Overview

overview

10

Static

static

10

2026-08-04...op.exe

windows10-2004-x64

9

2026-08-04...op.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 05:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_e300132f662b0ec7856eb61031281b18_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
  • Size 5.6MB
  • Sample260804-fr1rfswtfw
  • SHA256 768607aa306240b631393d33e775585431ee5eab952bfb2bbd4d3520fac6c756
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryspywarestealer

Malware Config

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_e300132f662b0ec7856eb61031281b18_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_e300132f662b0ec7856eb61031281b18_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of WriteProcessMemory
    PID:600
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/2ao8lisw.Admin\logins.json\" \"C:\Users\Admin\AppData\Local\Temp\0j9gm0kda240768265.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/2ao8lisw.Admin\key3.db\" \"C:\Users\Admin\AppData\Local\Temp\jt0ycpu3j8dgwxc240768265.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/2ao8lisw.Admin\key4.db\" \"C:\Users\Admin\AppData\Local\Temp\yhb1zypq240768265.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/2ao8lisw.Admin\cert9.db\" \"C:\Users\Admin\AppData\Local\Temp\q9ydw6d8n9x3240768265.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/2ao8lisw.Admin\prefs.js\" \"C:\Users\Admin\AppData\Local\Temp\sa7ttvy7vqe2240768265.tmp\" -Force"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:256
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/2ao8lisw.Admin\formhistory.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\15xxpwcvfel240782531.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/2ao8lisw.Admin\cookies.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\xhli7u0sfamrvll240782531.tmp\" -Force"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5588
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/6uwf3l8l.default-release\logins.json\" \"C:\Users\Admin\AppData\Local\Temp\im6b78bnzzp240790812.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/6uwf3l8l.default-release\key3.db\" \"C:\Users\Admin\AppData\Local\Temp\z62oxuit7240790812.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/6uwf3l8l.default-release\key4.db\" \"C:\Users\Admin\AppData\Local\Temp\3yzjpj7p3240790812.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/6uwf3l8l.default-release\cert9.db\" \"C:\Users\Admin\AppData\Local\Temp\5lm03rbza240790812.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/6uwf3l8l.default-release\prefs.js\" \"C:\Users\Admin\AppData\Local\Temp\j66udzie240790812.tmp\" -Force"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:784
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/6uwf3l8l.default-release\formhistory.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\d4r71fn0ig4oy240796687.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/6uwf3l8l.default-release\cookies.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\5a8f1o66qwc240796687.tmp\" -Force"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4408
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/2ao8lisw.Admin\logins.json\" \"C:\Users\Admin\AppData\Local\Temp\f1gjc8ya6yqlm240801734.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/2ao8lisw.Admin\key3.db\" \"C:\Users\Admin\AppData\Local\Temp\m9nfw56q240801734.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/2ao8lisw.Admin\key4.db\" \"C:\Users\Admin\AppData\Local\Temp\e5noq3k2cd3v8q7240801734.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/2ao8lisw.Admin\cert9.db\" \"C:\Users\Admin\AppData\Local\Temp\odxphoi3eu240801734.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/2ao8lisw.Admin\prefs.js\" \"C:\Users\Admin\AppData\Local\Temp\hs9co3uyy240801734.tmp\" -Force"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2248
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/2ao8lisw.Admin\formhistory.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\mznfguttfe240820750.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/2ao8lisw.Admin\cookies.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\okwzwz368845240820750.tmp\" -Force"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2064
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/6uwf3l8l.default-release\logins.json\" \"C:\Users\Admin\AppData\Local\Temp\o4ttlzie5ips3240842125.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/6uwf3l8l.default-release\key3.db\" \"C:\Users\Admin\AppData\Local\Temp\z6m7ofus5r240842125.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/6uwf3l8l.default-release\key4.db\" \"C:\Users\Admin\AppData\Local\Temp\1s8afbld240842125.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/6uwf3l8l.default-release\cert9.db\" \"C:\Users\Admin\AppData\Local\Temp\4b851xaz1qrd3dd240842125.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/6uwf3l8l.default-release\prefs.js\" \"C:\Users\Admin\AppData\Local\Temp\nn39jky2uro240842125.tmp\" -Force"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5552
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/6uwf3l8l.default-release\formhistory.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\ovwjwzjfj4u240847593.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/6uwf3l8l.default-release\cookies.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\cknj3evl81240847593.tmp\" -Force"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1688
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Local\Google\Chrome\user Data\Default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\07e0kcebveoy5f240854156.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\Google\Chrome\user Data\Default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\t5m8fwoijep5240854156.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\Google\Chrome\user Data\Default\Network\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\hcm82ryhk97240854250.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\Google\Chrome\user Data\Default\..\Local State\" \"C:\Users\Admin\AppData\Local\Temp\90pdp6bkxz240854250.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\Google\Chrome\user Data\Default\Preferences\" \"C:\Users\Admin\AppData\Local\Temp\qr0yqc0ld7e240854531.tmp\" -Force"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2368
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Local\Microsoft\edge\user Data\Default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\wjl8tc1hs240866390.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\Microsoft\edge\user Data\Default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\zebfyav5kwcr240866390.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\Microsoft\edge\user Data\Default\Network\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\tsp9pxgnp7jcmv2b240866453.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\Microsoft\edge\user Data\Default\..\Local State\" \"C:\Users\Admin\AppData\Local\Temp\63nqkdnsm240866453.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\Microsoft\edge\user Data\Default\Preferences\" \"C:\Users\Admin\AppData\Local\Temp\i6d5v5d09hxv240866656.tmp\" -Force"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4692

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 1644a8734b1a870853c20608b2c652c71a46e3cce6318ad116a4f9159a76d282
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 60292489db6d4ba2a3e4448639fbe7fa2261be477f63ef09bca0b55e520a4777
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 6dee3f4a4ac1034163e509db3b4e97e7e671e18ad6798571fbb620ecd01af27d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 8f923917be4be4ccffe35cf4269526e80b8f4d4aa8f40327220fa5a2d06fd84d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 6f421d1c1278268b8a05b3881bd397c273416db32231a55b14a76afceb7345e1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 aef8b020212d19e8c6e52e5f91f96126439e9399bc7e0a9ef369ab991df7b2fa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_fxtlzj4c.qqn.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fxtlzj4c.qqn.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        i9g7avree2p1y5wsp5owf5y.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\i9g7avree2p1y5wsp5owf5y.tmp
        • Size 114KB
        • SHA256 12a298e523084cb8a617383c7e527bf1e1256b0f1fc9ea02fa88895cbf1d5596
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        590aee7bdd69b59b.customDestinations-ms
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        • Size 6KB
        • SHA256 bd897d21b1efff851a98795d66b02a082b44057dc887be993b8ddcfe475f0b74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        590aee7bdd69b59b.customDestinations-ms
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        • Size 6KB
        • SHA256 8d8dd2e870e38f3e09762035e4bf227a905c12f32dda741708f0d075660c825b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        590aee7bdd69b59b.customDestinations-ms
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        • Size 6KB
        • SHA256 9228691988b55e7400d9a1ddfa59bf5c381e670b87b4379861b76005fafa96d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        590aee7bdd69b59b.customDestinations-ms
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        • Size 6KB
        • SHA256 abacc6b7f183e2b3e19bdfc97a0259c34dc9803adc706d5be1d5a37ef1e6c9e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        590aee7bdd69b59b.customDestinations-ms
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        • Size 6KB
        • SHA256 4c5771a8ee09a1850acd8d743965ba97393f95a2c770d079ecd0884c942270da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        590aee7bdd69b59b.customDestinations-ms
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        • Size 6KB
        • SHA256 9fa9ee5507f4964886175e7f65148954c1e9d190864d63a5aad7f42c2eec44fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        590aee7bdd69b59b.customDestinations-ms
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        • Size 6KB
        • SHA256 d99fd2d53696c615006e96fc64b6ea13d2791ce268d5635ea931619ea5e34540
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        590aee7bdd69b59b.customDestinations-ms
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        • Size 6KB
        • SHA256 1eab2c0b5a9b8b7f86f1fac5fd2b0cb77876092a670b0ed3db7b1016f683d6f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        590aee7bdd69b59b.customDestinations-ms
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        • Size 6KB
        • SHA256 aeead7a4d66639f9576f8d7812036870c46580f2664964ddd3bf39008358fc73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        590aee7bdd69b59b.customDestinations-ms
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        • Size 6KB
        • SHA256 24472e9c0a76f47b5a63ca36a1d31e3aee1461977028856cfbdb9832f11a56fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/256-21-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
        Download

        memory/256-28-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
        Download

        memory/256-26-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
        Download

        memory/256-23-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
        Download

        memory/256-22-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
        Download

        memory/256-25-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
        Download

        memory/256-24-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
        Download

        memory/256-20-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
        Download

        memory/256-19-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
        Download

        memory/256-18-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
        Download

        memory/256-17-0x000001ED7BC20000-0x000001ED7BC42000-memory.dmp
        Download

        memory/256-14-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
        Download

        memory/256-13-0x00007FFC8914F000-0x00007FFC89150000-memory.dmp
        Download

        memory/600-41-0x0000000000400000-0x00000000009AA000-memory.dmp
        Download

        memory/600-65-0x0000000000400000-0x00000000009AA000-memory.dmp
        Download

        memory/600-78-0x0000000000400000-0x00000000009AA000-memory.dmp
        Download

        memory/600-79-0x0000000000400000-0x00000000009AA000-memory.dmp
        Download

        memory/600-0-0x00000000007AC000-0x00000000007AD000-memory.dmp
        Download

        memory/600-7-0x0000000003CA0000-0x0000000003D47000-memory.dmp
        Download

        memory/600-90-0x0000000000400000-0x00000000009AA000-memory.dmp
        Download

        memory/600-91-0x0000000000400000-0x00000000009AA000-memory.dmp
        Download

        memory/600-8-0x0000000000400000-0x00000000009AA000-memory.dmp
        Download

        memory/600-10-0x0000000000400000-0x00000000009AA000-memory.dmp
        Download

        memory/600-114-0x0000000000400000-0x00000000009AA000-memory.dmp
        Download

        memory/600-30-0x0000000000400000-0x00000000009AA000-memory.dmp
        Download

        memory/600-6-0x0000000000400000-0x00000000009AA000-memory.dmp
        Download

        memory/600-128-0x0000000000400000-0x00000000009AA000-memory.dmp
        Download

        memory/600-29-0x0000000000400000-0x00000000009AA000-memory.dmp
        Download

        memory/600-5-0x0000000011000000-0x0000000011158000-memory.dmp
        Download

        memory/600-143-0x0000000000400000-0x00000000009AA000-memory.dmp
        Download

        memory/600-149-0x0000000000400000-0x00000000009AA000-memory.dmp
        Download

        memory/600-152-0x0000000000400000-0x00000000009AA000-memory.dmp
        Download

        memory/600-153-0x0000000000400000-0x00000000009AA000-memory.dmp
        Download