Overview

overview

10

Static

static

3

2026-11-13...at.exe

windows10-2004-x64

10

2026-11-13...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/11/2026, 19:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-13_fd8642620d3161b35ab8f89567b00810_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
  • Size 3.3MB
  • Sample261113-xvsnpafv91
  • SHA256 b10b0fb899dbc6d8b101f8514db230578373930affbaf7f13bfc8a5690f4fef7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryxmrigminerpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 1 IoCs
    miner
  • Downloads MZ/PE file 2 IoCs
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 29 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 33 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-13_fd8642620d3161b35ab8f89567b00810_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-13_fd8642620d3161b35ab8f89567b00810_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3420
    • C:\Users\Admin\AppData\Roaming\240766468.tmp
      "C:\Users\Admin\AppData\Roaming\240766468.tmp"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5616
      • C:\Users\Admin\AppData\Local\Temp\scdnfsar.exe
        "C:\Users\Admin\AppData\Local\Temp\scdnfsar.exe"
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        PID:5716
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Windows\system32\config\systemprofile\AppData\Roaming\240737046.tmp
      "C:\Windows\system32\config\systemprofile\AppData\Roaming\240737046.tmp"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5016
      • C:\Windows\TEMP\hftcfunu.exe
        "C:\Windows\TEMP\hftcfunu.exe"
        3⤵
        • Sets service image path in registry
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2656
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /Delete /TN "MicrosoftEdgeUpdateTaskMachinef3e11885" /F
          4⤵
            PID:3856
          • C:\ProgramData\ab72a1f4fddeb839\06FE5B53F3E11885\06FE5B53F3E11885.exe
            "C:\ProgramData\ab72a1f4fddeb839\06FE5B53F3E11885\06FE5B53F3E11885.exe" --host
            4⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • Checks processor information in registry
            PID:2520
    • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      1⤵
      • Executes dropped EXE
      PID:5036
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
      1⤵
        PID:3488
      • C:\Windows\system32\fxssvc.exe
        C:\Windows\system32\fxssvc.exe
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:3624
      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:3796
      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:876
      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
        1⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:4256
      • C:\Windows\System32\msdtc.exe
        C:\Windows\System32\msdtc.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:2300
      • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
        "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
        1⤵
        • Executes dropped EXE
        PID:2832
      • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        1⤵
        • Executes dropped EXE
        PID:4152
      • C:\Windows\SysWow64\perfhost.exe
        C:\Windows\SysWow64\perfhost.exe
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3616
      • C:\Windows\system32\locator.exe
        C:\Windows\system32\locator.exe
        1⤵
        • Executes dropped EXE
        PID:3784
      • C:\Windows\System32\SensorDataService.exe
        C:\Windows\System32\SensorDataService.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:2384
      • C:\Windows\System32\snmptrap.exe
        C:\Windows\System32\snmptrap.exe
        1⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        PID:2336
      • C:\Windows\system32\spectrum.exe
        C:\Windows\system32\spectrum.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:1040
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
        1⤵
          PID:3172
        • C:\Windows\System32\OpenSSH\ssh-agent.exe
          C:\Windows\System32\OpenSSH\ssh-agent.exe
          1⤵
          • Executes dropped EXE
          PID:3192
        • C:\Windows\system32\TieringEngineService.exe
          C:\Windows\system32\TieringEngineService.exe
          1⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:4408
        • C:\Windows\system32\AgentService.exe
          C:\Windows\system32\AgentService.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:224
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Executes dropped EXE
          PID:3908
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:760
        • C:\Windows\system32\wbengine.exe
          "C:\Windows\system32\wbengine.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5108
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          PID:5076
        • C:\ProgramData\ab72a1f4fddeb839\06FE5B53F3E11885\06FE5B53F3E11885.exe
          "C:\ProgramData\ab72a1f4fddeb839\06FE5B53F3E11885\06FE5B53F3E11885.exe"
          1⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1136
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /Delete /TN "MicrosoftEdgeUpdateTaskMachinef3e11885" /F
            2⤵
              PID:4264
          • C:\ProgramData\ab72a1f4fddeb839\06FE5B53F3E11885\06FE5B53F3E11885.exe
            C:\ProgramData\ab72a1f4fddeb839\06FE5B53F3E11885\06FE5B53F3E11885.exe
            1⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            PID:5028
          • C:\Windows\system32\SearchIndexer.exe
            C:\Windows\system32\SearchIndexer.exe /Embedding
            1⤵
            • Executes dropped EXE
            • Direct Volume Access: Opens a physical disk for reading
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2480
            • C:\Windows\system32\SearchProtocolHost.exe
              "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
              2⤵
              • Modifies data under HKEY_USERS
              PID:2696
            • C:\Windows\system32\SearchFilterHost.exe
              "C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 904
              2⤵
              • Modifies data under HKEY_USERS
              PID:2068

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                1
                T1546

                Component Object Model Hijacking

                1
                T1546.015

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                1
                T1546

                Component Object Model Hijacking

                1
                T1546.015

                Defense Evasion

                Direct Volume Access

                1
                T1006

                Modify Registry

                1
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Peripheral Device Discovery

                1
                T1120

                Query Registry

                3
                T1012

                System Information Discovery

                3
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Web Service

                1
                T1102

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                elevation_service.exe
                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                • Size 2.7MB
                • SHA256 08af8f02154335c08c66755064e9414194fd2da555b99643ccfd94091d48ed38
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                maintenanceservice.exe
                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                • Size 849KB
                • SHA256 db110f069f57095f24ac7c2a87151d78dcbe880d9e7f56ba881505ab7fe147c3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OSE.EXE
                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                • Size 829KB
                • SHA256 f43639df35c73f3c6dde4174a37fc1bd5bb32ebb9f59a6e164e97b24c215ea50
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                • Size 2.8MB
                • SHA256 c9dc949b200a3a7fbfbab7c06077fac1ed7b5f8e8207c64552dde60540c81e11
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                06FE5B53F3E11885.dll
                • Path C:\ProgramData\ab72a1f4fddeb839\06FE5B53F3E11885\06FE5B53F3E11885.dll
                • Size 3.4MB
                • SHA256 361a4277fb4fd7f7fa02d16de2db5cf8583b510be99a8138b76a005ab3d26080
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vh
                • Path C:\ProgramData\ab72a1f4fddeb839\06FE5B53F3E11885\vh
                • Size 16B
                • SHA256 54c50c402fc5ca107f341116cc29a7ee4a1df37beb6f8eb006357f4355c6a8fa
                • MD5 SHA1 SHA512
                Submit Download

                217799dc646ac033
                • Path C:\ProgramData\ab72a1f4fddeb839\217799dc646ac033
                • Size 17B
                • SHA256 32bf19dad066303ed98ea3c6ca29a02f41c14077a5d21bff3fc4146bf1c7c2f3
                • MD5 SHA1 SHA512
                Submit Download

                perfhost.exe
                • Path C:\Windows\SysWOW64\perfhost.exe
                • Size 610KB
                • SHA256 333f113a260d522b6d06a06667500e71aba06d4bf2723b51f6076f99436ef7ad
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AgentService.exe
                • Path C:\Windows\System32\AgentService.exe
                • Size 1.8MB
                • SHA256 d0c202138379b1c7bc90b16864a272ef3cd5c9f529d50770cf5c9fc8392afca1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DiagnosticsHub.StandardCollector.Service.exe
                • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                • Size 681KB
                • SHA256 96bf5e078ddfa806f584e6c48766a0c4d769532aa02b675f9cdb7e3e765b0097
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                FXSSVC.exe
                • Path C:\Windows\System32\FXSSVC.exe
                • Size 1.2MB
                • SHA256 55c3aa5740b483fcbba233bdff0338fec2c2021e8964d6295c50f5f3381e2613
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Locator.exe
                • Path C:\Windows\System32\Locator.exe
                • Size 600KB
                • SHA256 1043bbf95942b0489bc7a6c1a99cf780f21db0457892c49e00d6705efe8b2198
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ssh-agent.exe
                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                • Size 963KB
                • SHA256 4a812175b9808537e3a4df8b774ac58c0d9d67b5c9d5effa6511c35dd5c2b46b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PerceptionSimulationService.exe
                • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                • Size 693KB
                • SHA256 f74fc44ab1e6ef52589c5110ecdca9146c3e54bdadecf89dbb8fed764db068b8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SearchIndexer.exe
                • Path C:\Windows\System32\SearchIndexer.exe
                • Size 1.5MB
                • SHA256 9948f7f34493a6db5179bd3ed63da9ac793cfc502b39840d52d965090f006afe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SensorDataService.exe
                • Path C:\Windows\System32\SensorDataService.exe
                • Size 1.8MB
                • SHA256 c6628ecebc07fc67cacb7d2441ff7f54be308a7f1497b61d64b8d7629c37a087
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Spectrum.exe
                • Path C:\Windows\System32\Spectrum.exe
                • Size 1.4MB
                • SHA256 4c34a4a86c90acc4cbf8afc4a9b739d82dd42576f03d2c8a5236e2e3c778f605
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                TieringEngineService.exe
                • Path C:\Windows\System32\TieringEngineService.exe
                • Size 907KB
                • SHA256 5666cecbae66db5f3e3f0c59ea03a1e03425ddf1f3f3ce484454dafae46eb962
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSSVC.exe
                • Path C:\Windows\System32\VSSVC.exe
                • Size 2.0MB
                • SHA256 38d9ca626517c26b382350b002c7b4b6377470bb68916afde8d354225901388f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                alg.exe
                • Path C:\Windows\System32\alg.exe
                • Size 682KB
                • SHA256 3655693cf5f2f94f96e6de45ad2bab28881161bfe2e15138efdd6c7ef46b956d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                240737046.tmp
                • Path C:\Windows\System32\config\systemprofile\AppData\Roaming\240737046.tmp
                • Size 4KB
                • SHA256 51bb056e70a295d38b11e94711505e585989e987726652529c0327b1bb48d4bf
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                msdtc.exe
                • Path C:\Windows\System32\msdtc.exe
                • Size 734KB
                • SHA256 8f2eb2571c734cdb9dc9a54a90a9543f01ac30050feb7511083f109ba706f560
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                snmptrap.exe
                • Path C:\Windows\System32\snmptrap.exe
                • Size 605KB
                • SHA256 c4bf73cf463434114851f8cca5e102cea03841371197485be38f6efedc77e22c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vds.exe
                • Path C:\Windows\System32\vds.exe
                • Size 1.3MB
                • SHA256 28d72b0fa32fc4b0580b9105899639d32647ec27ef50451319410a9f63b1ff1a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WmiApSrv.exe
                • Path C:\Windows\System32\wbem\WmiApSrv.exe
                • Size 794KB
                • SHA256 bead3e331f028ac10d5d65f9f144766c6be970b031cad231af5e0160aaccd36d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wbengine.exe
                • Path C:\Windows\System32\wbengine.exe
                • Size 2.1MB
                • SHA256 413db5f8115d2e8e325f16248685bbb0b960b8a801c9aaecc3d2554b961258a7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                hftcfunu.exe
                • Path C:\Windows\TEMP\hftcfunu.exe
                • Size 3.9MB
                • SHA256 96c38f706d0dbf6d7c4f63784f326c9119e2ff9cd6d0dd73c086fbebc639b683
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/224-174-0x000001A5C2200000-0x000001A5C2266000-memory.dmp
                Download

                memory/224-176-0x00007FF75D390000-0x00007FF75D7B9000-memory.dmp
                Download

                memory/224-169-0x000001A5C2200000-0x000001A5C2266000-memory.dmp
                Download

                memory/224-170-0x00007FF75D390000-0x00007FF75D7B9000-memory.dmp
                Download

                memory/224-168-0x000001A5C2200000-0x000001A5C2266000-memory.dmp
                Download

                memory/760-184-0x000001FA40F00000-0x000001FA40F66000-memory.dmp
                Download

                memory/760-187-0x00007FF6D1170000-0x00007FF6D164D000-memory.dmp
                Download

                memory/760-185-0x000001FA40F00000-0x000001FA40F66000-memory.dmp
                Download

                memory/760-320-0x00007FF6D1170000-0x00007FF6D164D000-memory.dmp
                Download

                memory/876-54-0x0000017C1AA20000-0x0000017C1AAE6000-memory.dmp
                Download

                memory/876-55-0x0000017C1AC10000-0x0000017C1AC76000-memory.dmp
                Download

                memory/876-56-0x0000017C1AC10000-0x0000017C1AC76000-memory.dmp
                Download

                memory/1040-142-0x000001F5DCA50000-0x000001F5DCAB6000-memory.dmp
                Download

                memory/1040-141-0x000001F5DCA50000-0x000001F5DCAB6000-memory.dmp
                Download

                memory/1040-143-0x00007FF707050000-0x00007FF707374000-memory.dmp
                Download

                memory/1040-197-0x00007FF707050000-0x00007FF707374000-memory.dmp
                Download

                memory/1724-16-0x0000024A0AD80000-0x0000024A0ADE6000-memory.dmp
                Download

                memory/1724-18-0x0000024A0AD80000-0x0000024A0ADE6000-memory.dmp
                Download

                memory/1724-15-0x00007FF622240000-0x00007FF622327000-memory.dmp
                Download

                memory/1724-62-0x00007FF622240000-0x00007FF622327000-memory.dmp
                Download

                memory/2068-522-0x00000228A6F40000-0x00000228A6F50000-memory.dmp
                Download

                memory/2068-523-0x00000228A6F40000-0x00000228A6F50000-memory.dmp
                Download

                memory/2068-521-0x00000228A6F40000-0x00000228A6F50000-memory.dmp
                Download

                memory/2068-520-0x00000228A6F40000-0x00000228A6F50000-memory.dmp
                Download

                memory/2068-525-0x00000228A6F40000-0x00000228A6F50000-memory.dmp
                Download

                memory/2068-524-0x00000228A6F40000-0x00000228A6F50000-memory.dmp
                Download

                memory/2300-75-0x00007FF717C80000-0x00007FF717D94000-memory.dmp
                Download

                memory/2300-76-0x0000021E312D0000-0x0000021E31336000-memory.dmp
                Download

                memory/2300-164-0x00007FF717C80000-0x00007FF717D94000-memory.dmp
                Download

                memory/2300-77-0x0000021E312D0000-0x0000021E31336000-memory.dmp
                Download

                memory/2336-135-0x000001595FB70000-0x000001595FBD6000-memory.dmp
                Download

                memory/2336-133-0x00007FF6E6AA0000-0x00007FF6E6B4B000-memory.dmp
                Download

                memory/2336-191-0x00007FF6E6AA0000-0x00007FF6E6B4B000-memory.dmp
                Download

                memory/2336-134-0x000001595FB70000-0x000001595FBD6000-memory.dmp
                Download

                memory/2384-129-0x00007FF61B400000-0x00007FF61B86D000-memory.dmp
                Download

                memory/2384-124-0x00000250EC010000-0x00000250EC076000-memory.dmp
                Download

                memory/2384-125-0x00000250EC010000-0x00000250EC076000-memory.dmp
                Download

                memory/2384-211-0x00007FF61B400000-0x00007FF61B86D000-memory.dmp
                Download

                memory/2384-208-0x00000250EC010000-0x00000250EC076000-memory.dmp
                Download

                memory/2384-186-0x00007FF61B400000-0x00007FF61B86D000-memory.dmp
                Download

                memory/2480-516-0x000001F5A03D0000-0x000001F5A03D8000-memory.dmp
                Download

                memory/2480-279-0x00007FF757E10000-0x00007FF758164000-memory.dmp
                Download

                memory/2480-278-0x000001F595820000-0x000001F595886000-memory.dmp
                Download

                memory/2480-277-0x000001F595820000-0x000001F595886000-memory.dmp
                Download

                memory/2480-318-0x000001F59ED50000-0x000001F59ED58000-memory.dmp
                Download

                memory/2480-350-0x00007FF757E10000-0x00007FF758164000-memory.dmp
                Download

                memory/2480-302-0x000001F596990000-0x000001F5969A0000-memory.dmp
                Download

                memory/2480-286-0x000001F596760000-0x000001F596770000-memory.dmp
                Download

                memory/2520-236-0x0000000001800000-0x0000000001C0F000-memory.dmp
                Download

                memory/2520-243-0x00000000004F0000-0x0000000000510000-memory.dmp
                Download

                memory/2520-235-0x0000000000C90000-0x0000000001002000-memory.dmp
                Download

                memory/2520-245-0x0000000000C90000-0x0000000001002000-memory.dmp
                Download

                memory/2656-202-0x0000000140000000-0x0000000140404000-memory.dmp
                Download

                memory/2832-89-0x000002531EA00000-0x000002531EA66000-memory.dmp
                Download

                memory/2832-88-0x000002531EA00000-0x000002531EA66000-memory.dmp
                Download

                memory/2832-87-0x000002531E860000-0x000002531E926000-memory.dmp
                Download

                memory/3192-155-0x00007FF7CE990000-0x00007FF7CEB7F000-memory.dmp
                Download

                memory/3192-212-0x00007FF7CE990000-0x00007FF7CEB7F000-memory.dmp
                Download

                memory/3192-151-0x000001D13AA80000-0x000001D13AAE6000-memory.dmp
                Download

                memory/3192-150-0x000001D13AA80000-0x000001D13AAE6000-memory.dmp
                Download

                memory/3420-7-0x0000000002D30000-0x0000000002D99000-memory.dmp
                Download

                memory/3420-0-0x0000000002D30000-0x0000000002D99000-memory.dmp
                Download

                memory/3420-1-0x0000000002DE0000-0x0000000002F3D000-memory.dmp
                Download

                memory/3420-6-0x0000000002D30000-0x0000000002D99000-memory.dmp
                Download

                memory/3616-104-0x0000000000400000-0x00000000004AE000-memory.dmp
                Download

                memory/3616-110-0x0000000000800000-0x0000000000869000-memory.dmp
                Download

                memory/3616-177-0x0000000000400000-0x00000000004AE000-memory.dmp
                Download

                memory/3616-105-0x0000000000800000-0x0000000000869000-memory.dmp
                Download

                memory/3624-35-0x00007FF773630000-0x00007FF7738B8000-memory.dmp
                Download

                memory/3624-36-0x0000014514DE0000-0x0000014514E46000-memory.dmp
                Download

                memory/3624-37-0x0000014514DE0000-0x0000014514E46000-memory.dmp
                Download

                memory/3624-41-0x0000014514DE0000-0x0000014514E46000-memory.dmp
                Download

                memory/3624-43-0x00007FF773630000-0x00007FF7738B8000-memory.dmp
                Download

                memory/3784-118-0x0000027FB11F0000-0x0000027FB1256000-memory.dmp
                Download

                memory/3784-180-0x00007FF6A0110000-0x00007FF6A01B8000-memory.dmp
                Download

                memory/3784-116-0x00007FF6A0110000-0x00007FF6A01B8000-memory.dmp
                Download

                memory/3784-117-0x0000027FB11F0000-0x0000027FB1256000-memory.dmp
                Download

                memory/3796-48-0x000001B0E2F10000-0x000001B0E2F76000-memory.dmp
                Download

                memory/3796-47-0x000001B0E2F10000-0x000001B0E2F76000-memory.dmp
                Download

                memory/3796-46-0x000001B0E2D20000-0x000001B0E2DE6000-memory.dmp
                Download

                memory/3908-268-0x00007FF60F3C0000-0x00007FF60F67E000-memory.dmp
                Download

                memory/3908-181-0x00007FF60F3C0000-0x00007FF60F67E000-memory.dmp
                Download

                memory/4152-98-0x0000019BD3080000-0x0000019BD30E6000-memory.dmp
                Download

                memory/4152-97-0x0000019BD3080000-0x0000019BD30E6000-memory.dmp
                Download

                memory/4152-167-0x00007FF7B0A80000-0x00007FF7B0B6A000-memory.dmp
                Download

                memory/4152-96-0x00007FF7B0A80000-0x00007FF7B0B6A000-memory.dmp
                Download

                memory/4256-72-0x00007FF729C80000-0x00007FF729DE8000-memory.dmp
                Download

                memory/4256-70-0x000002A967840000-0x000002A9678A6000-memory.dmp
                Download

                memory/4256-63-0x00007FF729C80000-0x00007FF729DE8000-memory.dmp
                Download

                memory/4256-64-0x000002A967840000-0x000002A9678A6000-memory.dmp
                Download

                memory/4256-65-0x000002A967840000-0x000002A9678A6000-memory.dmp
                Download

                memory/4408-160-0x0000018E313D0000-0x0000018E31436000-memory.dmp
                Download

                memory/4408-159-0x0000018E313D0000-0x0000018E31436000-memory.dmp
                Download

                memory/4408-214-0x00007FF74E0B0000-0x00007FF74E23F000-memory.dmp
                Download

                memory/4408-158-0x00007FF74E0B0000-0x00007FF74E23F000-memory.dmp
                Download

                memory/5036-29-0x000001D4447B0000-0x000001D444816000-memory.dmp
                Download

                memory/5036-95-0x00007FF622DB0000-0x00007FF622E94000-memory.dmp
                Download

                memory/5036-27-0x000001D4447B0000-0x000001D444816000-memory.dmp
                Download

                memory/5036-26-0x00007FF622DB0000-0x00007FF622E94000-memory.dmp
                Download

                memory/5076-348-0x00007FF770770000-0x00007FF7708AB000-memory.dmp
                Download

                memory/5076-249-0x00000256334A0000-0x0000025633506000-memory.dmp
                Download

                memory/5076-254-0x00007FF770770000-0x00007FF7708AB000-memory.dmp
                Download

                memory/5076-250-0x00000256334A0000-0x0000025633506000-memory.dmp
                Download

                memory/5108-215-0x000002592CF10000-0x000002592CF76000-memory.dmp
                Download

                memory/5108-332-0x00007FF664350000-0x00007FF66487B000-memory.dmp
                Download

                memory/5108-216-0x000002592CF10000-0x000002592CF76000-memory.dmp
                Download

                memory/5108-217-0x00007FF664350000-0x00007FF66487B000-memory.dmp
                Download