Overview

overview

10

Static

static

10

2026-08-05...at.exe

windows10-2004-x64

7

2026-08-05...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 18:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-05_56005270408300dc74d52b69f7c2e6cc_coinminer_emotet_helldown_icedid_mespinoza_njrat.exe
  • Size 8.3MB
  • Sample260805-w7cbssdr5v
  • SHA256 42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 8 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_56005270408300dc74d52b69f7c2e6cc_coinminer_emotet_helldown_icedid_mespinoza_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_56005270408300dc74d52b69f7c2e6cc_coinminer_emotet_helldown_icedid_mespinoza_njrat.exe"
    1⤵
    • Adds Run key to start application
    • Checks for any installed AV software in registry
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:400
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:712
  • C:\Windows\System32\GameInputSvc.exe
    C:\Windows\System32\GameInputSvc.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5392
    • C:\Windows\System32\GameInputSvc.exe
      "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:2344
  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_56005270408300dc74d52b69f7c2e6cc_coinminer_emotet_helldown_icedid_mespinoza_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_56005270408300dc74d52b69f7c2e6cc_coinminer_emotet_helldown_icedid_mespinoza_njrat.exe" /Startup
    1⤵
      PID:7000
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4968
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4180
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:2744
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:2396
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4440
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:3604
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4740
    • C:\Windows\System32\ReFsDedupSvc.exe
      C:\Windows\System32\ReFsDedupSvc.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:6832
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:5228
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      PID:1052
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:6612
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:6080
    • C:\Windows\system32\TieringEngineService.exe
      C:\Windows\system32\TieringEngineService.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3636
    • C:\Windows\system32\AgentService.exe
      C:\Windows\system32\AgentService.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3740
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Executes dropped EXE
      PID:5172
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4236
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4464
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
      • Executes dropped EXE
      PID:2692
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5216
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:5996
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
        2⤵
          PID:6776
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 952 2916 2920 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
          2⤵
            PID:2948
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 952 2904 2944 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
            2⤵
            • Modifies data under HKEY_USERS
            PID:6336
          • C:\Windows\System32\SearchProtocolHost.exe
            "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:6164
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 952 2916 2920 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
            2⤵
              PID:5488
            • C:\Windows\System32\SearchFilterHost.exe
              "C:\Windows\System32\SearchFilterHost.exe" 952 2904 2944 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
              2⤵
                PID:3448

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Defense Evasion

                  Modify Registry

                  1
                  T1112

                  Credential Access

                  Credentials from Password Stores

                  1
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Unsecured Credentials

                  2
                  T1552

                  Credentials In Files

                  2
                  T1552.001

                  Discovery

                  Peripheral Device Discovery

                  2
                  T1120

                  Query Registry

                  4
                  T1012

                  Software Discovery

                  1
                  T1518

                  Security Software Discovery

                  1
                  T1518.001

                  System Information Discovery

                  4
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  Lateral Movement

                  Collection

                  Data from Local System

                  2
                  T1005

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  elevation_service.exe
                  • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                  • Size 2.7MB
                  • SHA256 4d10fa6f1fc392c23b337c4577e1755607ecac721aac39c2c62089f8e23300df
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  maintenanceservice.exe
                  • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                  • Size 849KB
                  • SHA256 dc922fccf1e82279ea17a0b6cb9f06f22ea780cde9496988bc35ede6a31fd52a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  OSE.EXE
                  • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                  • Size 829KB
                  • SHA256 fd423c7a72e869a85aee51a261a8ec2243edb78c75e5b7ab09cae4e1d973057b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevation_service.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                  • Size 2.8MB
                  • SHA256 3e88cfe8a4fe76bac223b894ba4cc602e386ed1a854c45c422a87dc4948b1f59
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfhost.exe
                  • Path C:\Windows\SysWOW64\perfhost.exe
                  • Size 610KB
                  • SHA256 186edb00019ad57d8f1881944ecb02a2e439bed1d9ef40b9f6e0db7d6b6c2c0f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AgentService.exe
                  • Path C:\Windows\System32\AgentService.exe
                  • Size 1.4MB
                  • SHA256 8d0567d56aba353026de1a50b7dc681a5b192787b2d1bd96479586b583d5f7ac
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  GameInputSvc.exe
                  • Path C:\Windows\System32\GameInputSvc.exe
                  • Size 664KB
                  • SHA256 821e39d2ba3b80f979639309d187be445e933499b79657b4ad4fe20474e585b2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Locator.exe
                  • Path C:\Windows\System32\Locator.exe
                  • Size 628KB
                  • SHA256 4397e1c9998f535774d0bc78d2141a30a24a830d02ab71c9e0e99d6f9b4dce5e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ssh-agent.exe
                  • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                  • Size 1.1MB
                  • SHA256 033211f78d7fd340068d283ccb54951dabf42149b1a5f879aa7da8174cd5c200
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  PerceptionSimulationService.exe
                  • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                  • Size 832KB
                  • SHA256 b8d0ce43a1428f43d1eb1bd89e24da50e9a6ba767f57eb15038a93915064c71c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ReFsDedupSvc.exe
                  • Path C:\Windows\System32\ReFsDedupSvc.exe
                  • Size 2.7MB
                  • SHA256 d40373c1c520eed67be1d0f3d3b2223b434d374730280cba13ec31d3ef4f2a0a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SearchIndexer.exe
                  • Path C:\Windows\System32\SearchIndexer.exe
                  • Size 1.5MB
                  • SHA256 03543b04b470da4700a33d27d018768396e5af92d94306051e4d0c0b994edaaa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SensorDataService.exe
                  • Path C:\Windows\System32\SensorDataService.exe
                  • Size 1.7MB
                  • SHA256 34c547c0da63dcd776bb1cbfaf4c4242cbb2c6ae6db2977131cfa8b24603582b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  TieringEngineService.exe
                  • Path C:\Windows\System32\TieringEngineService.exe
                  • Size 936KB
                  • SHA256 fb388638f5bab58bc587b27661fa7383045d8d1679fdeffeeb375d24fd3c5cd4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VSSVC.exe
                  • Path C:\Windows\System32\VSSVC.exe
                  • Size 2.0MB
                  • SHA256 9c5c604f2c1bc69137128f85bb34f11145f97339b5ced6875e160cf5bc686775
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  alg.exe
                  • Path C:\Windows\System32\alg.exe
                  • Size 780KB
                  • SHA256 edaad828bb61b6413370f586a1796ee43345384c7acc4c1f3aa7bf1481099b2a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msdtc.exe
                  • Path C:\Windows\System32\msdtc.exe
                  • Size 764KB
                  • SHA256 c38b18e9953d972e65b5820f707e8b8a3d9fc507723cf7656d292651b630b50d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  snmptrap.exe
                  • Path C:\Windows\System32\snmptrap.exe
                  • Size 636KB
                  • SHA256 e7ea7a4dcc743be027ffb0bc7b0e8c1c21f69674aefb74b6044aea9e3444ceaa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vds.exe
                  • Path C:\Windows\System32\vds.exe
                  • Size 1.2MB
                  • SHA256 1ec36be6b96a1a71cebac2aa67d0da6e59dd28c9040caa06a38bdaf3ad4c337a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  WmiApSrv.exe
                  • Path C:\Windows\System32\wbem\WmiApSrv.exe
                  • Size 796KB
                  • SHA256 4640c1d9ae5a63ca3be35b496a28deb7faf3cf69b044d24f50beed07c3ac857f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  wbengine.exe
                  • Path C:\Windows\System32\wbengine.exe
                  • Size 2.1MB
                  • SHA256 c196bcb2f9a0cb617713210a58d0c4b144bcff4a8dcf4f9df558a089cad05da0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/400-53-0x000000000B080000-0x000000000B0A4000-memory.dmp
                  Download

                  memory/400-1-0x0000000009FC0000-0x000000000A026000-memory.dmp
                  Download

                  memory/400-7-0x0000000009FC0000-0x000000000A026000-memory.dmp
                  Download

                  memory/400-8-0x0000000009FC0000-0x000000000A026000-memory.dmp
                  Download

                  memory/400-0-0x0000000009E10000-0x0000000009EEB000-memory.dmp
                  Download

                  memory/712-16-0x00007FF61EE70000-0x00007FF61EF93000-memory.dmp
                  Download

                  memory/712-78-0x00007FF61EE70000-0x00007FF61EF93000-memory.dmp
                  Download

                  memory/712-17-0x000002401A570000-0x000002401A5D6000-memory.dmp
                  Download

                  memory/712-19-0x000002401A570000-0x000002401A5D6000-memory.dmp
                  Download

                  memory/712-18-0x000002401A570000-0x000002401A5D6000-memory.dmp
                  Download

                  memory/1052-265-0x00000277ACBC0000-0x00000277ACC26000-memory.dmp
                  Download

                  memory/1052-161-0x00007FF757E20000-0x00007FF758237000-memory.dmp
                  Download

                  memory/1052-234-0x00007FF757E20000-0x00007FF758237000-memory.dmp
                  Download

                  memory/1052-268-0x00007FF757E20000-0x00007FF758237000-memory.dmp
                  Download

                  memory/1052-162-0x00000277ACBC0000-0x00000277ACC26000-memory.dmp
                  Download

                  memory/1052-163-0x00000277ACBC0000-0x00000277ACC26000-memory.dmp
                  Download

                  memory/2344-37-0x00000196F2C50000-0x00000196F2CB6000-memory.dmp
                  Download

                  memory/2344-38-0x00000196F2C50000-0x00000196F2CB6000-memory.dmp
                  Download

                  memory/2344-36-0x00007FF671F50000-0x00007FF672019000-memory.dmp
                  Download

                  memory/2344-122-0x00007FF671F50000-0x00007FF672019000-memory.dmp
                  Download

                  memory/2396-102-0x00007FF71FAB0000-0x00007FF71FBCA000-memory.dmp
                  Download

                  memory/2396-103-0x0000022379B60000-0x0000022379BC6000-memory.dmp
                  Download

                  memory/2396-104-0x0000022379B60000-0x0000022379BC6000-memory.dmp
                  Download

                  memory/2396-188-0x00007FF71FAB0000-0x00007FF71FBCA000-memory.dmp
                  Download

                  memory/2692-241-0x000001B2FB6B0000-0x000001B2FB716000-memory.dmp
                  Download

                  memory/2692-240-0x000001B2FB6B0000-0x000001B2FB716000-memory.dmp
                  Download

                  memory/2692-239-0x00007FF73DE70000-0x00007FF73DF9F000-memory.dmp
                  Download

                  memory/2692-276-0x00007FF73DE70000-0x00007FF73DF9F000-memory.dmp
                  Download

                  memory/2744-90-0x00007FF6E0CF0000-0x00007FF6E0E58000-memory.dmp
                  Download

                  memory/2744-100-0x00007FF6E0CF0000-0x00007FF6E0E58000-memory.dmp
                  Download

                  memory/2744-91-0x00000179F2340000-0x00000179F23A6000-memory.dmp
                  Download

                  memory/2744-92-0x00000179F2340000-0x00000179F23A6000-memory.dmp
                  Download

                  memory/2744-97-0x00000179F2340000-0x00000179F23A6000-memory.dmp
                  Download

                  memory/3604-197-0x00007FF7A6AC0000-0x00007FF7A6C0A000-memory.dmp
                  Download

                  memory/3604-125-0x0000016A4B430000-0x0000016A4B496000-memory.dmp
                  Download

                  memory/3604-123-0x00007FF7A6AC0000-0x00007FF7A6C0A000-memory.dmp
                  Download

                  memory/3604-126-0x0000016A4B430000-0x0000016A4B496000-memory.dmp
                  Download

                  memory/3636-249-0x00007FF602F40000-0x00007FF6030D5000-memory.dmp
                  Download

                  memory/3636-191-0x000001EDBF920000-0x000001EDBF986000-memory.dmp
                  Download

                  memory/3636-190-0x000001EDBF920000-0x000001EDBF986000-memory.dmp
                  Download

                  memory/3636-189-0x00007FF602F40000-0x00007FF6030D5000-memory.dmp
                  Download

                  memory/3740-198-0x00007FF683D60000-0x00007FF684081000-memory.dmp
                  Download

                  memory/3740-206-0x00007FF683D60000-0x00007FF684081000-memory.dmp
                  Download

                  memory/3740-199-0x0000024DFB8B0000-0x0000024DFB916000-memory.dmp
                  Download

                  memory/3740-200-0x0000024DFB8B0000-0x0000024DFB916000-memory.dmp
                  Download

                  memory/3740-204-0x0000024DFB8B0000-0x0000024DFB916000-memory.dmp
                  Download

                  memory/4180-81-0x000001ED25180000-0x000001ED2528E000-memory.dmp
                  Download

                  memory/4180-83-0x000001ED253B0000-0x000001ED25416000-memory.dmp
                  Download

                  memory/4180-82-0x000001ED253B0000-0x000001ED25416000-memory.dmp
                  Download

                  memory/4236-221-0x00007FF79EC80000-0x00007FF79F151000-memory.dmp
                  Download

                  memory/4236-218-0x00000164BDBB0000-0x00000164BDC16000-memory.dmp
                  Download

                  memory/4236-272-0x00007FF79EC80000-0x00007FF79F151000-memory.dmp
                  Download

                  memory/4236-220-0x00000164BDBB0000-0x00000164BDC16000-memory.dmp
                  Download

                  memory/4440-114-0x000001A700E90000-0x000001A700F9E000-memory.dmp
                  Download

                  memory/4440-115-0x000001A701070000-0x000001A7010D6000-memory.dmp
                  Download

                  memory/4440-116-0x000001A701070000-0x000001A7010D6000-memory.dmp
                  Download

                  memory/4464-228-0x000002083D8F0000-0x000002083D956000-memory.dmp
                  Download

                  memory/4464-275-0x00007FF63F4F0000-0x00007FF63F9F7000-memory.dmp
                  Download

                  memory/4464-229-0x00007FF63F4F0000-0x00007FF63F9F7000-memory.dmp
                  Download

                  memory/4464-230-0x000002083D8F0000-0x000002083D956000-memory.dmp
                  Download

                  memory/4740-138-0x0000000000840000-0x00000000008A9000-memory.dmp
                  Download

                  memory/4740-133-0x0000000000840000-0x00000000008A9000-memory.dmp
                  Download

                  memory/4740-209-0x0000000000400000-0x00000000004AE000-memory.dmp
                  Download

                  memory/4740-132-0x0000000000400000-0x00000000004AE000-memory.dmp
                  Download

                  memory/4968-64-0x000001DEB61A0000-0x000001DEB6206000-memory.dmp
                  Download

                  memory/4968-62-0x000001DEB5FC0000-0x000001DEB60CE000-memory.dmp
                  Download

                  memory/4968-63-0x000001DEB61A0000-0x000001DEB6206000-memory.dmp
                  Download

                  memory/5172-211-0x00000219E5C80000-0x00000219E5CE6000-memory.dmp
                  Download

                  memory/5172-212-0x00000219E5C80000-0x00000219E5CE6000-memory.dmp
                  Download

                  memory/5172-210-0x00007FF6BEA10000-0x00007FF6BEC9B000-memory.dmp
                  Download

                  memory/5172-269-0x00007FF6BEA10000-0x00007FF6BEC9B000-memory.dmp
                  Download

                  memory/5216-252-0x000002F041710000-0x000002F041776000-memory.dmp
                  Download

                  memory/5216-277-0x00007FF7E0D10000-0x00007FF7E104F000-memory.dmp
                  Download

                  memory/5216-251-0x00007FF7E0D10000-0x00007FF7E104F000-memory.dmp
                  Download

                  memory/5216-250-0x000002F041710000-0x000002F041776000-memory.dmp
                  Download

                  memory/5228-225-0x00007FF635F20000-0x00007FF635FCE000-memory.dmp
                  Download

                  memory/5228-152-0x00007FF635F20000-0x00007FF635FCE000-memory.dmp
                  Download

                  memory/5228-154-0x00000222DFB80000-0x00000222DFBE6000-memory.dmp
                  Download

                  memory/5228-153-0x00000222DFB80000-0x00000222DFBE6000-memory.dmp
                  Download

                  memory/5392-28-0x0000012649300000-0x0000012649366000-memory.dmp
                  Download

                  memory/5392-30-0x0000012649300000-0x0000012649366000-memory.dmp
                  Download

                  memory/5392-29-0x0000012649300000-0x0000012649366000-memory.dmp
                  Download

                  memory/5392-89-0x00007FF671F50000-0x00007FF672019000-memory.dmp
                  Download

                  memory/5392-27-0x00007FF671F50000-0x00007FF672019000-memory.dmp
                  Download

                  memory/6080-180-0x00007FF7B4F40000-0x00007FF7B51E3000-memory.dmp
                  Download

                  memory/6080-182-0x000001C750B40000-0x000001C750BA6000-memory.dmp
                  Download

                  memory/6080-181-0x000001C750B40000-0x000001C750BA6000-memory.dmp
                  Download

                  memory/6080-246-0x00007FF7B4F40000-0x00007FF7B51E3000-memory.dmp
                  Download

                  memory/6336-448-0x000001B8D94F0000-0x000001B8D977B000-memory.dmp
                  Download

                  memory/6612-172-0x0000027D216C0000-0x0000027D21726000-memory.dmp
                  Download

                  memory/6612-238-0x00007FF6D0530000-0x00007FF6D05E4000-memory.dmp
                  Download

                  memory/6612-173-0x0000027D216C0000-0x0000027D21726000-memory.dmp
                  Download

                  memory/6612-171-0x00007FF6D0530000-0x00007FF6D05E4000-memory.dmp
                  Download

                  memory/6832-219-0x00007FF7DA790000-0x00007FF7DAED4000-memory.dmp
                  Download

                  memory/6832-146-0x0000021D23030000-0x0000021D23096000-memory.dmp
                  Download

                  memory/6832-144-0x00007FF7DA790000-0x00007FF7DAED4000-memory.dmp
                  Download

                  memory/6832-284-0x0000021D23030000-0x0000021D23096000-memory.dmp
                  Download

                  memory/6832-286-0x00007FF7DA790000-0x00007FF7DAED4000-memory.dmp
                  Download

                  memory/6832-145-0x0000021D23030000-0x0000021D23096000-memory.dmp
                  Download

                  memory/7000-43-0x0000000008040000-0x00000000080A6000-memory.dmp
                  Download

                  memory/7000-49-0x0000000008040000-0x00000000080A6000-memory.dmp
                  Download

                  memory/7000-75-0x0000000008040000-0x00000000080A6000-memory.dmp
                  Download