Overview

overview

10

Static

static

10

2026-05-28...er.exe

windows10-2004-x64

6

2026-05-28...er.exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    28/05/2026, 02:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-28_3e997c4d48da98e5245531e0c2dee689_akira_cobalt-strike_glassworm_megazord_rusty-stealer.exe
  • Size 25.5MB
  • Sample260528-cva4esdx5l
  • SHA256 b8a6b0fbe9e3eb862ed2286a310faf663f24dc1429f732ea88fae8dc6c20997e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverytrojan

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Windows directory 59 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-28_3e997c4d48da98e5245531e0c2dee689_akira_cobalt-strike_glassworm_megazord_rusty-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-28_3e997c4d48da98e5245531e0c2dee689_akira_cobalt-strike_glassworm_megazord_rusty-stealer.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-05-28_3e997c4d48da98e5245531e0c2dee689_akira_cobalt-strike_glassworm_megazord_rusty-stealer.exe --webview-exe-version=3.0.73 --user-data-dir="C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2296.2684.15854581041672922936
      2⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:484
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffba6bfb078,0x7ffba6bfb084,0x7ffba6bfb090
        3⤵
          PID:2752
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView" --webview-exe-name=2026-05-28_3e997c4d48da98e5245531e0c2dee689_akira_cobalt-strike_glassworm_megazord_rusty-stealer.exe --webview-exe-version=3.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1700,i,3928951506946080106,13676281187761357228,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1624 /prefetch:2
          3⤵
            PID:4204
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView" --webview-exe-name=2026-05-28_3e997c4d48da98e5245531e0c2dee689_akira_cobalt-strike_glassworm_megazord_rusty-stealer.exe --webview-exe-version=3.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1996,i,3928951506946080106,13676281187761357228,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
            3⤵
              PID:5896
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView" --webview-exe-name=2026-05-28_3e997c4d48da98e5245531e0c2dee689_akira_cobalt-strike_glassworm_megazord_rusty-stealer.exe --webview-exe-version=3.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1704,i,3928951506946080106,13676281187761357228,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:13
              3⤵
                PID:5588
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView" --webview-exe-name=2026-05-28_3e997c4d48da98e5245531e0c2dee689_akira_cobalt-strike_glassworm_megazord_rusty-stealer.exe --webview-exe-version=3.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3552,i,3928951506946080106,13676281187761357228,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
                3⤵
                  PID:5428
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView" --webview-exe-name=2026-05-28_3e997c4d48da98e5245531e0c2dee689_akira_cobalt-strike_glassworm_megazord_rusty-stealer.exe --webview-exe-version=3.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2200,i,3928951506946080106,13676281187761357228,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
                  3⤵
                    PID:2144
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView" --webview-exe-name=2026-05-28_3e997c4d48da98e5245531e0c2dee689_akira_cobalt-strike_glassworm_megazord_rusty-stealer.exe --webview-exe-version=3.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4344,i,3928951506946080106,13676281187761357228,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:14
                    3⤵
                      PID:5056
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView" --webview-exe-name=2026-05-28_3e997c4d48da98e5245531e0c2dee689_akira_cobalt-strike_glassworm_megazord_rusty-stealer.exe --webview-exe-version=3.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4516,i,3928951506946080106,13676281187761357228,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:10
                      3⤵
                        PID:5372

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        crl-set
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
                        • Size 22KB
                        • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        settings.dat
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Crashpad\settings.dat
                        • Size 280B
                        • SHA256 25e69dc623ffa4e7ba5c5929e1a84610ed38f116f7a91455aacff8171f16c9fb
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        settings.dat
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Crashpad\settings.dat
                        • Size 280B
                        • SHA256 f85591f0beb146b859cbca15eb9766a4b21c0a389ca1bc2a34577fb5e99dc472
                        • MD5 SHA1 SHA512
                        Submit Download

                        throttle_store.dat
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Crashpad\throttle_store.dat
                        • Size 20B
                        • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                        • MD5 SHA1 SHA512
                        Submit Download

                        the-real-index
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                        • Size 48B
                        • SHA256 916cfaa29f037efc127dc28e70434fbf9016bffa2ca623e792f55eae828c4d07
                        • MD5 SHA1 SHA512
                        Submit Download

                        the-real-index
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                        • Size 72B
                        • SHA256 ebe4f9ee65ec9db168d82a0d3655986c9913a7b6bb2f4ac46945746c8409009b
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        index
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Default\DawnGraphiteCache\index
                        • Size 256KB
                        • SHA256 ff487b2eb20bb90c3378ca76060601e188000858165574892b047647873237e3
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        data_0
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Default\DawnWebGPUCache\data_0
                        • Size 8KB
                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        data_1
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Default\DawnWebGPUCache\data_1
                        • Size 264KB
                        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        data_2
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Default\DawnWebGPUCache\data_2
                        • Size 8KB
                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        data_3
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Default\DawnWebGPUCache\data_3
                        • Size 8KB
                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        MANIFEST-000001
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Default\Extension Rules\MANIFEST-000001
                        • Size 41B
                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                        • MD5 SHA1 SHA512
                        Submit Download

                        Network Persistent State
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Default\Network\Network Persistent State
                        • Size 575B
                        • SHA256 a54b3cbd7118b8c2569afe1a08e4d0da9c11b56f4e4aae1a754853e3cd499081
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        Network Persistent State~RFe596603.TMP
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Default\Network\Network Persistent State~RFe596603.TMP
                        • Size 59B
                        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        SCT Auditing Pending Reports
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Default\Network\SCT Auditing Pending Reports
                        • Size 2B
                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                        • MD5 SHA1 SHA512
                        Submit Download

                        Preferences
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Default\Preferences
                        • Size 6KB
                        • SHA256 51a6978e5759dd56f07d660a13516e1ef453c9dc1dea80fa888afe33b607cdc1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Preferences~RFe58ed0b.TMP
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Default\Preferences~RFe58ed0b.TMP
                        • Size 6KB
                        • SHA256 7a8d23737ea20fb8c751027f323b9e082e1c53f757f9594c521c6a77633f1cce
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CURRENT
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Default\Site Characteristics Database\CURRENT
                        • Size 16B
                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                        • MD5 SHA1 SHA512
                        Submit Download

                        Local State
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Local State
                        • Size 1KB
                        • SHA256 0ba01012af9fb9b1195aae85400c6e93cf60f864f3cf762df3e94747791fc378
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        Local State
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Local State
                        • Size 2KB
                        • SHA256 e24172dc1280a3bb56efe7e84de14353cab7cb67dd6fa917010ba0e8661cf95d
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        Local State
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Local State
                        • Size 3KB
                        • SHA256 435f7ce0b510b628988799f5d5571baa46d274ec162dadb9b66e2a28c1b7d673
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        Local State
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Local State
                        • Size 16KB
                        • SHA256 20ba010b317e3148fd0c4b21202a29a2f0ab6ee62f84e81df2d31f5929cb74e6
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Local State~RFe584e88.TMP
                        • Path C:\Users\Admin\AppData\Local\com.nemesis.app\EBWebView\Local State~RFe584e88.TMP
                        • Size 1KB
                        • SHA256 8501d43fe15770a391fc499d1c09ef64201a7a88f6ec017e8d987d09a0bc042b
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        manifest.json
                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1978580620\manifest.json
                        • Size 113B
                        • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        hyph-af.hyb
                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_431881928\hyph-af.hyb
                        • Size 70KB
                        • SHA256 5487ee44a4cd706d0086522e90c59c76cdf2ac68ce506fd3eae6054b9220c0cf
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        hyph-as.hyb
                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_431881928\hyph-as.hyb
                        • Size 703B
                        • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        hyph-hi.hyb
                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_431881928\hyph-hi.hyb
                        • Size 687B
                        • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        hyph-nb.hyb
                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_431881928\hyph-nb.hyb
                        • Size 141KB
                        • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        manifest.json
                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_431881928\manifest.json
                        • Size 82B
                        • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        memory/484-206-0x000001B19F0E0000-0x000001B1A00E0000-memory.dmp
                        Download

                        memory/4204-239-0x0000023173940000-0x00000231739E3000-memory.dmp
                        Download

                        memory/4204-219-0x0000023173940000-0x00000231739E3000-memory.dmp
                        Download

                        memory/4204-27-0x00007FFBC6F90000-0x00007FFBC6F91000-memory.dmp
                        Download

                        memory/4204-532-0x0000023173940000-0x00000231739E3000-memory.dmp
                        Download

                        memory/5372-563-0x00000195825C0000-0x00000195825C1000-memory.dmp
                        Download

                        memory/5372-574-0x00000195825C0000-0x00000195825C1000-memory.dmp
                        Download

                        memory/5372-568-0x00000195825C0000-0x00000195825C1000-memory.dmp
                        Download

                        memory/5372-569-0x00000195825C0000-0x00000195825C1000-memory.dmp
                        Download

                        memory/5372-564-0x00000195825C0000-0x00000195825C1000-memory.dmp
                        Download

                        memory/5372-570-0x00000195825C0000-0x00000195825C1000-memory.dmp
                        Download

                        memory/5372-562-0x00000195825C0000-0x00000195825C1000-memory.dmp
                        Download

                        memory/5372-571-0x00000195825C0000-0x00000195825C1000-memory.dmp
                        Download

                        memory/5372-573-0x00000195825C0000-0x00000195825C1000-memory.dmp
                        Download

                        memory/5372-572-0x00000195825C0000-0x00000195825C1000-memory.dmp
                        Download

                        memory/5428-224-0x000001F21A740000-0x000001F21A7E3000-memory.dmp
                        Download

                        memory/5428-284-0x000001F21A740000-0x000001F21A7E3000-memory.dmp
                        Download

                        memory/5428-240-0x000001F21A740000-0x000001F21A7E3000-memory.dmp
                        Download

                        memory/5428-142-0x00007FFBC6F90000-0x00007FFBC6F91000-memory.dmp
                        Download