Overview

overview

10

Static

static

3

2026-11-13...at.exe

windows10-2004-x64

10

2026-11-13...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 19:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-13_fd8642620d3161b35ab8f89567b00810_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
  • Size 3.3MB
  • Sample261113-xvsnpafv91
  • SHA256 b10b0fb899dbc6d8b101f8514db230578373930affbaf7f13bfc8a5690f4fef7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryxmrigminerpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 1 IoCs
    miner
  • Downloads MZ/PE file 2 IoCs
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 29 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 25 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 33 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-13_fd8642620d3161b35ab8f89567b00810_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-13_fd8642620d3161b35ab8f89567b00810_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5008
    • C:\Users\Admin\AppData\Roaming\240836390.tmp
      "C:\Users\Admin\AppData\Roaming\240836390.tmp"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3120
      • C:\Users\Admin\AppData\Local\Temp\strbkvsq.exe
        "C:\Users\Admin\AppData\Local\Temp\strbkvsq.exe"
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2020
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks.exe /Delete /TN "MicrosoftEdgeUpdateTaskMachine2999a65d" /F
          4⤵
            PID:3556
    • C:\Windows\System32\alg.exe
      C:\Windows\System32\alg.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2892
      • C:\Windows\system32\config\systemprofile\AppData\Roaming\240733812.tmp
        "C:\Windows\system32\config\systemprofile\AppData\Roaming\240733812.tmp"
        2⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:352
        • C:\Windows\TEMP\rqsiqpdw.exe
          "C:\Windows\TEMP\rqsiqpdw.exe"
          3⤵
          • Sets service image path in registry
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5640
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /Delete /TN "MicrosoftEdgeUpdateTaskMachine2999a65d" /F
            4⤵
              PID:3084
            • C:\ProgramData\486f225c585cf5ff\3354EC4C2999A65D\3354EC4C2999A65D.exe
              "C:\ProgramData\486f225c585cf5ff\3354EC4C2999A65D\3354EC4C2999A65D.exe" --host
              4⤵
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • Checks processor information in registry
              PID:4804
      • C:\Windows\System32\GameInputSvc.exe
        C:\Windows\System32\GameInputSvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3300
        • C:\Windows\System32\GameInputSvc.exe
          "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
          2⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:776
      • C:\ProgramData\486f225c585cf5ff\3354EC4C2999A65D\3354EC4C2999A65D.exe
        "C:\ProgramData\486f225c585cf5ff\3354EC4C2999A65D\3354EC4C2999A65D.exe"
        1⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5112
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks.exe /Delete /TN "MicrosoftEdgeUpdateTaskMachine2999a65d" /F
          2⤵
            PID:3704
        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
          1⤵
          • Executes dropped EXE
          PID:3316
        • C:\ProgramData\486f225c585cf5ff\3354EC4C2999A65D\3354EC4C2999A65D.exe
          C:\ProgramData\486f225c585cf5ff\3354EC4C2999A65D\3354EC4C2999A65D.exe
          1⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          PID:820
        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
          1⤵
          • Executes dropped EXE
          PID:5516
        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
          "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
          1⤵
          • Executes dropped EXE
          PID:1536
        • C:\Windows\System32\msdtc.exe
          C:\Windows\System32\msdtc.exe
          1⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:1212
        • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
          "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
          1⤵
          • Executes dropped EXE
          PID:4676
        • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
          C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
          1⤵
          • Executes dropped EXE
          PID:3592
        • C:\Windows\SysWow64\perfhost.exe
          C:\Windows\SysWow64\perfhost.exe
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5648
        • C:\Windows\System32\ReFsDedupSvc.exe
          C:\Windows\System32\ReFsDedupSvc.exe
          1⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:4484
        • C:\Windows\system32\locator.exe
          C:\Windows\system32\locator.exe
          1⤵
          • Executes dropped EXE
          PID:2200
        • C:\Windows\System32\SensorDataService.exe
          C:\Windows\System32\SensorDataService.exe
          1⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Checks SCSI registry key(s)
          PID:1244
        • C:\Windows\System32\snmptrap.exe
          C:\Windows\System32\snmptrap.exe
          1⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          PID:5860
        • C:\Windows\System32\OpenSSH\ssh-agent.exe
          C:\Windows\System32\OpenSSH\ssh-agent.exe
          1⤵
          • Executes dropped EXE
          PID:5248
        • C:\Windows\system32\TieringEngineService.exe
          C:\Windows\system32\TieringEngineService.exe
          1⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:3380
        • C:\Windows\system32\AgentService.exe
          C:\Windows\system32\AgentService.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4312
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Executes dropped EXE
          PID:4932
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3968
        • C:\Windows\system32\wbengine.exe
          "C:\Windows\system32\wbengine.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1372
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          PID:1284
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1232
          • C:\Windows\System32\SearchProtocolHost.exe
            "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:6020
          • C:\Windows\System32\SearchProtocolHost.exe
            "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
            2⤵
              PID:5600
            • C:\Windows\System32\SearchFilterHost.exe
              "C:\Windows\System32\SearchFilterHost.exe" 952 2224 1792 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
              2⤵
              • Modifies data under HKEY_USERS
              PID:3384
            • C:\Windows\System32\SearchFilterHost.exe
              "C:\Windows\System32\SearchFilterHost.exe" 952 1776 632 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
              2⤵
              • Modifies data under HKEY_USERS
              PID:1996

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                1
                T1546

                Component Object Model Hijacking

                1
                T1546.015

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                1
                T1546

                Component Object Model Hijacking

                1
                T1546.015

                Defense Evasion

                Modify Registry

                1
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Peripheral Device Discovery

                2
                T1120

                Query Registry

                4
                T1012

                System Information Discovery

                4
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Web Service

                1
                T1102

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                elevation_service.exe
                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                • Size 2.7MB
                • SHA256 8bd07e01d8aef24df56c2cee44b3b220c4270c602f9ba96479b68d6dcd265dbf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                maintenanceservice.exe
                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                • Size 849KB
                • SHA256 db78635a15f617098c3e7c1aa911115fc7b6420432ad330a80bb519028e6b5b7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OSE.EXE
                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                • Size 829KB
                • SHA256 6dddc7a55943c04d14233669caf63084273ebd84a17069dff408d52a2ec9e8f6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                • Size 2.8MB
                • SHA256 ab7cadcc7aea7f4c7eed5ec501d0047741913d36f66f1c805e3320b1306f2db9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                3354EC4C2999A65D.dll
                • Path C:\ProgramData\486f225c585cf5ff\3354EC4C2999A65D\3354EC4C2999A65D.dll
                • Size 3.4MB
                • SHA256 361a4277fb4fd7f7fa02d16de2db5cf8583b510be99a8138b76a005ab3d26080
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vh
                • Path C:\ProgramData\486f225c585cf5ff\3354EC4C2999A65D\vh
                • Size 16B
                • SHA256 54c50c402fc5ca107f341116cc29a7ee4a1df37beb6f8eb006357f4355c6a8fa
                • MD5 SHA1 SHA512
                Submit Download

                93e426fda62c54d5
                • Path C:\ProgramData\486f225c585cf5ff\93e426fda62c54d5
                • Size 17B
                • SHA256 297fc86e8ceb5efeb295e2ded3c784ea728bf2c3818a27553ded8b2c8fe4b221
                • MD5 SHA1 SHA512
                Submit Download

                perfhost.exe
                • Path C:\Windows\SysWOW64\perfhost.exe
                • Size 610KB
                • SHA256 855d95e3f563155e2eb11264e137f73209c9baf0a24c13c54c69059fbeaa8867
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AgentService.exe
                • Path C:\Windows\System32\AgentService.exe
                • Size 1.4MB
                • SHA256 a1a02914728f289c18556d253f2aff13774f53cb1c65fca16d17b482478ba8e8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GameInputSvc.exe
                • Path C:\Windows\System32\GameInputSvc.exe
                • Size 664KB
                • SHA256 12c693580df3fae3cfaee764ce4612a3fb2db8af09430fd2fca2a5e6cf0871cc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Locator.exe
                • Path C:\Windows\System32\Locator.exe
                • Size 624KB
                • SHA256 03fa7272c10347a5e8c006769c662c17a3ce02176a8dbfcf6f69c2b84c8274d0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ssh-agent.exe
                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                • Size 1.1MB
                • SHA256 5dadfd1032b89c560b782ab89d4121a19104b31665f290c9a8d381747fe690b5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PerceptionSimulationService.exe
                • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                • Size 832KB
                • SHA256 a187c86363cc6f7534d01efa942f5acc04106bfb58ab2d0f4340161f95d4fd0f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ReFsDedupSvc.exe
                • Path C:\Windows\System32\ReFsDedupSvc.exe
                • Size 2.7MB
                • SHA256 e1ac921ada05dd162266577eac2a8aff8709c425b0f04b987e8baea2c02ba59c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SearchIndexer.exe
                • Path C:\Windows\System32\SearchIndexer.exe
                • Size 1.5MB
                • SHA256 23c286bea49a22550f865b1403442b76eb0363cc28ba554ff55f2e2c11b2fe35
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SensorDataService.exe
                • Path C:\Windows\System32\SensorDataService.exe
                • Size 1.7MB
                • SHA256 d597c54f092ba5a57bac0fed7086445eb511a89c035073c21e54ac341c7db236
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                TieringEngineService.exe
                • Path C:\Windows\System32\TieringEngineService.exe
                • Size 932KB
                • SHA256 61a57d06780a8508754e167d7733ad81568e5cf9199f87428e257f1cd192c738
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSSVC.exe
                • Path C:\Windows\System32\VSSVC.exe
                • Size 2.0MB
                • SHA256 fd64f40302a83482b7af6249705a991f56f273de01968a91fb9409ac64f44de5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                alg.exe
                • Path C:\Windows\System32\alg.exe
                • Size 780KB
                • SHA256 b2eb262cdb9c039ebb07184bf9e6fd3312ba1e3bc456192544a8edc6efe89d13
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                240733812.tmp
                • Path C:\Windows\System32\config\systemprofile\AppData\Roaming\240733812.tmp
                • Size 4KB
                • SHA256 51bb056e70a295d38b11e94711505e585989e987726652529c0327b1bb48d4bf
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                msdtc.exe
                • Path C:\Windows\System32\msdtc.exe
                • Size 764KB
                • SHA256 2cb22af640a436b1f4cc582a695bf7651c1b12a32b07446ee0499914e87413f2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                snmptrap.exe
                • Path C:\Windows\System32\snmptrap.exe
                • Size 632KB
                • SHA256 a7788cbec61f4ebc21bb2d1526c99b8063cc6b026da0d3405de901444b7993a4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vds.exe
                • Path C:\Windows\System32\vds.exe
                • Size 1.2MB
                • SHA256 343e0a2a2a6f43b21c1ad8319a7f0bf3e092286d3889c48d911437c906d2ec7c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WmiApSrv.exe
                • Path C:\Windows\System32\wbem\WmiApSrv.exe
                • Size 792KB
                • SHA256 d361dd5a90939f7b64b1c3a519b07f1073dab17eb1d85ae09ced1b008b38e95a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wbengine.exe
                • Path C:\Windows\System32\wbengine.exe
                • Size 2.1MB
                • SHA256 a8e24dc16a8d186a72ee38608515f00fd8688bdadae2a1684c57a008e6c5470b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                rqsiqpdw.exe
                • Path C:\Windows\Temp\rqsiqpdw.exe
                • Size 3.9MB
                • SHA256 96c38f706d0dbf6d7c4f63784f326c9119e2ff9cd6d0dd73c086fbebc639b683
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/776-112-0x00007FF6541F0000-0x00007FF6542B9000-memory.dmp
                Download

                memory/776-34-0x00007FF6541F0000-0x00007FF6542B9000-memory.dmp
                Download

                memory/776-36-0x00000211E3900000-0x00000211E3966000-memory.dmp
                Download

                memory/776-37-0x00000211E3900000-0x00000211E3966000-memory.dmp
                Download

                memory/776-35-0x00000211E3900000-0x00000211E3966000-memory.dmp
                Download

                memory/1212-221-0x00007FF7E6F80000-0x00007FF7E709A000-memory.dmp
                Download

                memory/1212-137-0x0000022C469A0000-0x0000022C46A06000-memory.dmp
                Download

                memory/1212-136-0x0000022C469A0000-0x0000022C46A06000-memory.dmp
                Download

                memory/1212-135-0x00007FF7E6F80000-0x00007FF7E709A000-memory.dmp
                Download

                memory/1232-287-0x0000023074F80000-0x0000023074FE6000-memory.dmp
                Download

                memory/1232-286-0x0000023074F80000-0x0000023074FE6000-memory.dmp
                Download

                memory/1232-285-0x00007FF6125F0000-0x00007FF61292E000-memory.dmp
                Download

                memory/1232-312-0x00007FF6125F0000-0x00007FF61292E000-memory.dmp
                Download

                memory/1244-298-0x000002838A5F0000-0x000002838A656000-memory.dmp
                Download

                memory/1244-196-0x000002838A5F0000-0x000002838A656000-memory.dmp
                Download

                memory/1244-195-0x000002838A5F0000-0x000002838A656000-memory.dmp
                Download

                memory/1244-194-0x00007FF6FBA20000-0x00007FF6FBE36000-memory.dmp
                Download

                memory/1244-263-0x00007FF6FBA20000-0x00007FF6FBE36000-memory.dmp
                Download

                memory/1244-300-0x00007FF6FBA20000-0x00007FF6FBE36000-memory.dmp
                Download

                memory/1284-276-0x00000279E0910000-0x00000279E0976000-memory.dmp
                Download

                memory/1284-274-0x00007FF6ECC70000-0x00007FF6ECD9E000-memory.dmp
                Download

                memory/1284-311-0x00007FF6ECC70000-0x00007FF6ECD9E000-memory.dmp
                Download

                memory/1284-275-0x00000279E0910000-0x00000279E0976000-memory.dmp
                Download

                memory/1372-264-0x00007FF78B450000-0x00007FF78B956000-memory.dmp
                Download

                memory/1372-310-0x00007FF78B450000-0x00007FF78B956000-memory.dmp
                Download

                memory/1372-266-0x000001A227F80000-0x000001A227FE6000-memory.dmp
                Download

                memory/1372-265-0x000001A227F80000-0x000001A227FE6000-memory.dmp
                Download

                memory/1536-133-0x00007FF69C1D0000-0x00007FF69C338000-memory.dmp
                Download

                memory/1536-125-0x000002CBBD270000-0x000002CBBD2D6000-memory.dmp
                Download

                memory/1536-123-0x00007FF69C1D0000-0x00007FF69C338000-memory.dmp
                Download

                memory/1536-130-0x000002CBBD270000-0x000002CBBD2D6000-memory.dmp
                Download

                memory/1536-124-0x000002CBBD270000-0x000002CBBD2D6000-memory.dmp
                Download

                memory/2200-186-0x0000024D9BDD0000-0x0000024D9BE36000-memory.dmp
                Download

                memory/2200-187-0x0000024D9BDD0000-0x0000024D9BE36000-memory.dmp
                Download

                memory/2200-185-0x00007FF7DB4B0000-0x00007FF7DB55D000-memory.dmp
                Download

                memory/2200-260-0x00007FF7DB4B0000-0x00007FF7DB55D000-memory.dmp
                Download

                memory/2892-14-0x00007FF7BDBA0000-0x00007FF7BDCC3000-memory.dmp
                Download

                memory/2892-17-0x0000027E9FC50000-0x0000027E9FCB6000-memory.dmp
                Download

                memory/2892-83-0x00007FF7BDBA0000-0x00007FF7BDCC3000-memory.dmp
                Download

                memory/2892-16-0x0000027E9FC50000-0x0000027E9FCB6000-memory.dmp
                Download

                memory/2892-15-0x0000027E9FC50000-0x0000027E9FCB6000-memory.dmp
                Download

                memory/3300-111-0x00007FF6541F0000-0x00007FF6542B9000-memory.dmp
                Download

                memory/3300-28-0x0000022658800000-0x0000022658866000-memory.dmp
                Download

                memory/3300-26-0x0000022658800000-0x0000022658866000-memory.dmp
                Download

                memory/3300-25-0x00007FF6541F0000-0x00007FF6542B9000-memory.dmp
                Download

                memory/3316-97-0x00000256C6100000-0x00000256C6166000-memory.dmp
                Download

                memory/3316-98-0x00000256C6100000-0x00000256C6166000-memory.dmp
                Download

                memory/3316-96-0x00000256C5F30000-0x00000256C5FF6000-memory.dmp
                Download

                memory/3380-222-0x0000018E7D810000-0x0000018E7D876000-memory.dmp
                Download

                memory/3380-284-0x00007FF794F80000-0x00007FF795114000-memory.dmp
                Download

                memory/3380-223-0x0000018E7D810000-0x0000018E7D876000-memory.dmp
                Download

                memory/3380-224-0x00007FF794F80000-0x00007FF795114000-memory.dmp
                Download

                memory/3592-155-0x00007FF7092F0000-0x00007FF70943A000-memory.dmp
                Download

                memory/3592-158-0x000001FD89420000-0x000001FD89486000-memory.dmp
                Download

                memory/3592-157-0x000001FD89420000-0x000001FD89486000-memory.dmp
                Download

                memory/3592-230-0x00007FF7092F0000-0x00007FF70943A000-memory.dmp
                Download

                memory/3968-253-0x000001B573180000-0x000001B5731E6000-memory.dmp
                Download

                memory/3968-256-0x00007FF715D20000-0x00007FF7161F0000-memory.dmp
                Download

                memory/3968-255-0x000001B573180000-0x000001B5731E6000-memory.dmp
                Download

                memory/3968-307-0x00007FF715D20000-0x00007FF7161F0000-memory.dmp
                Download

                memory/4312-231-0x00007FF6B8640000-0x00007FF6B8960000-memory.dmp
                Download

                memory/4312-233-0x000001FAEB510000-0x000001FAEB576000-memory.dmp
                Download

                memory/4312-232-0x000001FAEB510000-0x000001FAEB576000-memory.dmp
                Download

                memory/4312-237-0x000001FAEB510000-0x000001FAEB576000-memory.dmp
                Download

                memory/4312-239-0x00007FF6B8640000-0x00007FF6B8960000-memory.dmp
                Download

                memory/4484-179-0x00000201406D0000-0x0000020140736000-memory.dmp
                Download

                memory/4484-178-0x00007FF7905B0000-0x00007FF790CF3000-memory.dmp
                Download

                memory/4484-254-0x00007FF7905B0000-0x00007FF790CF3000-memory.dmp
                Download

                memory/4484-418-0x00007FF7905B0000-0x00007FF790CF3000-memory.dmp
                Download

                memory/4484-416-0x00000201406D0000-0x0000020140736000-memory.dmp
                Download

                memory/4484-177-0x00000201406D0000-0x0000020140736000-memory.dmp
                Download

                memory/4676-147-0x000002818BD60000-0x000002818BE26000-memory.dmp
                Download

                memory/4676-148-0x000002818BCE0000-0x000002818BD46000-memory.dmp
                Download

                memory/4676-149-0x000002818BCE0000-0x000002818BD46000-memory.dmp
                Download

                memory/4804-70-0x0000000000D60000-0x00000000010D2000-memory.dmp
                Download

                memory/4804-80-0x0000000000D60000-0x00000000010D2000-memory.dmp
                Download

                memory/4804-78-0x0000000002060000-0x0000000002080000-memory.dmp
                Download

                memory/4804-71-0x00000000018C0000-0x0000000001CCF000-memory.dmp
                Download

                memory/4932-243-0x00007FF7E7D50000-0x00007FF7E7FDA000-memory.dmp
                Download

                memory/4932-304-0x00007FF7E7D50000-0x00007FF7E7FDA000-memory.dmp
                Download

                memory/4932-244-0x0000021D8C380000-0x0000021D8C3E6000-memory.dmp
                Download

                memory/4932-245-0x0000021D8C380000-0x0000021D8C3E6000-memory.dmp
                Download

                memory/5008-5-0x00000000033A0000-0x00000000034FD000-memory.dmp
                Download

                memory/5008-6-0x00000000035E0000-0x0000000003649000-memory.dmp
                Download

                memory/5008-0-0x00000000035E0000-0x0000000003649000-memory.dmp
                Download

                memory/5248-212-0x00007FF730910000-0x00007FF730BB3000-memory.dmp
                Download

                memory/5248-281-0x00007FF730910000-0x00007FF730BB3000-memory.dmp
                Download

                memory/5248-214-0x0000028847BA0000-0x0000028847C06000-memory.dmp
                Download

                memory/5248-215-0x0000028847BA0000-0x0000028847C06000-memory.dmp
                Download

                memory/5516-117-0x000001F653760000-0x000001F6537C6000-memory.dmp
                Download

                memory/5516-115-0x000001F653570000-0x000001F653636000-memory.dmp
                Download

                memory/5516-116-0x000001F653760000-0x000001F6537C6000-memory.dmp
                Download

                memory/5640-50-0x0000000140000000-0x0000000140404000-memory.dmp
                Download

                memory/5648-164-0x0000000000400000-0x00000000004AE000-memory.dmp
                Download

                memory/5648-165-0x0000000000930000-0x0000000000999000-memory.dmp
                Download

                memory/5648-170-0x0000000000930000-0x0000000000999000-memory.dmp
                Download

                memory/5648-242-0x0000000000400000-0x00000000004AE000-memory.dmp
                Download

                memory/5860-206-0x00000279E9100000-0x00000279E9166000-memory.dmp
                Download

                memory/5860-273-0x00007FF6EDBA0000-0x00007FF6EDC53000-memory.dmp
                Download

                memory/5860-204-0x00007FF6EDBA0000-0x00007FF6EDC53000-memory.dmp
                Download

                memory/5860-205-0x00000279E9100000-0x00000279E9166000-memory.dmp
                Download