2f3e2a07c625f3497a53dcfb501c6b9ca827162f7028f07fb65ff6b5070cc8b1

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.exe
Size 44.4MB
Sample261030-ctc7dsda82
SHA256 2f3e2a07c625f3497a53dcfb501c6b9ca827162f7028f07fb65ff6b5070cc8b1
MD5 6f33b0183fcf0886fe0601b7319b8fe8
SHA1 1bb0de5eff4696b003e34a647b4c3d6401aea95c
SHA512 808f89fb4baf20dcfc7fab42b354d08430c366f3129ef684b89df542ddd3f29301938f9ea49b91910b50f5433ba8dc899bb84679f652a87cee14234f247cb1e9
SSDEEP 786432:lO6WKFCLSjnUFOn+3bU/qMyhkDfrvpc+MGRS7+zryxeg4FfJ:g6WWswYOn+rU/RTpcjGISI4JJ
TLSH
T114A7115667A400E9E1B3D23CC562C726E6B27C6547309BCB42D0BA6F2F37AD58E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution installer persistence privilege_escalation ransomware

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 5984 created 3092	5984	elevation_service.exe	81

Detects Windows executables referencing non-Windows User-Agents 11 IoCs

resource	yara_rule
behavioral2/memory/1212-330-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1212-391-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1212-392-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1212-393-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1212-398-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1212-470-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1212-469-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1212-475-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1212-476-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1212-626-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1212-627-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4768	attrib.exe
2792	attrib.exe

Executes dropped EXE 5 IoCs

pid	Process
1764	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp
560	Unspokensignature5813.exe
4528	Unspokensignature5813.exe
4508	Unspokensignature5813.exe
5352	Unspokensignature5813.exe

Loads dropped DLL 4 IoCs

pid	Process
560	Unspokensignature5813.exe
4528	Unspokensignature5813.exe
4508	Unspokensignature5813.exe
5352	Unspokensignature5813.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5604	icacls.exe
3692	icacls.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1576	cmd.exe
3476	cmd.exe
5720	cmd.exe
4240	cmd.exe
4912	cmd.exe
3244	cmd.exe
2184	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1260-1-0x0000000000400000-0x0000000000442000-memory.dmp	innosetup
behavioral2/memory/1260-167-0x0000000000400000-0x0000000000442000-memory.dmp	innosetup

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	52	Go-http-client/1.1
HTTP User-Agent header	196	Go-http-client/1.1

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
6056	taskkill.exe
4808	taskkill.exe
3236	taskkill.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1764	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp
1764	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp
560	Unspokensignature5813.exe
560	Unspokensignature5813.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
1212	waitfor.exe
1212	waitfor.exe
4508	Unspokensignature5813.exe
4508	Unspokensignature5813.exe
1212	waitfor.exe
1212	waitfor.exe
5352	Unspokensignature5813.exe
5352	Unspokensignature5813.exe
1212	waitfor.exe
1212	waitfor.exe

Suspicious behavior: MapViewOfSection 1 TTPs 5 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
560	Unspokensignature5813.exe
5984	elevation_service.exe
5984	elevation_service.exe
4508	Unspokensignature5813.exe
5352	Unspokensignature5813.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	6056	taskkill.exe
Token: SeDebugPrivilege	4808	taskkill.exe
Token: SeDebugPrivilege	3236	taskkill.exe
Token: SeDebugPrivilege	560	Unspokensignature5813.exe
Token: SeShutdownPrivilege	5984	elevation_service.exe
Token: SeShutdownPrivilege	1212	waitfor.exe
Token: SeDebugPrivilege	1212	waitfor.exe
Token: SeDebugPrivilege	1212	waitfor.exe
Token: SeBackupPrivilege	3044	vssvc.exe
Token: SeRestorePrivilege	3044	vssvc.exe
Token: SeAuditPrivilege	3044	vssvc.exe
Token: SeDebugPrivilege	4528	Unspokensignature5813.exe
Token: SeDebugPrivilege	4508	Unspokensignature5813.exe
Token: SeDebugPrivilege	5352	Unspokensignature5813.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1764	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1212	waitfor.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1764	1260	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.exe	89
PID 1764 wrote to memory of 6056	1764	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp	90
PID 1764 wrote to memory of 4808	1764	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp	93
PID 1764 wrote to memory of 3236	1764	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp	95
PID 1764 wrote to memory of 560	1764	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp	97
PID 5984 wrote to memory of 1576	5984	elevation_service.exe	100
PID 1576 wrote to memory of 1212	1576	cmd.exe	102
PID 5984 wrote to memory of 3476	5984	elevation_service.exe	103
PID 3476 wrote to memory of 5604	3476	cmd.exe	105
PID 5984 wrote to memory of 5720	5984	elevation_service.exe	106
PID 1212 wrote to memory of 6068	1212	waitfor.exe	108
PID 5720 wrote to memory of 3692	5720	cmd.exe	109
PID 5984 wrote to memory of 2792	5984	elevation_service.exe	110
PID 5984 wrote to memory of 4768	5984	elevation_service.exe	112
PID 5984 wrote to memory of 1900	5984	elevation_service.exe	114
PID 1212 wrote to memory of 572	1212	waitfor.exe	116
PID 4240 wrote to memory of 4528	4240	cmd.exe	124
PID 1212 wrote to memory of 4912	1212	waitfor.exe	125
PID 4912 wrote to memory of 4244	4912	cmd.exe	126
PID 3244 wrote to memory of 4508	3244	cmd.exe	129
PID 2184 wrote to memory of 5352	2184	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2792	attrib.exe
4768	attrib.exe

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:3092
- C:\Users\Admin\AppData\Local\Temp\2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Users\Admin\AppData\Local\Temp\is-KCAS7.tmp\2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-KCAS7.tmp\2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp" /SL5="$4011A,46113230,229376,C:\Users\Admin\AppData\Local\Temp\2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Unspokensignature5813.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6056
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Unspokensignature5813.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4808
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Unspokensignature5813.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3236
  - - C:\Drivers\GeometryBarista\Unspokensignature5813.exe
      "C:\Drivers\GeometryBarista\Unspokensignature5813.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:560
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c waitfor.exe ZqIdleHeartbeat3f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\System32\waitfor.exe
    waitfor.exe ZqIdleHeartbeat3f
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Windows\system32\cmd.exe
      cmd ver
      4⤵
      PID:6068
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync
      4⤵
      PID:572
  - - C:\Windows\system32\cmd.exe
      cmd.exe /K "chcp 65001 >nul"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4912
    - - C:\Windows\System32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5984
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /deny Users:(D)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Windows\System32\icacls.exe
    icacls \"C:\Drivers\" /deny Users:(D)
    3⤵
    - Modifies file permissions
    PID:5604
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\System32\icacls.exe
    icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)
    3⤵
    - Modifies file permissions
    PID:3692
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers +s +h
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2792
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers\* +s +h /S /D
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4768
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn lxjdQnOJqglyUwKrTQzDHeDB /tr "cmd /c cd /d \"C:\Drivers\GeometryBarista\" && start \"\" \"C:\Drivers\GeometryBarista\Unspokensignature5813.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6116

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:5276

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\GeometryBarista" && start "" "C:\Drivers\GeometryBarista\Unspokensignature5813.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Drivers\GeometryBarista\Unspokensignature5813.exe
  "C:\Drivers\GeometryBarista\Unspokensignature5813.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:4528

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\GeometryBarista" && start "" "C:\Drivers\GeometryBarista\Unspokensignature5813.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Drivers\GeometryBarista\Unspokensignature5813.exe
  "C:\Drivers\GeometryBarista\Unspokensignature5813.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:4508

C:\Windows\system32\schtasks.exe
schtasks /query /tn lxjdQnOJqglyUwKrTQzDHeDB
1⤵
PID:5372

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\GeometryBarista" && start "" "C:\Drivers\GeometryBarista\Unspokensignature5813.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Drivers\GeometryBarista\Unspokensignature5813.exe
  "C:\Drivers\GeometryBarista\Unspokensignature5813.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:5352

C:\Windows\system32\schtasks.exe
schtasks /query /tn lxjdQnOJqglyUwKrTQzDHeDB
1⤵
PID:3904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Process Injection

T1055

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cheesespreading4359.exe

Path C:\Drivers\FameHandling\Cheesespreading4359.exe
Size 276KB
SHA256 ebe3614a4adbd3c87aa68360545ec474795ab977fcb7d46a6b59537e3164b246
MD5 36079e3f1b2d278bfaad7a85d9c4e24d
SHA1 eddda8a071170ec86a561f1dad17b82332dd7226
SHA512 d29322276a2dbaac315ba3d900ddb8b6d9c3dc8d88b8ba873ae712bee5bcab55312a0a5bb9c992c48c749a01677425e90328bf0cf403a74b6a004463b9c86d4d
SSDEEP 6144:5FWPGAoGpA0ta/xdybQGLWy3ngvxJ8XtJ7dQnEvpqDl:58GAot0tMbyHb3ngpJ8X3yEYl
TLSH
T158547C29B3944DF9EC67C23CCDB28412F63178564760EAEB13A48A391F336D45A3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChronicDevalue6594.1zZpO

Path C:\Drivers\FameHandling\ChronicDevalue6594.1zZpO
Size 4.4MB
SHA256 9b41eab968e38d1feb9a5d33ccb5c47e1f4cc8d359acb14b7909d15edc11235d
MD5 32e91bdc757f6d9695ef3b07cd91f5c5
SHA1 4bf1e5a15ef66f2091b637c8a25d61c1fe51a1c9
SHA512 3804fab78860732df9f913c659864d52e5d4bf3b86cf0a98ee3c1a6d8a70b5dc9c9d4f060cd426f288b9a6883c3032307839ced73dfded7303adaaebfc10c472
SSDEEP 49152:b9DcDbLw2foltKF14XOkaV4toQncXEaleu+DWENpTlJBGgoBoj0ZYQ:FkVfoWHIOBV4KocXEtu+99Rov
TLSH
T19226BF3132116A19E16F471AD1F84E1CC5BC294863B79B9C5E23BEE27E86702EF7815C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FuryToshiba8669.PHZ

Path C:\Drivers\GeometryBarista\FuryToshiba8669.PHZ
Size 4.4MB
SHA256 d266349904115202d9087f81597753f85ca4d5b80373a7a890acb115dbba78fa
MD5 f6d42d9025ebdcfe632fe96b3d1eb153
SHA1 3bae6837475d5950d353d6f8883ce8414339914e
SHA512 e489e80e6303e2c6252c283992beb23a20df20e885c36ffd67041ba10391b00e3d6ddcb09257248a1320e792ece33f9d543b093da5ab895043971e51e26475e2
SSDEEP 49152:FQ8pUGcQSZWCXFKKSSjOeiwF445Jg+Wo95s798yzBl8H4U/Y8Jkz8e:FQ4xCXFKjSCO4KJg+Wa5s79F8H0qkV
TLSH
T12226CF313200AA05E17F471BD1F81E1CD67D1608A7B69A9C8F23BFE67D56702FA78198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unspokensignature5813.exe

Path C:\Drivers\GeometryBarista\Unspokensignature5813.exe
Size 3.2MB
SHA256 f0084fa6d7c7e86e2fe0b3d66a9c61e2a3a4ac7288a8d742190dc808aaae0e1c
MD5 b5a4dd047f72e7f8f045d4ecafe71a04
SHA1 fc520d70c0c3cf86c7b34bc9ac63f802fb1e1e48
SHA512 35ebd6c7791c922189c9bd7d03a328decc16f720055da53a29d279c494b0028ba70019f78a5c6198e46dcb0e0b59bbf0934f9583a8fd15db9dddaba3c17f02c5
SSDEEP 49152:4U165F3QfiJC/1qhpsyQ32AJItY6dKxs1TGakkunfeoYPGBVBV:4K/FysInK3ksRFVBV
TLSH
T19DF59D4177A410E5F0B2E139C532875BE7B238598731F7CF8680866A1F7BAD68D35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TorchTelecom1475.OY0U

Path C:\Drivers\MillEngineers\TorchTelecom1475.OY0U
Size 4.4MB
SHA256 2cb3937e11d5d167b75d018dd759dff83bef7f9b225bb69121326b7e0434df82
MD5 e3c61022e9a9960493a5c09796b7c8a8
SHA1 c52c289dd343c5e1be844322400ea00e2aa583ee
SHA512 1bb35e5c65092f1868747d844e4eda1e938d7a0817d70fa0eb61244bcd4a50343f472a24620cf429f76e896628150889db5ecbdee877c7d6998e7c8524560d8f
SSDEEP 98304:hYDCChZE/sbpkLRveMEASQhTWcqf3ZMkM:hYDbDgsbgvZTNhTVC5M
TLSH
T18A26BF312251A919E06F472AD0F85E1CC27D664897778B8C8E63BFF66D96302EF7814C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Upgradeschili8690.exe

Path C:\Drivers\MillEngineers\Upgradeschili8690.exe
Size 240KB
SHA256 bcac830682396cc5d1b6e2b3d071cc7ae0897eda5679b2f7e461d0fe507e7254
MD5 3f4665d1091fd11fb86a7f2477e8d8bf
SHA1 20b1ed324a386e3776980f93c885ff6cf79dac9d
SHA512 664377a49c8c03d5285d2baecb042cd6ccbe997cec1220aab9ff7508f8351939a14db6ea45847a1d9593f9b831b32a02d014ba913049bff6e580e0729bea84d2
SSDEEP 1536:/QE7wIPcMhZmymaw0YzbVsyImWGg7TtMR:/L7wscMXqbV7ImWGg1G
TLSH
T1BC34086066545869DCA1C038C2F7C73AD875BCD9272592CB97FB7E8B3E703822C2A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WUlXB.ico

Path C:\Drivers\Qualmquiver6232\WUlXB.ico
Size 112KB
SHA256 6fd2bb5c3935626ae95878d5596dd8281bc42c00c1768dd1b6d1a5acb15fafe5
MD5 4234b0b7c484a20220b5b7ebd2c28bee
SHA1 6302247ee12bfdc8528a4aa13d3c9b46c95776d4
SHA512 5bbed4396ced4652e57f2923a204b97e67a465bc761e8a4a65046463fd290d1b4a4064b17f89988dcca3a9bef6eb443e13b0f0479f533d41584e373dbd5b1d64
SSDEEP 768:SxYdOUUidtxH+Hglwp0nbcFefkMQ897Lqj4/wXJHChe+JT4nqiRfRs4Rc1u/dxZf:S5U1fxHLSp0noFfOe+JT4qiRfjR/zV
TLSH
T1BFB30B93FD49D0A8F5658E31C863E16D2E5A3D71ED8EAD24F270BE0C1B32A415B83587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurvyTuna-8807.XpE

Path C:\Drivers\RocklikeAnimated\CurvyTuna-8807.XpE
Size 4.4MB
SHA256 aeb660895040f1d6edc9c007418745ad2878f49402d4ba2d3ff2e6dc514df701
MD5 61e64fa187fd33fb7b8deeb3a8fb83f5
SHA1 68ae01a0cc4c0ae093605030abef2b0156026286
SHA512 8ad276a8961272c237402e35b6d29834d620debe43ed648dc295774621320f6e136c32b5f92faa73c389a594c3b9af50879859dfda7ae3e99d3a00f34456f910
SSDEEP 49152:hMQearXa3QCjj8mXxelPynucHzXrVbWAY431fGD2tEVl:hKCORv8mXyP0ro3GfSv
TLSH
T1AD26BF313211AA15E17F471AD1B84D1CC57D6A48A7BA8B8C9F23BAF26D86302FF7415C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reshapeboat5322.exe

Path C:\Drivers\RocklikeAnimated\Reshapeboat5322.exe
Size 6.6MB
SHA256 52ec8946e1351cce60f41efdc03c82ca0e9e73a0287eccb0c1cd4cec5acdbcf9
MD5 a15229b2c81c06034e97258db9cb6f49
SHA1 ec7860cc2289b1c05a226f6858144c7c513de9d1
SHA512 dae920cb2050227873eadd21e0a33e29bf0db2b8322fe43cdf7d13303fcd0c93618472f7bea0bbcf90dfaee8af5baf37c128debe00859f6f3ab0b9194fb77486
SSDEEP 49152:ZJ8JXWvvo2ikatBz6VEE0hP2oVhLM4PkP5OmlwCJMboL/99DNRiaZmhPH66N7ZJ/:ZCmDVErPqlDNURhP8+IKWbLyV
TLSH
T1DA666A5B67A801DDD2BBD27CC6838B16F2B6BC5607318BCF019172B90E77AD49E39610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 16KB
SHA256 ca6265f7e940fec909e1b18cad6b77061567dfd971c90f46e96656b0baf33e3c
MD5 15d3f2f36804ce3cad098542863026b6
SHA1 355ea0bf37b9d3311ce1abda7aa732a6a42ced6b
SHA512 e8bd97c7fea068b21d4d048c4e1ecc749b69471de835ab859a3298ae30cb32e2ec404fd84429f214b9d13156bcc5803999186ad5eb586b9b4c2df52d0f8bea97
SSDEEP 384:oNwT+aKzXjBb+Ny9BnnWGSPgKvIgdl9ds/+3qv/sEa+:oSTPeXj2unWGSPgsNds/cqvV
TLSH
T16F72D11FF2426CC45F4C40D60441D82AF4C13A8B390FD672269E4DD53C2A629DFD54BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 17KB
SHA256 d93a1c4c003cfcbd1a7b9d1be9e2f07515b035eec39d8fac53238bfa6401b7c1
MD5 7d504b260d252d50a8468c9a2186cd30
SHA1 b30d098bf2f0a532babf89013805cd6cc0237b14
SHA512 dab3e6e2a06e3fb3f6ede39bf70b684fe60f776550f1cab3dc66e57899852f7dc989a37b5d6188801cf3c6a5edabafdb90aaecdfd88f928f8131a067be165e24
SSDEEP 384:oNwT+aKzXjBb+Ny9BnnWGSPgKvIgdl9ds/+3qv/sEa93vd:oSTPeXj2unWGSPgsNds/cqvafd
TLSH
T12582D12BF2426DC44F4C41C50041C836F4C13A8B3A0ED672169E8EC53C7E669DBE98BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 18KB
SHA256 4b76bd8d758a7f402bbb0664c7a2468f2e30c1b4da91e88b536cfc58c7731ba0
MD5 866e4b258b0d4819a7450c6bb1ca74f7
SHA1 122995f48872fed3d160e341fd1ae0a7b841f644
SHA512 9a8c43910bc848ee18c759e766813f747ce87f166eec39e42903d8eba48c864a4671693121ba5f153eb61c5b788e878d557348a677edeca783f93b600b704853
SSDEEP 384:oNwT+aKzXjBb+Ny9BnnWGSPgKvIgdl9ds/+3qv/sEa93vNCzA:oSTPeXj2unWGSPgsNds/cqvaf8A
TLSH
T1F382D02BF2426DC49F4881D60041C866F4C17A473A0ED572269F8ED53C7A629DBE9879
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 19KB
SHA256 7179220c12b59d69de915ccd2d4f7e36466a53f9978498eb7699357b1444e018
MD5 4e217d5a8fd2c2fab665b4270cf773b4
SHA1 bd17fa49755dd4bda2bd8544e3a5e5ec6b1008af
SHA512 75a8c37133d18251a2f37fec9b9937d925728518d355a244f8de158807287f1c88cee5d45b5d16d1a054a324c7e93081a146b34991b79c33f53ebdcc556b18aa
SSDEEP 384:oNwT+aKzXjBb+Ny9BnnWGSPgKvIgdl9ds/+3qv/sEa93vNCzJqa:oSTPeXj2unWGSPgsNds/cqvaf8Ia
TLSH
T12092D02FF2426DC49F4C80950040C466F4C57B8B3A4FDA73269F4ED53C7A6299AE98B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 33KB
SHA256 6da2f182c0b14738d1b959a037117fd9aaacf21694a85af315e435846110003f
MD5 76019be38a152b29f9b0fececba95698
SHA1 39888f05d3942257a431075b36261b6112bf0959
SHA512 02f7930a477b6861619b736b534abf092f7abb606bb43e05d16e2bb8776b490801977cc8ba9d328bec929dc5bb91ec816192e51c637fb24f44b8ad50ee7c40e1
SSDEEP 768:oSTPeXj2unWGSPgsNds/cqvaf8IFdbV0KcBqaSXCdOaVOsns:feXj2unWrLsAf8IF9tXCw0Osns
TLSH
T1FAF2F137B213BAC89D0CA2928250C41BF6D8759B3695F733662ED8813C752298FC9478
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 34KB
SHA256 e686479da0c57049215a9251b72f9704dd94145496479b30cc128ac43cefca08
MD5 575de13681ad6d37c8cd7e08d47b8d44
SHA1 d00b62da34777eb5b3240a2dfeef1f74654ca8ba
SHA512 a230e2242076eae29af49744e2086c7cde37ac1a8bc4d2aceb8edea1575f334dc4070e8f5825c96cf796fc7fc1c72aba6a27298e5e45e1dcf9de587bf971b492
SSDEEP 768:oSTPeXj2unWGSPgsNds/cqvaf8IFdbV0KcBqaSXCdOaVOsn2:feXj2unWrLsAf8IF9tXCw0Osn2
TLSH
T120F2F137B263BAC89D0C92818251C41BF6DC759B3695F733262E98913C753298FDD478
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 35KB
SHA256 1a691aa5569f5faa3f1b0b79040f5708cda76f3db92a57746fe52109f25908f4
MD5 274be4c44b8eeb50fc8be37d36166b9d
SHA1 5b0d984a2b2ef4c6e2b9c9385762e9a7e3cfdfb6
SHA512 03178b8448be2a92a0cfbfea595527734fb5556179eb45f85fce9579112269484ebb6e8f2e7a5952a12d8021b5d2ef83a3f0fab45c74fa94a2c4dd770145b04d
SSDEEP 768:oSTPeXj2unWGSPgsNds/cqvaf8IFdbV0KcBqaSXCdOaVOsncF2y:feXj2unWrLsAf8IF9tXCw0Osnccy
TLSH
T1C5F2F137B213BAC8DD0891924251C427F2DC799B76A5E633292E98913C7932C8FDA478
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 41KB
SHA256 a3125ce2885316d4707285e6e54df07a210c5a1afee25f4fa7a74dcf2420a58b
MD5 20bf06b47f28dad35a89fdac12833d1f
SHA1 7f24b93db87bb156f0f4007ac4dcf0b1709f8b2a
SHA512 6cc10558484bedb1159cfad71c3614f6fcebc73b49cc3b778cc62b939d8c2b5d97a3e48d916ea019bac10e7b460765c4cd8da44d66fd857fe48bcff6e94cbda4
SSDEEP 768:oSTPeXj2unWGSPgsNds/cqvaf8IFdbV0KcBqaSXCdOaVOsncF2vjlq:feXj2unWrLsAf8IF9tXCw0OsnccvRq
TLSH
T1E513F163B2677AC8DD18D5824645C017F2D8B59F36A5E633593F98D03C7622C8BD943C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 43KB
SHA256 2d8846db78ed959c78cd26f9560f8d484a84d29ba7c83a365083f4e9e139d135
MD5 d9c03c34d5bde0ae33a61b2819ce800b
SHA1 00008ad81153fd4f0e79a285b3857aa21236e68a
SHA512 53d26138b44c6ce67616b177688b4a9eed861c61122305020c0e406491afaaa95f674a8941c355a9429b2eee151fe6a37327ddd63be67711621999f51e3e7d3a
SSDEEP 768:oSTPeXj2unWGSPgsNds/cqvaf8IFdbV0KcBqaSXCdOaVOsncF2vjlYm:feXj2unWrLsAf8IF9tXCw0OsnccvR3
TLSH
T1E413F173F2677AC8DD18D5818A45C417F2DC69AF3595E232153F98A03C6662C8BD943C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 50KB
SHA256 db94bfd44fe2a9235be2535c67db860c09efde50111da01bddaa01868154b57d
MD5 1976489ecc505b4ebf4bd187788cd288
SHA1 515621019a0cdf710eea47f6f5933b6e2939ca86
SHA512 3b9cba170b056f79750846d676aea1c93d61f4c2ab6a213855be3cb1e09aba324e6ce8364c481a6a1c76f0fcc6f216956a204ef35943894c9103e01e828f3252
SSDEEP 1536:feXj2unWrLsAf8IF9tXCw0OsnccvRUdRD:feXimMso8IF9tOOcxpWRD
TLSH
T127330263F226B6C8DC04F5928A5EC112F2DDB5DF35D9D272592E94A02C6722CCAC9C3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 53KB
SHA256 c947a25134fb85160e2f4e308994bcd7f5f58acfe09763ad3db1f2e5171a46ac
MD5 39228bfe718e8ac97076b63a369565a5
SHA1 43a3049032d5c3a60b08ee63e15990f986bf3075
SHA512 830ca830c7438309d102e9d33d0048e908acc1522346a9786c8d052d0d055b321c0a5437d5b59e9b3cdda6781d7c34672eaa7ad40d94c1d3872007f772099625
SSDEEP 1536:feXj2unWrLsAf8IF9tXCw0OsnccvRUdROh:feXimMso8IF9tOOcxpWROh
TLSH
T15633F167F226B5C8DC14E5928A59C012F3DDB5DF35D9D632162E94B02C6722CC9C6C3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 57KB
SHA256 29ce9b35578cd94c2e8e826902cf7592a94b4052a85d58a09f5468af03ec3f75
MD5 8391f13c6ec0f0dd6a9b46bc706f15a6
SHA1 c2a66af750fa8368d01d4eaf74e388b042c957fe
SHA512 74d2de9886ac473c0f17f4e16f4b098a3318c52cc9a1e977ae577ec2cd3b5aa7ba647e7a02081ec11084ee8be50496c59150335dc702e68eb919b5d206dc6649
SSDEEP 1536:feXj2unWrLsAf8IF9tXCw0OsnccvRUdROkX/:feXimMso8IF9tOOcxpWROkX/
TLSH
T16A430167F226B9C8DC14E592466EC062F2DEA5DE35C9D631592E95E02C2B22CC9C6C3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 57KB
SHA256 af093f6810475ed7b7577954218320d0103117c70df52f44fe612ecca0822f71
MD5 b5888c4b91584b492aaec365a44b1cf2
SHA1 a1b4f5115f0fce483750752e6a8bdb54f45f1f41
SHA512 086ace465a87326eab12b2426dc664943e7f873e0947d79242eb9fb66d49563198f5bec84e80660a6677c48277e23e0555d8836b83101bccd21740b6a0257347
SSDEEP 1536:feXj2unWrLsAf8IF9tXCw0OsnccvRUdROkXQ8:feXimMso8IF9tOOcxpWROkXj
TLSH
T13A430167F126B8C8DC14E596466EC052F2EDE5DE39C9C631593D95E02C1B22CC9C6C3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 866B
SHA256 0ecf97a8e0c59fb0826363ac437437ba87f3d76dcb228956383b6a1c217dafa4
MD5 3fee5b48604b6cfe1151b0426f5a2c0e
SHA1 209d8eaaab8a69480ddd5fded2456e4a5f863a46
SHA512 0528c88c829c7f2731aa3c14c056e706bbe834d4a83cb48f32042331f7dce6b2b6cbf6d44cb0c3328aac4e9a706dd2dd51991b35450705904f836a5be56901cd
TLSH
T16D11636B781B848BB561821B6B05AC69E5DEE8C73A10DE3623200D12245E7EBDF92124
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 63KB
SHA256 0bb033fd300a41a727fe3ad9603944b2e788066d522fb70f647be712d4e8206d
MD5 cace8058863d2e55048d8e089f1a2d8c
SHA1 2cf60ed158f567dfcf3b7e852039f9f89fa86d19
SHA512 6399f41eaa69a0b028f7575ca26e8c93f89bfee63815c87d97f3cec08f6d148969f6ddb5d9503e8e0d2fb958ec2f81f2a7b210ca04b0440c39b3310420e2ae80
SSDEEP 1536:feXj2unWrLsAf8IF9tXCw0OsnccvRUdROkXQkam:feXimMso8IF9tOOcxpWROkXPam
TLSH
T1D753016BF126B9C8DC24E696065DC062F2DDA5DF36C686315AA991D02C1B32CCDCAC3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 1KB
SHA256 e9e3b705889f73c708c7c951225d83db736e4b2d6439f3f4304b7e793a9e4f2d
MD5 699d17dbc676857fa929f923f3f41060
SHA1 8ebebbdba7394ff3e63afff9e16199e29a0a4020
SHA512 e40f43ca319894511ac186638d054944e15344ca050a638b25ba44120075a52f4387786ac44a07428dbc7c2d9cd85b2a0d8ede70c17e069a7c36b3a26d3d7aa0
TLSH
T190313A07A4A384CFFB78464F4B36F465E2C9BA8AB717CE3F32240D51101A7A5A6D30A0
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 2KB
SHA256 06f8ac3ac469dbf7dd7334f9d370601f03cf03abb4f9b014dd89b134614730e3
MD5 01024cfb2d7b87e58a6ca83a32bfe12e
SHA1 547873fa37eddcb8ed1966a1184f8cca62a85134
SHA512 a88bb659662892d1a8a51ddb139600525e4b8e5ff53d4b61e4b1670a164ae058fb42db1b243152d497307e1fdd81f67221abdfe70e63263f09de5f12876e7a72
TLSH
T154516D5FE8E21C89D334568B0725B04EF2C5FA493E26DE3F72240DA10056BC8AAC3034
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 91KB
SHA256 b64f97acbd65cc3c735d39ae1274c2b9a85b50a7c80df0f0acfe9ebbdc309f92
MD5 42a76550a7dc32c3068422b25cb69c98
SHA1 1d9a34ebe7adee194325fb6999d2a86d9940844d
SHA512 e434020d6cd6f9c4ed432ba1f6c2c5eeef99c90210512d7fb29e4ae9937b4623e511d8158cc2193eb4ab5b5e4d78403445b40b76950f08372a26f34390d3624b
SSDEEP 1536:feXj2unWrLsAf8IF9tXCw0OsnccvRUdROkXQkaxNedKpVDD6smJSEWcvTKDCG/rv:feXimMso8IF9tOOcxpWROkXPaTegVXk2
TLSH
T19D930257B929F9C89C10FB75070CC622F1ECE9DA32DA9A36A55994D07C1732C8CCB86D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 3KB
SHA256 bdfe3043498875d2118532688bda575ce35c9ab3c67fb7c587b1572a8c35bd41
MD5 acc5559470719fd6e46997737c033622
SHA1 feaeb3990b9703919b8e7158adbb2baf3c12de95
SHA512 5615b1a50581b0ab16aeedd71926399587e410a0d29ebccb946ec992edd772b0c439c8b52173cdc55eba00699ced2b4e4476c2cb7110987f40dfd35facac8df8
TLSH
T1B5616C5FE4D25C98E368918BC721B9A9F3C8FD0A7F2A8F3B21240D514416BA4FAC6075
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 5KB
SHA256 f845eecd2220b5c51c46380239c57a8d8045df1b7a70e39198adcca75d0549ec
MD5 7454801d41fa7cbd6ff7ea87b6d3014c
SHA1 d751744abf2e437d5d584fd275a30182badf93bd
SHA512 7ad4a314585fa8f6f9534ff41383b8ec617fb55201eb1cf29d67bc1ae349b7754b8a910e3417349cb939dd2f7fbacccaeaec8818746009f730fb6bbcfa76005d
SSDEEP 96:QHWlSRGT+1ofV8iW56nrWnpb0Pk7XXATO2678VgakOHNyFvnAc:QHWIRGT+1AJWorWzXATO267UxkOHNyFp
TLSH
T1E4B19D6FF4C93884E27441D79E21E82BF2C0AA073F2A9B33295959811416B60DEE607B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 17KB
SHA256 57f2e617bff97b8f5d08a2ab705c783c9d5e6cfa752199541ebbdb07c9769b5b
MD5 8e223c4109ccba12c8dc6431ccd33cf1
SHA1 32295b588c6a68e5b2f5f50f303c4638aeb1bb06
SHA512 4abd18d8023355941b4c1acf083d1e9d2020f8dcab839b50e90b2fe52566372d820ea9b86bed501baafc31a1b0e64d6311b6615dc88e7cbbd61281e55d0d7a17
SSDEEP 384:oNwT+aKzXjBb+Ny9BnnWGSPgKvIgdl9ds/+3q3yv/sEa+:oSTPeXj2unWGSPgsNds/cqCvV
TLSH
T1F972D02FF2566CC44B4C41C60441D826F4C13A8B3A4BCA72269E4DD53C2A668DBE98BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 18KB
SHA256 474c7d5eb757c75c822e0cb830efd4283512ee80670475dd89eab3a6ce3fbd96
MD5 0aa0be983fc88bd340ad2af0723cde26
SHA1 3a0bcac514c2e28224a20624472da47fee08d4ae
SHA512 2458787b95619b6db68c3ec2a0f14912facad5a2115032a8070dfad6960b4cb2631536a07f14b3e5b7b9a1420616e7e2184e34ffffc0ecae7f22b21a9a8a6b8c
SSDEEP 384:oNwT+aKzXjBb+Ny9BnnWGSPgKvIgdl9ds/+3q3yv/sEacyzct:oSTPeXj2unWGSPgsNds/cqCv326
TLSH
T14282D02BF2426DC49F4881D60041C866F4C17A473A0ED672269F8ED53C7E629DBE9879
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 33KB
SHA256 2fa039462f38c40198554d29a5f2d7f4f76cb954ca8f8116216031e8367c9ada
MD5 e0997cd360579ed969ad7609824e4adc
SHA1 49c41e562b983cf32a4ca193def5f9ddc1e900ba
SHA512 81c5c5a9deea2c04293733bc9ee6c1532248e6f5725824f1225cfc1849b823ced7ec5a9cd5b5eaeace8e635fca5a08d89dfd6ed1572d482e6eba70f160ae2a50
SSDEEP 768:oSTPeXj2unWGSPgsNds/cqCv326FdbV0Kc7qkSXCdOaVOsn4:feXj2unWrLs7g26F3HXCw0Osn4
TLSH
T16AF2F137B213BAC89D0CA2928250C41BF6D8759B3695F733662ED8813C752298FC9478
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 34KB
SHA256 2a58cec269795af2be6925284c41f1e8fb4941204a89b9102d588a39cf958dee
MD5 9eed718e9e40fc5efb73201283210ef7
SHA1 3e5f26281440fc2bfec0607bfb489171c61c0fb3
SHA512 63395370c05061804b99b18389dd85f067ab56ec4cdb716ff8635996e2eb1dbd6448b91e99df420d41792bfd62074a5e4fcda3af4dbb90dc00e66b2e5e330e74
SSDEEP 768:oSTPeXj2unWGSPgsNds/cqCv326FdbV0Kc7qkSXCdOaVOsn6:feXj2unWrLs7g26F3HXCw0Osn6
TLSH
T192F2F137B263BAC89D0C92818251C41BF6DC759B3695F733262E98913C753298FDD478
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 35KB
SHA256 a3156abffd7874d7b1177556e668725a9900b7a3b81427c1f0d1199bdd47ec5c
MD5 c0f25bcf837b977a5c02049149e493f7
SHA1 584810170e10af1882fdd999cedda62ee585a881
SHA512 3bf743934838ed00dea41dfad5ae6749963b9b1beed3deab4f4f495aceb790692f5161579bce4bccc41fadfd99c399ad4f1db6834b4d55385a019d45b4b9ba75
SSDEEP 768:oSTPeXj2unWGSPgsNds/cqCv326FdbV0Kc7qkSXCdOaVOsnwF2y:feXj2unWrLs7g26F3HXCw0Osnwcy
TLSH
T1FDF2F137B213BAC8DD0891924251C427F2DC799B76A5E633292E98913C7932C8FDA478
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 41KB
SHA256 b80573f8ec6cc484a9a4b3b04d31d858c8a0ec1b3770fd130689a2d0d23ba251
MD5 88d3d7f30eddbacfeda22064d6f051cc
SHA1 2833c32a8ca1996308296085eccf5d3bb450e3f0
SHA512 47e96317cb0da4a6c7d0c444c8b98070e1cf07c22ca9740f50503788037b0718cace69b681d1b4b96be40589eaf993e5236acc28e366545b69ecabd9c5af4c8b
SSDEEP 768:oSTPeXj2unWGSPgsNds/cqCv326FdbV0Kc7qkSXCdOaVOsnwF2vjlq:feXj2unWrLs7g26F3HXCw0OsnwcvRq
TLSH
T10A13F163B2677AC8DD18D5824645C017F2D8B59F36A5E633593F98D03C7622C8BD943C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 43KB
SHA256 c37177b69c2ebc93315eedb80632f29934b6f3bbe87637a7e19670585c150a33
MD5 2f7453a493cb4f67ed573a829bfa6283
SHA1 81c1c9432029a93511b47f8e020a409a6f912ee4
SHA512 740923a424ce438305a380399b38e827cee28cc76c8c468d435ee1cd183713f05e202678ddfa20471f02636c8a8e535c00426d7c8059aa0f9fe4e4aedd39137f
SSDEEP 768:oSTPeXj2unWGSPgsNds/cqCv326FdbV0Kc7qkSXCdOaVOsnwF2vjlYm:feXj2unWrLs7g26F3HXCw0OsnwcvR3
TLSH
T15F13F173F2677AC8DD18D5818A45C417F2DC69AF3595E232153F98A03C6662C8BD943C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 48KB
SHA256 fd3a7dbdf7bd74be64f019ccf44cde5392169495870a5f13daf8646a75d77e08
MD5 007c09a6395c3a4089948aae4ca40296
SHA1 5a37bd347e4ecb85a7da033480495046544ff0d4
SHA512 5fb932864f1c3c3d18e66273af97a6e633df47308eba05578f8b85970c2799daed467bb40467418f8b1199ca66224b77e23de72e4a467fa37214cb36fd4bd0ca
SSDEEP 768:oSTPeXj2unWGSPgsNds/cqCv326FdbV0Kc7qkSXCdOaVOsnwF2vjlYD5/H07iV:feXj2unWrLs7g26F3HXCw0OsnwcvRUd7
TLSH
T13A230263F26677C8DC18F5518A89C513F2DDB59F3599E232063E94A12C2762CCEC683D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 53KB
SHA256 80d27d4a6b6553b876de8d61823b41a08bf7930e7a08c5f383303a4dac68986f
MD5 9bb82bf655800365def838e9ef793385
SHA1 d5bcb9f7a1b42d3bc00ad7843e3fa9c235bca2a1
SHA512 d0e44067ee03a6f8511f3681caa22175218122324129139cd5deea296a2f9d5b358ea011f935fee2e0638da27f4e7b8088b688cc6910f7554cca9dcf00ccb06b
SSDEEP 1536:feXj2unWrLs7g26F3HXCw0OsnwcvRUdRl6:feXimMsU26F3HOOclpWRl6
TLSH
T10733F167F226B5C8DC14E5928A59C012F3DDB5DF35D9D632162E94B02C6722CC9C6C3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 57KB
SHA256 7fc83fe13e387621c7d6bddff1808e17dcc0397a642a5a1fd90ac1cadca8bd21
MD5 2627308553429949e9c24b084e809e46
SHA1 f5c2e09d3e6f284d97c4d2bb9dbbbc4fa1e0e0bb
SHA512 8a2428a6d03bef2d81bd6d649629d27d754346d1d59dc90d5cdc63568f685cb1198a0fa78c5ec07c06e62b5ffd6f699c60a829988600c1cf5545b4907eda4414
SSDEEP 1536:feXj2unWrLs7g26F3HXCw0OsnwcvRUdRlDXmY:feXimMsU26F3HOOclpWRlDXz
TLSH
T1E1430167F126B8C8DC14E596466EC052F2EDE5DE39C9C631593D95E02C1B22CC9C6C3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 58KB
SHA256 da0f6dc9d841ecb0ba1f4eae4e22c2845e951e23ddc29b1d097e08849751bbad
MD5 35af1f4bb6754af4c0ef529c4dbc0b5e
SHA1 6fc1bc5f64b0327858dfeb1b991b06e4d23a93b2
SHA512 026c5307554f6d5cacafcf32b7410e11a26fba30a46c818a87dc76979c0759bccde21e0a68a86a87fb2a9fac9a0bc4d646f25d0e6dd3c27a1b874786b8250cb3
SSDEEP 1536:feXj2unWrLs7g26F3HXCw0OsnwcvRUdRlDXmA:feXimMsU26F3HOOclpWRlDXr
TLSH
T15C430167F126B8C8DC14E686466EC052F2EDE6DE3ACAD531593D95E02C1722CCAC6C3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 64KB
SHA256 b33ef32ba38796756467a888eaa795d194511bb612f0100cb33921fa19efa78a
MD5 7be872e2803def0025ff5810724e3645
SHA1 b2ccfaeafefd00a882de8abf631025f23b1713ca
SHA512 f824bd23afdd43cc73140b236fa149466361fcd25807be1363e292016402517032d662c3145faa7f8c446ae99d66f111e11c7d0ca2c824a56c4f863f5fd61944
SSDEEP 1536:feXj2unWrLs7g26F3HXCw0OsnwcvRUdRlDXmQaxe:feXimMsU26F3HOOclpWRlDX/ac
TLSH
T11E53016BF126B9C8DC18E696065DC062F2DDE5DE36C686315AA991D02C1B328CDCAC3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 2KB
SHA256 4b5d9b05b60bd76a53fce3ca95e8bf82963fb8a894207d2588c7057db560ae19
MD5 5d259decd070cbbc3e176d6878af6e57
SHA1 477962fa5624a5e866a0bd8a1edf3ff1d15b1cf7
SHA512 882c1d998cc28cc79f1081bc5ed46213adb0a58040e7f2d09e27aa80bdb9218ca105005ee8b29b62aaf3a1d575e6aad451f227fe0703124e84e9e1a6f0169dfa
TLSH
T159513D5FE4E24C49E764558B8750F599F2C4FE497E2ACE3B21280D911459B98FAC7034
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 90KB
SHA256 44792d7e47058d4b0443b7b35608c3747cbc92042a01cbee06ffd9587dc89703
MD5 99244b36717420b56aa84888dbf8f73d
SHA1 b4f67a7da2f4b65da432e1532bd71836e38d4e4a
SHA512 163f77ae324cad9bdf5bbbdaf969dc170e41bb1a5542bc27fe26106c6105c71c67668c82f02ea07e17cf00ae115235629c789bcd806c587bbe17875cef69a540
SSDEEP 1536:feXj2unWrLs7g26F3HXCw0OsnwcvRUdRlDXmQaxNedKpVDD6smJSEWcvTKDCG/r3:feXimMsU26F3HOOclpWRlDX/aTegVXkA
TLSH
T189930257BA2AF8C49C10FB75071CC522F1ECE9CA32DA9A36A55990D07C1732C8CDB86D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 3KB
SHA256 4b5a5463943e4adb9b0ef88e6a8b3821de9367aa6de86dec9fb3a11b4c4b13ec
MD5 76821dc1d2b01ada811a4c5d79d572da
SHA1 12b9efd8d4f24c7c963a11336648c0048f070cec
SHA512 5e905672b84318f0c986ea99981a34c802f2d23ea9b99d22621077c9d88101aaf511424ba3720373f0b5ae4ff82659a3909d83207ce3dfa2c278cd655538605b
TLSH
T1AA715C5BF4D62888D658C1DB8722F9AAF3C4ED0A7F29CE37145809910025B64E9C7079
MD5 SHA1 SHA512 TLSH

Submit Download

is-K7H9A.tmp

Path C:\Drivers\sleetspank45\is-K7H9A.tmp
Size 10.3MB
SHA256 2604761e24c7656dbd77883217eb6131f499c0792863e17c5dbfaedd66208ee0
MD5 69c414daf9537b09ef0395c7509e8442
SHA1 6afb2e678322de1860db6cd1421b7cc95fd2e29e
SHA512 93495652ae6eab038a071045c3e049e348b94598a867f19708c21ec1a1f653257ec32ad7cee14f839b376f024d84db045f18dd91389c27e8d2894cf8b6850401
SSDEEP 196608:0E7P4mMFeJLvS282g/58hhga/LN8pCawXhnrvVHVl4+pHhVIuMG:LbMFeJSZhkjN9frvpVK+MG
TLSH
T148B633BB497810CB6413B2DF526BE74FCF2B6188348AF9D5B39609D877425C85382CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-KCAS7.tmp\2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp
Size 1.2MB
SHA256 3b5f8709cabc449b2156452348f1c86c05ef13b1b75c034e9390c08665c35ed3
MD5 b682b35a8347458f85b0b3af30a6088f
SHA1 88022a4f14fd25edeca1a563ed66c74a4a05f61c
SHA512 9f772fc95d9089384c081ef68279694796c5f29de7cbd795843a81ac231584c049141fd5b2c828cf6e5f60c1f76165ba6c24be8c677eb2f1ac4f95fffa151105
SSDEEP 24576:fEZXjiinrzY5tO+uKE3LMT0jECZQEbLBDBEnFWsyTM7x99M:cdmbjTKlD00T+Q
TLSH
T108553B22A7D58437D4731E358D6BC2985C367D306EA8D85ABEF8AE0C0E39B417D35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-53-0x0000000001470000-0x000000000169B000-memory.dmp

Download

memory/1212-626-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp

Download

memory/1212-308-0x000001D2AE7E0000-0x000001D2AF9E8000-memory.dmp

Download

memory/1212-330-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp

Download

memory/1212-470-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp

Download

memory/1212-469-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp

Download

memory/1212-475-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp

Download

memory/1212-476-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp

Download

memory/1212-391-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp

Download

memory/1212-627-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp

Download

memory/1212-392-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp

Download

memory/1212-398-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp

Download

memory/1212-393-0x000001D2AF9F0000-0x000001D2B2C61000-memory.dmp

Download

memory/1260-1-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1260-167-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1764-166-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/1764-6-0x0000000002480000-0x0000000002481000-memory.dmp

Download

memory/4508-630-0x0000000001480000-0x00000000016AB000-memory.dmp

Download

memory/4528-507-0x0000000001390000-0x00000000015BB000-memory.dmp

Download

memory/5352-857-0x0000000001520000-0x000000000174B000-memory.dmp

Download

memory/5984-203-0x0000016FF9C80000-0x0000016FF9D6B000-memory.dmp

Download

memory/5984-200-0x0000016FF9B90000-0x0000016FF9C78000-memory.dmp

Download

memory/5984-222-0x0000016FF9C80000-0x0000016FF9D6B000-memory.dmp

Download

memory/5984-257-0x0000016FF9C80000-0x0000016FF9D6B000-memory.dmp

Download

memory/5984-307-0x0000016FF9C80000-0x0000016FF9D6B000-memory.dmp

Download

memory/5984-383-0x0000016FF9C80000-0x0000016FF9D6B000-memory.dmp

Download