Overview

overview

8

Static

static

3

582d90287d...b1.exe

windows10-2004-x64

8

582d90287d...b1.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 23:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    582d90287db6ab528ac342c7e3d77f5272132c28f62b248d4d0c6f85421fa8b1.exe
  • Size 8.4MB
  • Sample260910-3zf4caaj2y
  • SHA256 582d90287db6ab528ac342c7e3d77f5272132c28f62b248d4d0c6f85421fa8b1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 6 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Discovers running processes 1 TTPs 4 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 7 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Gathers network information 2 TTPs 10 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry class 6 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 44 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\582d90287db6ab528ac342c7e3d77f5272132c28f62b248d4d0c6f85421fa8b1.exe
    "C:\Users\Admin\AppData\Local\Temp\582d90287db6ab528ac342c7e3d77f5272132c28f62b248d4d0c6f85421fa8b1.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5492
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { $exclusions = (Get-MpPreference).ExclusionPath; if ($exclusions -notcontains ''C:\Users\Admin\AppData\Local\Temp'') { Add-MpPreference -ExclusionPath ''C:\Users\Admin\AppData\Local\Temp'' -Force } } catch {} "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:204
    • C:\Users\Admin\AppData\Local\Temp\ki8Mz6669Dm94t_3949\kB2OR51Z.exe
      C:\Users\Admin\AppData\Local\Temp\ki8Mz6669Dm94t_3949\kB2OR51Z.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Local/Temp\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2540
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2404
      • C:\Windows\SYSTEM32\netstat.exe
        netstat -an
        3⤵
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:4912
      • C:\Windows\SYSTEM32\netsh.exe
        netsh interface show interface
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        PID:5916
      • C:\Windows\SYSTEM32\netstat.exe
        netstat -an
        3⤵
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:1840
      • C:\Windows\SYSTEM32\netstat.exe
        netstat -an
        3⤵
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:5816
      • C:\Windows\SYSTEM32\netstat.exe
        netstat -an
        3⤵
        • Gathers network information
        PID:4344
      • C:\Windows\SYSTEM32\netstat.exe
        netstat -an
        3⤵
        • Gathers network information
        PID:5992
      • C:\Windows\System32\Wbem\wmic.exe
        wmic path Win32_NetworkAdapter get Name,NetConnectionStatus,Speed,MACAddress /format:csv
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2484
      • C:\Windows\SYSTEM32\netsh.exe
        netsh interface ipv4 show interfaces
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        PID:5220
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Local/Temp/check_driver_712193.exe\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2308
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Local/Temp/check_driver_976008.exe\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1456
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH 2>NUL | findstr /I "msedge.exe" >NUL
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5280
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
          4⤵
          • Discovers running processes
          PID:3220
        • C:\Windows\system32\findstr.exe
          findstr /I "msedge.exe"
          4⤵
            PID:2964
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq chrome.exe" /FO CSV /NH 2>NUL | findstr /I "chrome.exe" >NUL
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2136
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq chrome.exe" /FO CSV /NH
            4⤵
            • Discovers running processes
            PID:5644
          • C:\Windows\system32\findstr.exe
            findstr /I "chrome.exe"
            4⤵
              PID:3084
          • C:\Users\Admin\AppData\Local\Temp\check_driver_976008.exe
            "C:\Users\Admin\AppData\Local\Temp\check_driver_976008.exe" --output-path "C:\Users\Admin\AppData\Local\Temp\\temp_Edge_240870921" edge
            3⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2540
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
              4⤵
                PID:2400
            • C:\Users\Admin\AppData\Local\Temp\check_driver_712193.exe
              "C:\Users\Admin\AppData\Local\Temp\check_driver_712193.exe" --output-path "C:\Users\Admin\AppData\Local\Temp\\temp_Chrome_240870921" chrome
              3⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1916
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                4⤵
                  PID:5900
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~228529.bat
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5540
              • C:\Windows\system32\PING.EXE
                ping 127.0.0.1 -n 3
                3⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:1112
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k GPSvcGroup
            1⤵
              PID:3396
            • C:\Users\Admin\AppData\Local\Temp\ki8Mz6669Dm94t_3949\kB2OR51Z.exe
              C:\Users\Admin\AppData\Local\Temp\ki8Mz6669Dm94t_3949\kB2OR51Z.exe
              1⤵
              • Creates a file in the Startup directory
              • Executes dropped EXE
              • Adds Run key to start application
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4676
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Local/Temp\""
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1684
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup\""
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:5784
              • C:\Windows\SYSTEM32\netstat.exe
                netstat -an
                2⤵
                • Gathers network information
                PID:2612
              • C:\Windows\SYSTEM32\netsh.exe
                netsh interface show interface
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                PID:4892
              • C:\Windows\SYSTEM32\netstat.exe
                netstat -an
                2⤵
                • Gathers network information
                PID:3368
              • C:\Windows\SYSTEM32\netstat.exe
                netstat -an
                2⤵
                • Gathers network information
                PID:1820
              • C:\Windows\SYSTEM32\netstat.exe
                netstat -an
                2⤵
                • Gathers network information
                PID:2660
              • C:\Windows\SYSTEM32\netstat.exe
                netstat -an
                2⤵
                • Gathers network information
                PID:260
              • C:\Windows\System32\Wbem\wmic.exe
                wmic path Win32_NetworkAdapter get Name,NetConnectionStatus,Speed,MACAddress /format:csv
                2⤵
                  PID:1112
                • C:\Windows\SYSTEM32\netsh.exe
                  netsh interface ipv4 show interfaces
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:3300
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Local/Temp/check_driver_686302.exe\""
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4492
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Local/Temp/check_driver_914832.exe\""
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2912
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq chrome.exe" /FO CSV /NH 2>NUL | findstr /I "chrome.exe" >NUL
                  2⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1080
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq chrome.exe" /FO CSV /NH
                    3⤵
                    • Discovers running processes
                    PID:4348
                  • C:\Windows\system32\findstr.exe
                    findstr /I "chrome.exe"
                    3⤵
                      PID:3332
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH 2>NUL | findstr /I "msedge.exe" >NUL
                    2⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:4804
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
                      3⤵
                      • Discovers running processes
                      PID:2672
                    • C:\Windows\system32\findstr.exe
                      findstr /I "msedge.exe"
                      3⤵
                        PID:5428
                    • C:\Users\Admin\AppData\Local\Temp\check_driver_914832.exe
                      "C:\Users\Admin\AppData\Local\Temp\check_driver_914832.exe" --output-path "C:\Users\Admin\AppData\Local\Temp\\temp_Edge_240832687" edge
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:5584
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                        3⤵
                          PID:3776
                      • C:\Users\Admin\AppData\Local\Temp\check_driver_686302.exe
                        "C:\Users\Admin\AppData\Local\Temp\check_driver_686302.exe" --output-path "C:\Users\Admin\AppData\Local\Temp\\temp_Chrome_240832687" chrome
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3104
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                          3⤵
                            PID:4748
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\AppData\Local\Temp\\temp_Edge_240832687" /S /B 2>NUL
                          2⤵
                          • Executes a command shell one-liner
                          PID:4460
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\AppData\Local\Temp\\temp_Chrome_240832687" /S /B 2>NUL
                          2⤵
                          • Executes a command shell one-liner
                          PID:1772
                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                        1⤵
                          PID:2172
                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                          1⤵
                            PID:1412

                          Network

                                MITRE ATT&CK Enterprise v16

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Command and Scripting Interpreter

                                3
                                T1059

                                PowerShell

                                1
                                T1059.001

                                Windows Command Shell

                                1
                                T1059.003

                                Persistence

                                Boot or Logon Autostart Execution

                                2
                                T1547

                                Registry Run Keys / Startup Folder

                                2
                                T1547.001

                                Event Triggered Execution

                                1
                                T1546

                                Netsh Helper DLL

                                1
                                T1546.007

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                2
                                T1547

                                Registry Run Keys / Startup Folder

                                2
                                T1547.001

                                Event Triggered Execution

                                1
                                T1546

                                Netsh Helper DLL

                                1
                                T1546.007

                                Defense Evasion

                                Modify Registry

                                1
                                T1112

                                Credential Access

                                Credentials from Password Stores

                                1
                                T1555

                                Credentials from Web Browsers

                                1
                                T1555.003

                                Unsecured Credentials

                                2
                                T1552

                                Credentials In Files

                                1
                                T1552.001

                                Credentials in Registry

                                1
                                T1552.002

                                Discovery

                                Process Discovery

                                1
                                T1057

                                Remote System Discovery

                                1
                                T1018

                                System Information Discovery

                                2
                                T1082

                                System Network Configuration Discovery

                                2
                                T1016

                                Internet Connection Discovery

                                2
                                T1016.001

                                Lateral Movement

                                Collection

                                Data from Local System

                                2
                                T1005

                                Command and Control

                                Web Service

                                1
                                T1102

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 97ba58fb672945fef373e8c7f4d701a85941bf54d4f1d9acba1aa92550bd75c5
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 948B
                                • SHA256 19522c7e140736208a28a9056be124d495ec75471725dc9d11fbffd9ba767070
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 99eab782b794f4230a47d98a0cd5d57e64213d4042dcb7f253052297e2b59e0a
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 8723dc2574dafbb2924f503a8ed17fc605cafc446e8722a7fee05a0dff22b862
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 31f54a84498a62f4280cdad450e7e459b75378c7e67bfcf3279f493410eef07a
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 4aec7053d11fefdf8f5929b1b9e0faf529d6f8b5e966056ae41870a7565eb4c5
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 58a501df1116d1fe605606f9c77a8e35adeb6d7c636902510b1550d663530369
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                __PSScriptPolicyTest_3ojzexst.22e.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ojzexst.22e.ps1
                                • Size 60B
                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                check_driver_914832.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\check_driver_914832.exe
                                • Size 1.9MB
                                • SHA256 c9b058c7d614f5ccde605e022c9417f2904659582507f69b30bad3abf2676a9c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                kB2OR51Z.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\ki8Mz6669Dm94t_3949\kB2OR51Z.exe
                                • Size 9.1MB
                                • SHA256 1a76dc127033ea7761391e6878d2eb791f1ed0dbf8e8b1ba5944d16be7ce36f2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ~228529.bat
                                • Path C:\Users\Admin\AppData\Local\Temp\~228529.bat
                                • Size 347B
                                • SHA256 3482e52fde62dbecdc9640ea166bcdaeb70a722b25a6321c951c8f0048b98540
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                memory/204-16-0x00007FFEC4CD0000-0x00007FFEC5674000-memory.dmp
                                Download

                                memory/204-17-0x00007FFEC4CD0000-0x00007FFEC5674000-memory.dmp
                                Download

                                memory/204-23-0x00007FFEC4CD0000-0x00007FFEC5674000-memory.dmp
                                Download

                                memory/204-12-0x00007FFEC4CD0000-0x00007FFEC5674000-memory.dmp
                                Download

                                memory/204-20-0x00007FFEC4CD0000-0x00007FFEC5674000-memory.dmp
                                Download

                                memory/204-19-0x00007FFEC4CD0000-0x00007FFEC5674000-memory.dmp
                                Download

                                memory/204-18-0x00007FFEC4CD0000-0x00007FFEC5674000-memory.dmp
                                Download

                                memory/204-11-0x00007FFEC4E5F000-0x00007FFEC4E60000-memory.dmp
                                Download

                                memory/204-15-0x0000019399410000-0x0000019399432000-memory.dmp
                                Download

                                memory/204-22-0x00007FFEC4CD0000-0x00007FFEC5674000-memory.dmp
                                Download

                                memory/2308-116-0x00000191D3550000-0x00000191D3602000-memory.dmp
                                Download

                                memory/2404-45-0x000001E4BBE60000-0x000001E4BBF12000-memory.dmp
                                Download

                                memory/2540-38-0x000001E4A4EE0000-0x000001E4A4EEA000-memory.dmp
                                Download

                                memory/2540-37-0x000001E4A4D20000-0x000001E4A4DD2000-memory.dmp
                                Download

                                memory/2540-36-0x000001E4A4D00000-0x000001E4A4D1E000-memory.dmp
                                Download

                                memory/5492-0-0x00007FF6F0D00000-0x00007FF6F1613000-memory.dmp
                                Download

                                memory/5492-9-0x00007FF6F0D00000-0x00007FF6F1613000-memory.dmp
                                Download

                                memory/5492-8-0x00007FF6F0D00000-0x00007FF6F1613000-memory.dmp
                                Download

                                memory/5492-6-0x00007FF6F0D00000-0x00007FF6F1613000-memory.dmp
                                Download

                                memory/5492-29-0x00007FF6F0D00000-0x00007FF6F1613000-memory.dmp
                                Download

                                memory/5492-7-0x00007FF6F0D00000-0x00007FF6F1613000-memory.dmp
                                Download