certutil" -addstore -f Root C:\Windows\INF\EventBus\credentials.crt
  2⤵
  PID:816
- C:\Windows\system32\ipconfig.exe
  "ipconfig" /flushdns
  2⤵
  - Gathers network information
  PID:480
- C:\Windows\system32\certutil.exe
  "certutil" certutil -urlcache * delete
  2⤵
  PID:268
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4556
- C:\Windows\system32\sc.exe
  "sc.exe" create SystemEventManager binPath= C:\Windows\INF\EventBus\EventHandler.exe start= auto DisplayName= "System Event Manager"
  2⤵
  - Launches sc.exe
  PID:2952
- C:\Windows\system32\sc.exe
  "sc.exe" description SystemEventManager "Provides an interface for System Events to provide per-partition performance counters to the host operating system."
  2⤵
  - Launches sc.exe
  PID:5888
- C:\Windows\system32\sc.exe
  "sc.exe" start SystemEventManager
  2⤵
  - Launches sc.exe
  PID:5756
- C:\Windows\system32\sc.exe
  "sc.exe" create SystemEventsBus binPath= C:\Windows\INF\EventBus\EventScheduler.exe start= auto DisplayName= "System Events Bus"
  2⤵
  - Launches sc.exe
  PID:2104
- C:\Windows\system32\sc.exe
  "sc.exe" description SystemEventsBus "Tunnels execution requests for background work scheduled by WinRT application. If this service is stopped or disabled, then system components may not function correctly."
  2⤵
  - Launches sc.exe
  PID:5176
- C:\Windows\system32\sc.exe
  "sc.exe" start SystemEventsBus
  2⤵
  - Launches sc.exe
  PID:3272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Start-Sleep -Milliseconds 500; while (Get-Process -Id 3260 -ErrorAction SilentlyContinue) { Start-Sleep -Milliseconds 100 }; Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-23_d6b5805c4eeac7f3ce892a3d57b92472_akira_amadey_coinminer_darkgate_glassworm_luca-stealer_n.exe' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Deletes itself
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1176

C:\Windows\INF\EventBus\EventHandler.exe
C:\Windows\INF\EventBus\EventHandler.exe
1⤵
- Executes dropped EXE
PID:1760

C:\Windows\INF\EventBus\EventScheduler.exe
C:\Windows\INF\EventBus\EventScheduler.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\system32\cmd.exe
  cmd.exe /e:ON /v:OFF /d /c ""C:\Windows\INF\EventBus\bus\reinitialize.cmd""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "$r=Invoke-RestMethod -Uri 'https://dns.google/resolve' -Method Get -Body @{name='www.google.com';type='A'}; $r.Answer[0].data"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "$r=Invoke-RestMethod -Uri 'https://dns.google/resolve' -Method Get -Body @{name='www.google.com';type='A'}; $r.Answer[0].data"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-Content 'conf\bus.conf.base' -Raw).Replace('[IP]', ' ') | Set-Content 'conf\nginx.conf'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1660
- - C:\Windows\INF\EventBus\bus\BusDaemon.exe
    BusDaemon.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5380
- C:\Windows\system32\cmd.exe
  cmd.exe /e:ON /v:OFF /d /c ""C:\Windows\INF\EventBus\bus\reinitialize.cmd""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "$r=Invoke-RestMethod -Uri 'https://dns.google/resolve' -Method Get -Body @{name='www.google.com';type='A'}; $r.Answer[0].data"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "$r=Invoke-RestMethod -Uri 'https://dns.google/resolve' -Method Get -Body @{name='www.google.com';type='A'}; $r.Answer[0].data"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-Content 'conf\bus.conf.base' -Raw).Replace('[IP]', '142.251.157.119') | Set-Content 'conf\nginx.conf'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- - C:\Windows\INF\EventBus\bus\BusDaemon.exe
    BusDaemon.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6080
  - - C:\Windows\INF\EventBus\bus\BusDaemon.exe
      BusDaemon.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:2960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xanqiq15.tsu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xanqiq15.tsu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

EventHandler.exe

Path C:\Windows\INF\EventBus\EventHandler.exe
Size 2.8MB
SHA256 20615cff9da3ae96bb73787840b3b4cae76d80b9413cf0a6f88e564159cb3281
MD5 12c6c335a629873fd2613b9969679676
SHA1 452a6e9b301d6189cafe6668f612440e857a67bd
SHA512 6e0fdd1cc88dae432d423712b7d4dcdf5160681f8329b052740716e0509f7d9f282cfb611e9f05aa32ecb21242129125b8e7829f8e302d601c3936f565c086da
SSDEEP 49152:jdwbDF8QpPb3ReJBmUd7QRH4vMYYu4dOuzx58kBIU6isav9:j2f0B1QR+JY+uJ2+s
TLSH
T18AD57C13E29581FDC09EC1B8C386963AFA75B8DA0521767F0BE047312E69F605F0D76A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EventScheduler.exe

Path C:\Windows\INF\EventBus\EventScheduler.exe
Size 896KB
SHA256 eab9548a79b1d225165f887f236bd3f2f9e550f0c4878b57b47b5f1e726cd5e0
MD5 10695e339d363170d6efe62afc290ce7
SHA1 dafb4ca1a4f0482c24a263f6f4ced3bb27848185
SHA512 ec9cfaedb9e43b1f568d098f092a1b677f91bd12a42132e22c4d4c470bf584c4b0b8186b9feff7f0350c03fdbdd2174feab6cc6de398dbd42fbbde9528d4f8ec
SSDEEP 12288:JxQzJg3d/dB5isMhDno2pFV6gBp1HE94gSoeC9q8gs8ed6ux6:rQ9gN/dA962pS94HoeYq8gs8ed6R
TLSH
T17515AE57F6C192BDD55AC0B483468A72B53AB0C90221BCBF02E5D7343F99E664F1CB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BusDaemon.exe

Path C:\Windows\INF\EventBus\bus\BusDaemon.exe
Size 6.3MB
SHA256 c5a8592c7f15fc830d26b0ba83617c9962dc6cae6e2c039e3c7a1067371e8538
MD5 63367c170230e8f85d5f631a5c442071
SHA1 2950a20215a7d193f4223dd011ac4ec421d51993
SHA512 13e1d5ede1011f10418e46e3266b30ada4c507daba3bcaa68435d184eecfb42ebd34ef09264005331ad6cd86cd65e6ea0da09c2eedbbbbe355cd584dbec1561e
SSDEEP 49152:iGDQyvlG+6UG6E0pIx/PGyw0tJvC98rORKoPDhBs1x56RI3BSfwAlq+pfSjDzEMy:nvfmIGrVIJaSf9pajUM2S
TLSH
T1F766AE02FBC365D1E8C741BE02EE677F0E396624872598D3CA9424F5C9316D1AB3E7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bus.conf.base

Path C:\Windows\INF\EventBus\bus\conf\bus.conf.base
Size 1KB
SHA256 bd32049ff4d3db05e7e2827a01a4cd809e737cab3717ec36948545e59dedd53c
MD5 0aaf4083b52206d60adf2786f6cb1147
SHA1 1c6fa709d591c49bed8e1c003636a43ab0c04197
SHA512 8d8f642c4f6d69e0238a2a3f3e695f5df1e6071a0ba0c7ad48ff5e71ecf8b84010088f546ac758e1f3a269ac0e2a25ba7b22e421f96577c17e49234cfb53535f
TLSH
T14D2129D7AD0B600789B5D32F4E15A358FB2E905F26090685B79C96139FF0A498090DBC
MD5 SHA1 SHA512 TLSH

Submit Download

cert.key

Path C:\Windows\INF\EventBus\bus\conf\cert.key
Size 1KB
SHA256 31a6b18f293806578bb5c068a00e4d7db7cf5db2c70b50345f79759270aaa860
MD5 ec11cf9d7d1ea92869b9d8b33925540f
SHA1 9029acf941e63d03b88a61253bda536f53ebe93b
SHA512 bc41f1b24407321e9344bd2a9c44347676d68b686d5d95bc909341758a0a68ce0dbd4e77b347d13127e123cebae9e234accebddd7fa4ccff12b286c7ceea1e4d
TLSH
T1A23118C39F663C218F84E3BF8D8545882F9AA11A07F9E46D02D244932E37D043CE9964
MD5 SHA1 SHA512 TLSH

Submit Download

cert.pem

Path C:\Windows\INF\EventBus\bus\conf\cert.pem
Size 1KB
SHA256 e3282f66c747bedee2e83afb3a1b42dd985cd3942d5b5910998150cddb8748b6
MD5 8ed9947043a042d08abcb37f70ae9471
SHA1 224512a031ea0ed6d41b4b7f0579255c5c87973a
SHA512 9be9f01bd4de6c0ca7eed979e34459ebf59c46dbeae42ae2a425e49acc96ee142d77ea7720b5c91b52461b6d6c835c9a479714ef93f9a9a98060f6cc6e3331c2
TLSH
T1D2310AED0F207F183190F17881456031C48D29E64C6FD1002DB6D5F54949632A87CA7A
MD5 SHA1 SHA512 TLSH

Submit Download

mime.types

Path C:\Windows\INF\EventBus\bus\conf\mime.types
Size 5KB
SHA256 173da2ee9b08323bcfd77791e727c5f1df7f22072f65b4aa3a36d4dd9b1e2bd8
MD5 6b1b85cbf70154fc051e8057dc72b2ce
SHA1 fd2ce3ef17c7f703aab89d100387b258b3e9263e
SHA512 e91d4f79236a769b7208de7135503d810ba517679937f00eaec6b24fd9461cbf6c5302763531307b575293f1797e4b5b9075172f596e544776acde5b5ab44e96
SSDEEP 96:F+9bL2lolI8IaLI9GublInpMi9Z46O4FmHPm:Y1L2lcXxLKGfnpMi9Z46O4FmHPm
TLSH
T118B1F1D2691B44E15FF660BFAFB181D4F8A2202F1D839AC07E4D864C1F3525CC76A799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nginx.conf

Path C:\Windows\INF\EventBus\bus\conf\nginx.conf
Size 1KB
SHA256 fb2089941468600b25a7cc609e5bace313cede8eab4691c0bff9d40b6ad3ed41
MD5 71db97b72a489a779c6333a577e37aae
SHA1 c74c5d0f18476a33b3739697569159a8d30f144f
SHA512 70bde8a34a01a56686ef49b425069bcaa98cefc01368085254bcd148711c2c268262f367227c4f58179bf7c40d270c04821649a3f28d4c8e414cf4a2d97f43d2
TLSH
T161212697DE0B600789B5D32F4E15A358FB2EA05F26094685BB9C96139FF0A998090DBC
MD5 SHA1 SHA512 TLSH

Submit Download

nginx.conf

Path C:\Windows\INF\EventBus\bus\conf\nginx.conf
Size 1KB
SHA256 2f9d9315ef3af543849bad912915e390a5a9dbc35780793315fb23bc05a68bcc
MD5 3dda06ca6d083bb6e2eb65bc0984fcde
SHA1 7c2e0b7977f3393a6d2f6c53655edacff43b6c1b
SHA512 8d56e8a9cb5fda1c3953645df15cc08e375f359b3bb2360b6e274e66ad27c6c775d2fed3985841ea3873691533abcc86ea64c2e2b72728611751733e8d6b3692
TLSH
T11B215C939E0B641789B5C32F0E25A318FB2E901F66050685BB9D96139FF1A8980D5DBC
MD5 SHA1 SHA512 TLSH

Submit Download

error.log

Path C:\Windows\INF\EventBus\bus\logs\error.log
Size 144B
SHA256 3c25a085a070e5ce3574fdb38c89268229561bfa5ba0bd8dd87068e4b75143f6
MD5 40eb901deb0ddc46e7b6677eafdc1ab3
SHA1 5f2aef46de5561174f02fe0929be443de58e6a2c
SHA512 b6f267a0aef9c28eb5284bfe0d51d981a0f5fd692d02bafb315051e1d0a5c4b82f07da5b1f953e5ec28cd2fce38cf1226b72ebd597d092c18f91db0f12b7b005
TLSH
T1B8C02B01FFA419C1C0EF0784413EFD0057A000C6200562E434304B1C0677C021404681
MD5 SHA1 SHA512 TLSH

Submit Download

reinitialize.cmd

Path C:\Windows\INF\EventBus\bus\reinitialize.cmd
Size 381B
SHA256 4f790ca793555b9a1fec4f4a269de9e2b9eeb3518bb60793053e5883aeaed5db
MD5 7415f115f738cb59967707c9c1eeb0c2
SHA1 b87f2d3df089caed7212c4fd9b757b99ebee99bc
SHA512 cda09715a69c7a79856de418ffb3f794fd2bf6ca77108a8baef5fcb13b10fb674a9d86e0f85769060589857fdbad224145fce6524b9d55dbae7323671e7b976b
TLSH
T149E0F8233C8CA886215BD1BDA42AB46C2C3211C49114AC8A38E4E02A4AD1B60C092CFD
MD5 SHA1 SHA512 TLSH

Submit Download

credentials.crt

Path C:\Windows\INF\EventBus\credentials.crt
Size 1KB
SHA256 59293a3dbe352d9983697856afa197c59dac97bcb98b6b39ac1d2a42d32a121a
MD5 e4bc8e6eab29ca07a1139ee18b4ae797
SHA1 5e5850fbc481657626174bc682f0fd7544127df2
SHA512 ed3570054fb97ba17a3cd67035e61a6eb5f23b28f2ee70e425f5149365aad236a0f175e314446045cb5e6708a2cd53aa6f12035c2a15960dd74af1666e30d3b9
TLSH
T143310B555C623A5835E1B0231F4E06A1F086DAE4CA27E8700F2635DD920AB54CC7C7A9
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 5KB
SHA256 25aa0ddf87ef0bbe862591d9791d058a83081dc4a22126b54ebffe2698c5fa96
MD5 a9717d60fff8401c72defe8f76d28548
SHA1 0df24febf69907a293f07516542b7de9d5a4c396
SHA512 80aa9f6302a21f95952d2025888d6b3e570b10f8336d9a57fad90169ccf3e45aa5f5cb17b06171b7019d6f60d000c17143f4a40339dc69bff6d83142c1bf191a
SSDEEP 96:lCJ2Woe5Lpu1Qzsxzsb4bDgyg12jDs+un/iQLEYFjDaeWJ6KGcmXsFRLcU6/K69T:4xoe5LpOvib4bZgkjDt4iWN3yBGHodcU
TLSH
T139C142512D608BB6E6097F3EA1524852BF30399590D8297253C8DCEF11839B51A2F7AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6a0f6c545beaac7d95f6d759165f12ab79330c5a4214be90d4c3bd70a7466e0e
MD5 71c335411158d29b1ecf4aff8f563b0c
SHA1 5415d69ca139a19eb3375e2dfad2e6474582e9c0
SHA512 a339fb321041dc8598843f625ec72700310b8945709719268c4c0dc3a81246ae5b2f0a0df6dfba157a797e955996b6cfc44afcc3f540c9aa526b36fcfbbd2822
TLSH
T144215733F3CC86A4DC9A413650CEAC1136B787DB409EDEABAB84D559B42F689CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d92d529483d3340105c18086873cfbbc79ba2585fadb31c73c908545abc1f97c
MD5 3b20d8907f8fb0ef3fab55d52562262d
SHA1 ddb6693b9c25c3b647f7ab6f44715bef31577d49
SHA512 258d046884aa7d4d5f1dc90e617ba880c602d53bf576809be1dde22b9a886f6a0182b90a95eaf9904957b8dfa9c44f2620c520b93c9cb40a7d9dc73cec4ca6d3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a981ac817ccfad370480edfa5cbe058107fa36fefb8fd9df6b5c594829ab45c5
MD5 9aa03554806fd7500a70a039924dbd28
SHA1 7f2a70b18f232e3d8060915d8350cbbe36a19cd2
SHA512 70ab3bb7b699132768e76fb935f537051c793448855979caa7c3fd5a5745342c30c77be3f226e27234a43ac4ad551fb8c842efadc373c7fd0001127d5e971d84
TLSH
T1EE31AB63B3CC469EE845043997D99C10317ACBEBC0EEDED7AB84D504602E68ACE5C820
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1760-90-0x00007FF789EF0000-0x00007FF78A1C7000-memory.dmp

Download

memory/1760-46-0x00007FF789EF0000-0x00007FF78A1C7000-memory.dmp

Download

memory/2856-47-0x00007FF7AD5F0000-0x00007FF7AD6D6000-memory.dmp

Download

memory/2856-91-0x00007FF7AD5F0000-0x00007FF7AD6D6000-memory.dmp

Download

memory/3260-38-0x00007FF785BE0000-0x00007FF78663A000-memory.dmp

Download

memory/4100-11-0x000001FD5F320000-0x000001FD5F32A000-memory.dmp

Download

memory/4100-20-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/4100-16-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/4100-14-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/4100-17-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/4100-23-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/4100-22-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/4100-12-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/4100-15-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/4100-10-0x000001FD5F350000-0x000001FD5F402000-memory.dmp

Download

memory/4100-9-0x000001FD5F300000-0x000001FD5F31E000-memory.dmp

Download

memory/4100-13-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/4100-18-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/4100-0-0x00007FFEBC44F000-0x00007FFEBC450000-memory.dmp

Download

memory/4100-19-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/4100-6-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/4100-5-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/4100-4-0x000001FD5F260000-0x000001FD5F282000-memory.dmp

Download

memory/4100-1-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/4632-74-0x00000258EABE0000-0x00000258EB108000-memory.dmp

Download

memory/4632-73-0x00000258EA4E0000-0x00000258EA6A2000-memory.dmp

Download