salatstealer | f0bd8ebb53b50439b45c03bb7c37a51a4adf75e0d95efe95807a4fe9267c98ef

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_1067db1b9185bd74672605164fe71ed0_akira_elex_glassworm.exe
Size 3.8MB
Sample260831-23frbaszaz
SHA256 f0bd8ebb53b50439b45c03bb7c37a51a4adf75e0d95efe95807a4fe9267c98ef
MD5 1067db1b9185bd74672605164fe71ed0
SHA1 60a87c4fd9b6f2ea4e5f0e21489ee1b529d12b06
SHA512 f06c6b6af0a071d1067132c0047ceffb8d2d844ba59ff358275eba9a11940dddd4df5fd734e1bb20ceae14d167c16556bd75d8e0d049f7f201c213f24f6a6a98
SSDEEP 98304:zjJk+ezJWscHniesMddNojwI2w0xz6UpL+SmzvuWa33:z17ezMtnnddNojw+9Up93
TLSH
T1B9062349E65348F5E577227100BFA23FF2345A0D8406DDAFDFAA5C66FB2F7001918A29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery salatstealer spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 36 IoCs

resource	yara_rule
behavioral2/memory/1304-5-0x0000000001C50000-0x00000000028A5000-memory.dmp	family_salatstealer
behavioral2/memory/1304-4-0x0000000001C50000-0x00000000028A5000-memory.dmp	family_salatstealer
behavioral2/memory/1304-8-0x0000000001C50000-0x00000000028A5000-memory.dmp	family_salatstealer
behavioral2/memory/1304-7-0x0000000001C50000-0x00000000028A5000-memory.dmp	family_salatstealer
behavioral2/memory/1304-9-0x0000000001C50000-0x00000000028A5000-memory.dmp	family_salatstealer
behavioral2/memory/1304-6-0x0000000001C50000-0x00000000028A5000-memory.dmp	family_salatstealer
behavioral2/memory/1304-11-0x0000000001C50000-0x00000000028A5000-memory.dmp	family_salatstealer
behavioral2/memory/1304-12-0x0000000001C50000-0x00000000028A5000-memory.dmp	family_salatstealer
behavioral2/memory/1304-14-0x0000000001C50000-0x00000000028A5000-memory.dmp	family_salatstealer
behavioral2/memory/1304-15-0x0000000001C50000-0x00000000028A5000-memory.dmp	family_salatstealer
behavioral2/memory/1304-24-0x0000000001C50000-0x00000000028A5000-memory.dmp	family_salatstealer
behavioral2/memory/3512-32-0x0000000002130000-0x0000000002D85000-memory.dmp	family_salatstealer
behavioral2/memory/3512-34-0x0000000002130000-0x0000000002D85000-memory.dmp	family_salatstealer
behavioral2/memory/3512-36-0x0000000002130000-0x0000000002D85000-memory.dmp	family_salatstealer
behavioral2/memory/3512-37-0x0000000002130000-0x0000000002D85000-memory.dmp	family_salatstealer
behavioral2/memory/3512-33-0x0000000002130000-0x0000000002D85000-memory.dmp	family_salatstealer
behavioral2/memory/3512-35-0x0000000002130000-0x0000000002D85000-memory.dmp	family_salatstealer
behavioral2/memory/3512-39-0x0000000002130000-0x0000000002D85000-memory.dmp	family_salatstealer
behavioral2/memory/3512-40-0x0000000002130000-0x0000000002D85000-memory.dmp	family_salatstealer
behavioral2/memory/3512-42-0x0000000002130000-0x0000000002D85000-memory.dmp	family_salatstealer
behavioral2/memory/3512-43-0x0000000002130000-0x0000000002D85000-memory.dmp	family_salatstealer
behavioral2/memory/3512-44-0x0000000002130000-0x0000000002D85000-memory.dmp	family_salatstealer
behavioral2/memory/3512-62-0x0000000002130000-0x0000000002D85000-memory.dmp	family_salatstealer
behavioral2/memory/3512-60-0x0000000002130000-0x0000000002D85000-memory.dmp	family_salatstealer
behavioral2/memory/2756-83-0x0000000001640000-0x0000000002295000-memory.dmp	family_salatstealer
behavioral2/memory/2756-85-0x0000000001640000-0x0000000002295000-memory.dmp	family_salatstealer
behavioral2/memory/2756-86-0x0000000001640000-0x0000000002295000-memory.dmp	family_salatstealer
behavioral2/memory/2756-84-0x0000000001640000-0x0000000002295000-memory.dmp	family_salatstealer
behavioral2/memory/2756-87-0x0000000001640000-0x0000000002295000-memory.dmp	family_salatstealer
behavioral2/memory/2756-88-0x0000000001640000-0x0000000002295000-memory.dmp	family_salatstealer
behavioral2/memory/4132-103-0x0000000001660000-0x00000000022B5000-memory.dmp	family_salatstealer
behavioral2/memory/4132-104-0x0000000001660000-0x00000000022B5000-memory.dmp	family_salatstealer
behavioral2/memory/4132-105-0x0000000001660000-0x00000000022B5000-memory.dmp	family_salatstealer
behavioral2/memory/4132-107-0x0000000001660000-0x00000000022B5000-memory.dmp	family_salatstealer
behavioral2/memory/4132-106-0x0000000001660000-0x00000000022B5000-memory.dmp	family_salatstealer
behavioral2/memory/4132-110-0x0000000001660000-0x00000000022B5000-memory.dmp	family_salatstealer

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 36 IoCs

resource	yara_rule
behavioral2/memory/1304-5-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1304-4-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1304-8-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1304-7-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1304-9-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1304-6-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1304-11-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1304-12-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1304-14-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1304-15-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1304-24-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3512-32-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3512-34-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3512-36-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3512-37-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3512-33-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3512-35-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3512-39-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3512-40-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3512-42-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3512-43-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3512-44-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3512-62-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3512-60-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2756-83-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2756-85-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2756-86-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2756-84-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2756-87-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2756-88-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4132-103-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4132-104-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4132-105-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4132-107-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4132-106-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4132-110-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 36 IoCs

resource	yara_rule
behavioral2/memory/1304-5-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1304-4-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1304-8-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1304-7-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1304-9-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1304-6-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1304-11-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1304-12-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1304-14-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1304-15-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1304-24-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3512-32-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3512-34-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3512-36-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3512-37-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3512-33-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3512-35-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3512-39-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3512-40-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3512-42-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3512-43-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3512-44-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3512-62-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3512-60-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2756-83-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2756-85-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2756-86-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2756-84-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2756-87-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2756-88-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4132-103-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4132-104-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4132-105-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4132-107-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4132-106-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4132-110-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 36 IoCs

resource	yara_rule
behavioral2/memory/1304-5-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1304-4-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1304-8-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1304-7-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1304-9-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1304-6-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1304-11-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1304-12-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1304-14-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1304-15-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1304-24-0x0000000001C50000-0x00000000028A5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3512-32-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3512-34-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3512-36-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3512-37-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3512-33-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3512-35-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3512-39-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3512-40-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3512-42-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3512-43-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3512-44-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3512-62-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3512-60-0x0000000002130000-0x0000000002D85000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2756-83-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2756-85-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2756-86-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2756-84-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2756-87-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2756-88-0x0000000001640000-0x0000000002295000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4132-103-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4132-104-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4132-105-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4132-107-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4132-106-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4132-110-0x0000000001660000-0x00000000022B5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 42 IoCs

resource	yara_rule
behavioral2/memory/1304-0-0x0000000001C50000-0x00000000028A5000-memory.dmp	UPX
behavioral2/memory/1304-3-0x0000000001C50000-0x00000000028A5000-memory.dmp	UPX
behavioral2/memory/1304-5-0x0000000001C50000-0x00000000028A5000-memory.dmp	UPX
behavioral2/memory/1304-4-0x0000000001C50000-0x00000000028A5000-memory.dmp	UPX
behavioral2/memory/1304-8-0x0000000001C50000-0x00000000028A5000-memory.dmp	UPX
behavioral2/memory/1304-7-0x0000000001C50000-0x00000000028A5000-memory.dmp	UPX
behavioral2/memory/1304-9-0x0000000001C50000-0x00000000028A5000-memory.dmp	UPX
behavioral2/memory/1304-6-0x0000000001C50000-0x00000000028A5000-memory.dmp	UPX
behavioral2/memory/1304-11-0x0000000001C50000-0x00000000028A5000-memory.dmp	UPX
behavioral2/memory/1304-12-0x0000000001C50000-0x00000000028A5000-memory.dmp	UPX
behavioral2/memory/1304-14-0x0000000001C50000-0x00000000028A5000-memory.dmp	UPX
behavioral2/memory/1304-15-0x0000000001C50000-0x00000000028A5000-memory.dmp	UPX
behavioral2/memory/1304-24-0x0000000001C50000-0x00000000028A5000-memory.dmp	UPX
behavioral2/memory/3512-28-0x0000000002130000-0x0000000002D85000-memory.dmp	UPX
behavioral2/memory/3512-31-0x0000000002130000-0x0000000002D85000-memory.dmp	UPX
behavioral2/memory/3512-32-0x0000000002130000-0x0000000002D85000-memory.dmp	UPX
behavioral2/memory/3512-34-0x0000000002130000-0x0000000002D85000-memory.dmp	UPX
behavioral2/memory/3512-36-0x0000000002130000-0x0000000002D85000-memory.dmp	UPX
behavioral2/memory/3512-37-0x0000000002130000-0x0000000002D85000-memory.dmp	UPX
behavioral2/memory/3512-33-0x0000000002130000-0x0000000002D85000-memory.dmp	UPX
behavioral2/memory/3512-35-0x0000000002130000-0x0000000002D85000-memory.dmp	UPX
behavioral2/memory/3512-39-0x0000000002130000-0x0000000002D85000-memory.dmp	UPX
behavioral2/memory/3512-40-0x0000000002130000-0x0000000002D85000-memory.dmp	UPX
behavioral2/memory/3512-42-0x0000000002130000-0x0000000002D85000-memory.dmp	UPX
behavioral2/memory/3512-43-0x0000000002130000-0x0000000002D85000-memory.dmp	UPX
behavioral2/memory/3512-44-0x0000000002130000-0x0000000002D85000-memory.dmp	UPX
behavioral2/memory/3512-62-0x0000000002130000-0x0000000002D85000-memory.dmp	UPX
behavioral2/memory/3512-60-0x0000000002130000-0x0000000002D85000-memory.dmp	UPX
behavioral2/memory/2756-66-0x0000000001640000-0x0000000002295000-memory.dmp	UPX
behavioral2/memory/2756-83-0x0000000001640000-0x0000000002295000-memory.dmp	UPX
behavioral2/memory/2756-85-0x0000000001640000-0x0000000002295000-memory.dmp	UPX
behavioral2/memory/2756-86-0x0000000001640000-0x0000000002295000-memory.dmp	UPX
behavioral2/memory/2756-84-0x0000000001640000-0x0000000002295000-memory.dmp	UPX
behavioral2/memory/2756-87-0x0000000001640000-0x0000000002295000-memory.dmp	UPX
behavioral2/memory/2756-88-0x0000000001640000-0x0000000002295000-memory.dmp	UPX
behavioral2/memory/4132-100-0x0000000001660000-0x00000000022B5000-memory.dmp	UPX
behavioral2/memory/4132-103-0x0000000001660000-0x00000000022B5000-memory.dmp	UPX
behavioral2/memory/4132-104-0x0000000001660000-0x00000000022B5000-memory.dmp	UPX
behavioral2/memory/4132-105-0x0000000001660000-0x00000000022B5000-memory.dmp	UPX
behavioral2/memory/4132-107-0x0000000001660000-0x00000000022B5000-memory.dmp	UPX
behavioral2/memory/4132-106-0x0000000001660000-0x00000000022B5000-memory.dmp	UPX
behavioral2/memory/4132-110-0x0000000001660000-0x00000000022B5000-memory.dmp	UPX

Executes dropped EXE 3 IoCs

pid	Process
3512	WmiPrvSE.exe
2756	WmiPrvSE.exe
4132	WmiPrvSE.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1304-0-0x0000000001C50000-0x00000000028A5000-memory.dmp	upx
behavioral2/memory/1304-3-0x0000000001C50000-0x00000000028A5000-memory.dmp	upx
behavioral2/memory/1304-5-0x0000000001C50000-0x00000000028A5000-memory.dmp	upx
behavioral2/memory/1304-4-0x0000000001C50000-0x00000000028A5000-memory.dmp	upx
behavioral2/memory/1304-8-0x0000000001C50000-0x00000000028A5000-memory.dmp	upx
behavioral2/memory/1304-7-0x0000000001C50000-0x00000000028A5000-memory.dmp	upx
behavioral2/memory/1304-9-0x0000000001C50000-0x00000000028A5000-memory.dmp	upx
behavioral2/memory/1304-6-0x0000000001C50000-0x00000000028A5000-memory.dmp	upx
behavioral2/memory/1304-11-0x0000000001C50000-0x00000000028A5000-memory.dmp	upx
behavioral2/memory/1304-12-0x0000000001C50000-0x00000000028A5000-memory.dmp	upx
behavioral2/memory/1304-14-0x0000000001C50000-0x00000000028A5000-memory.dmp	upx
behavioral2/memory/1304-15-0x0000000001C50000-0x00000000028A5000-memory.dmp	upx
behavioral2/memory/1304-24-0x0000000001C50000-0x00000000028A5000-memory.dmp	upx
behavioral2/memory/3512-28-0x0000000002130000-0x0000000002D85000-memory.dmp	upx
behavioral2/memory/3512-31-0x0000000002130000-0x0000000002D85000-memory.dmp	upx
behavioral2/memory/3512-32-0x0000000002130000-0x0000000002D85000-memory.dmp	upx
behavioral2/memory/3512-34-0x0000000002130000-0x0000000002D85000-memory.dmp	upx
behavioral2/memory/3512-36-0x0000000002130000-0x0000000002D85000-memory.dmp	upx
behavioral2/memory/3512-37-0x0000000002130000-0x0000000002D85000-memory.dmp	upx
behavioral2/memory/3512-33-0x0000000002130000-0x0000000002D85000-memory.dmp	upx
behavioral2/memory/3512-35-0x0000000002130000-0x0000000002D85000-memory.dmp	upx
behavioral2/memory/3512-39-0x0000000002130000-0x0000000002D85000-memory.dmp	upx
behavioral2/memory/3512-40-0x0000000002130000-0x0000000002D85000-memory.dmp	upx
behavioral2/memory/3512-42-0x0000000002130000-0x0000000002D85000-memory.dmp	upx
behavioral2/memory/3512-43-0x0000000002130000-0x0000000002D85000-memory.dmp	upx
behavioral2/memory/3512-44-0x0000000002130000-0x0000000002D85000-memory.dmp	upx
behavioral2/memory/3512-62-0x0000000002130000-0x0000000002D85000-memory.dmp	upx
behavioral2/memory/3512-60-0x0000000002130000-0x0000000002D85000-memory.dmp	upx
behavioral2/memory/2756-66-0x0000000001640000-0x0000000002295000-memory.dmp	upx
behavioral2/memory/2756-83-0x0000000001640000-0x0000000002295000-memory.dmp	upx
behavioral2/memory/2756-85-0x0000000001640000-0x0000000002295000-memory.dmp	upx
behavioral2/memory/2756-86-0x0000000001640000-0x0000000002295000-memory.dmp	upx
behavioral2/memory/2756-84-0x0000000001640000-0x0000000002295000-memory.dmp	upx
behavioral2/memory/2756-87-0x0000000001640000-0x0000000002295000-memory.dmp	upx
behavioral2/memory/2756-88-0x0000000001640000-0x0000000002295000-memory.dmp	upx
behavioral2/memory/4132-100-0x0000000001660000-0x00000000022B5000-memory.dmp	upx
behavioral2/memory/4132-103-0x0000000001660000-0x00000000022B5000-memory.dmp	upx
behavioral2/memory/4132-104-0x0000000001660000-0x00000000022B5000-memory.dmp	upx
behavioral2/memory/4132-105-0x0000000001660000-0x00000000022B5000-memory.dmp	upx
behavioral2/memory/4132-107-0x0000000001660000-0x00000000022B5000-memory.dmp	upx
behavioral2/memory/4132-106-0x0000000001660000-0x00000000022B5000-memory.dmp	upx
behavioral2/memory/4132-110-0x0000000001660000-0x00000000022B5000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\WmiPrvSE.exe	WmiPrvSE.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\WmiPrvSE.exe	WmiPrvSE.exe
File opened for modification	C:\Program Files (x86)\Adobe\d22dc116-339e-338a-6471-c36eef691633	2026-08-31_1067db1b9185bd74672605164fe71ed0_akira_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Adobe\ctfmon.exe	2026-08-31_1067db1b9185bd74672605164fe71ed0_akira_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\d22dc116-339e-338a-6471-c36eef691633	2026-08-31_1067db1b9185bd74672605164fe71ed0_akira_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\WmiPrvSE.exe	2026-08-31_1067db1b9185bd74672605164fe71ed0_akira_elex_glassworm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_1067db1b9185bd74672605164fe71ed0_akira_elex_glassworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WmiPrvSE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WmiPrvSE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WmiPrvSE.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
1304	2026-08-31_1067db1b9185bd74672605164fe71ed0_akira_elex_glassworm.exe
1304	2026-08-31_1067db1b9185bd74672605164fe71ed0_akira_elex_glassworm.exe
1304	2026-08-31_1067db1b9185bd74672605164fe71ed0_akira_elex_glassworm.exe
1304	2026-08-31_1067db1b9185bd74672605164fe71ed0_akira_elex_glassworm.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
1768	powershell.exe
1768	powershell.exe
1768	powershell.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe
3512	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeIncreaseQuotaPrivilege	1768	powershell.exe
Token: SeSecurityPrivilege	1768	powershell.exe
Token: SeTakeOwnershipPrivilege	1768	powershell.exe
Token: SeLoadDriverPrivilege	1768	powershell.exe
Token: SeSystemProfilePrivilege	1768	powershell.exe
Token: SeSystemtimePrivilege	1768	powershell.exe
Token: SeProfSingleProcessPrivilege	1768	powershell.exe
Token: SeIncBasePriorityPrivilege	1768	powershell.exe
Token: SeCreatePagefilePrivilege	1768	powershell.exe
Token: SeBackupPrivilege	1768	powershell.exe
Token: SeRestorePrivilege	1768	powershell.exe
Token: SeShutdownPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeSystemEnvironmentPrivilege	1768	powershell.exe
Token: SeRemoteShutdownPrivilege	1768	powershell.exe
Token: SeUndockPrivilege	1768	powershell.exe
Token: SeManageVolumePrivilege	1768	powershell.exe
Token: 33	1768	powershell.exe
Token: 34	1768	powershell.exe
Token: 35	1768	powershell.exe
Token: 36	1768	powershell.exe
Token: SeIncreaseQuotaPrivilege	1768	powershell.exe
Token: SeSecurityPrivilege	1768	powershell.exe
Token: SeTakeOwnershipPrivilege	1768	powershell.exe
Token: SeLoadDriverPrivilege	1768	powershell.exe
Token: SeSystemProfilePrivilege	1768	powershell.exe
Token: SeSystemtimePrivilege	1768	powershell.exe
Token: SeProfSingleProcessPrivilege	1768	powershell.exe
Token: SeIncBasePriorityPrivilege	1768	powershell.exe
Token: SeCreatePagefilePrivilege	1768	powershell.exe
Token: SeBackupPrivilege	1768	powershell.exe
Token: SeRestorePrivilege	1768	powershell.exe
Token: SeShutdownPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeSystemEnvironmentPrivilege	1768	powershell.exe
Token: SeRemoteShutdownPrivilege	1768	powershell.exe
Token: SeUndockPrivilege	1768	powershell.exe
Token: SeManageVolumePrivilege	1768	powershell.exe
Token: 33	1768	powershell.exe
Token: 34	1768	powershell.exe
Token: 35	1768	powershell.exe
Token: 36	1768	powershell.exe
Token: SeIncreaseQuotaPrivilege	1768	powershell.exe
Token: SeSecurityPrivilege	1768	powershell.exe
Token: SeTakeOwnershipPrivilege	1768	powershell.exe
Token: SeLoadDriverPrivilege	1768	powershell.exe
Token: SeSystemProfilePrivilege	1768	powershell.exe
Token: SeSystemtimePrivilege	1768	powershell.exe
Token: SeProfSingleProcessPrivilege	1768	powershell.exe
Token: SeIncBasePriorityPrivilege	1768	powershell.exe
Token: SeCreatePagefilePrivilege	1768	powershell.exe
Token: SeBackupPrivilege	1768	powershell.exe
Token: SeRestorePrivilege	1768	powershell.exe
Token: SeShutdownPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeSystemEnvironmentPrivilege	1768	powershell.exe
Token: SeRemoteShutdownPrivilege	1768	powershell.exe
Token: SeUndockPrivilege	1768	powershell.exe
Token: SeManageVolumePrivilege	1768	powershell.exe
Token: 33	1768	powershell.exe
Token: 34	1768	powershell.exe
Token: 35	1768	powershell.exe
Token: 36	1768	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 3512	1304	2026-08-31_1067db1b9185bd74672605164fe71ed0_akira_elex_glassworm.exe	91
PID 3512 wrote to memory of 1768	3512	WmiPrvSE.exe	93
PID 3512 wrote to memory of 2756	3512	WmiPrvSE.exe	95
PID 3512 wrote to memory of 4132	3512	WmiPrvSE.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-31_1067db1b9185bd74672605164fe71ed0_akira_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_1067db1b9185bd74672605164fe71ed0_akira_elex_glassworm.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Program Files (x86)\Reference Assemblies\WmiPrvSE.exe
  "C:\Program Files (x86)\Reference Assemblies\WmiPrvSE.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\WmiPrvSE.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\WmiPrvSE.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2756
- - C:\Program Files\Google\Chrome\Application\WmiPrvSE.exe
    "C:\Program Files\Google\Chrome\Application\WmiPrvSE.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4924

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WmiPrvSE.exe

Path C:\Program Files (x86)\Reference Assemblies\WmiPrvSE.exe
Size 3.8MB
SHA256 f0bd8ebb53b50439b45c03bb7c37a51a4adf75e0d95efe95807a4fe9267c98ef
MD5 1067db1b9185bd74672605164fe71ed0
SHA1 60a87c4fd9b6f2ea4e5f0e21489ee1b529d12b06
SHA512 f06c6b6af0a071d1067132c0047ceffb8d2d844ba59ff358275eba9a11940dddd4df5fd734e1bb20ceae14d167c16556bd75d8e0d049f7f201c213f24f6a6a98
SSDEEP 98304:zjJk+ezJWscHniesMddNojwI2w0xz6UpL+SmzvuWa33:z17ezMtnnddNojw+9Up93
TLSH
T1B9062349E65348F5E577227100BFA23FF2345A0D8406DDAFDFAA5C66FB2F7001918A29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1304-10-0x0000000000440000-0x000000000080C000-memory.dmp

Download

memory/1304-14-0x0000000001C50000-0x00000000028A5000-memory.dmp

Download

memory/1304-4-0x0000000001C50000-0x00000000028A5000-memory.dmp

Download

memory/1304-8-0x0000000001C50000-0x00000000028A5000-memory.dmp

Download

memory/1304-7-0x0000000001C50000-0x00000000028A5000-memory.dmp

Download

memory/1304-9-0x0000000001C50000-0x00000000028A5000-memory.dmp

Download

memory/1304-5-0x0000000001C50000-0x00000000028A5000-memory.dmp

Download

memory/1304-11-0x0000000001C50000-0x00000000028A5000-memory.dmp

Download

memory/1304-6-0x0000000001C50000-0x00000000028A5000-memory.dmp

Download

memory/1304-12-0x0000000001C50000-0x00000000028A5000-memory.dmp

Download

memory/1304-0-0x0000000001C50000-0x00000000028A5000-memory.dmp

Download

memory/1304-15-0x0000000001C50000-0x00000000028A5000-memory.dmp

Download

memory/1304-3-0x0000000001C50000-0x00000000028A5000-memory.dmp

Download

memory/1304-24-0x0000000001C50000-0x00000000028A5000-memory.dmp

Download

memory/1304-27-0x0000000000440000-0x000000000080C000-memory.dmp

Download

memory/1768-81-0x0000000008410000-0x0000000008432000-memory.dmp

Download

memory/1768-69-0x0000000006EF0000-0x0000000006F38000-memory.dmp

Download

memory/1768-93-0x00000000745A0000-0x0000000074D5C000-memory.dmp

Download

memory/1768-82-0x0000000009180000-0x000000000973A000-memory.dmp

Download

memory/1768-80-0x0000000008010000-0x00000000080A6000-memory.dmp

Download

memory/1768-79-0x0000000007F60000-0x0000000007F6A000-memory.dmp

Download

memory/1768-77-0x0000000008540000-0x0000000008BBC000-memory.dmp

Download

memory/1768-78-0x0000000007F00000-0x0000000007F1A000-memory.dmp

Download

memory/1768-70-0x0000000007D50000-0x0000000007D86000-memory.dmp

Download

memory/1768-72-0x0000000070A70000-0x0000000070DCB000-memory.dmp

Download

memory/1768-75-0x0000000007D90000-0x0000000007DB0000-memory.dmp

Download

memory/1768-76-0x0000000007DB0000-0x0000000007E53000-memory.dmp

Download

memory/1768-71-0x0000000070910000-0x000000007095C000-memory.dmp

Download

memory/1768-63-0x0000000006920000-0x000000000693E000-memory.dmp

Download

memory/1768-45-0x00000000745B2000-0x00000000745B3000-memory.dmp

Download

memory/1768-48-0x00000000030F0000-0x0000000003126000-memory.dmp

Download

memory/1768-49-0x00000000745A0000-0x0000000074D5C000-memory.dmp

Download

memory/1768-50-0x0000000005D40000-0x000000000638A000-memory.dmp

Download

memory/1768-51-0x00000000745A0000-0x0000000074D5C000-memory.dmp

Download

memory/1768-52-0x0000000005B20000-0x0000000005B42000-memory.dmp

Download

memory/1768-53-0x0000000005BC0000-0x0000000005C26000-memory.dmp

Download

memory/1768-54-0x0000000005C30000-0x0000000005C96000-memory.dmp

Download

memory/1768-57-0x00000000064F0000-0x000000000684B000-memory.dmp

Download

memory/1768-64-0x00000000069F0000-0x0000000006A3C000-memory.dmp

Download

memory/2756-83-0x0000000001640000-0x0000000002295000-memory.dmp

Download

memory/2756-88-0x0000000001640000-0x0000000002295000-memory.dmp

Download

memory/2756-91-0x0000000000690000-0x0000000000A5C000-memory.dmp

Download

memory/2756-66-0x0000000001640000-0x0000000002295000-memory.dmp

Download

memory/2756-87-0x0000000001640000-0x0000000002295000-memory.dmp

Download

memory/2756-84-0x0000000001640000-0x0000000002295000-memory.dmp

Download

memory/2756-86-0x0000000001640000-0x0000000002295000-memory.dmp

Download

memory/2756-85-0x0000000001640000-0x0000000002295000-memory.dmp

Download

memory/3512-39-0x0000000002130000-0x0000000002D85000-memory.dmp

Download

memory/3512-43-0x0000000002130000-0x0000000002D85000-memory.dmp

Download

memory/3512-35-0x0000000002130000-0x0000000002D85000-memory.dmp

Download

memory/3512-33-0x0000000002130000-0x0000000002D85000-memory.dmp

Download

memory/3512-37-0x0000000002130000-0x0000000002D85000-memory.dmp

Download

memory/3512-36-0x0000000002130000-0x0000000002D85000-memory.dmp

Download

memory/3512-28-0x0000000002130000-0x0000000002D85000-memory.dmp

Download

memory/3512-34-0x0000000002130000-0x0000000002D85000-memory.dmp

Download

memory/3512-62-0x0000000002130000-0x0000000002D85000-memory.dmp

Download

memory/3512-40-0x0000000002130000-0x0000000002D85000-memory.dmp

Download

memory/3512-42-0x0000000002130000-0x0000000002D85000-memory.dmp

Download

memory/3512-38-0x00000000008A0000-0x0000000000C6C000-memory.dmp

Download

memory/3512-31-0x0000000002130000-0x0000000002D85000-memory.dmp

Download

memory/3512-44-0x0000000002130000-0x0000000002D85000-memory.dmp

Download

memory/3512-60-0x0000000002130000-0x0000000002D85000-memory.dmp

Download

memory/3512-32-0x0000000002130000-0x0000000002D85000-memory.dmp

Download

memory/4132-100-0x0000000001660000-0x00000000022B5000-memory.dmp

Download

memory/4132-103-0x0000000001660000-0x00000000022B5000-memory.dmp

Download

memory/4132-104-0x0000000001660000-0x00000000022B5000-memory.dmp

Download

memory/4132-105-0x0000000001660000-0x00000000022B5000-memory.dmp

Download

memory/4132-107-0x0000000001660000-0x00000000022B5000-memory.dmp

Download

memory/4132-106-0x0000000001660000-0x00000000022B5000-memory.dmp

Download

memory/4132-110-0x0000000001660000-0x00000000022B5000-memory.dmp

Download

memory/4132-111-0x0000000000110000-0x00000000004DC000-memory.dmp

Download