Overview

overview

10

Static

static

3

controller.exe

windows10-2004-x64

10

controller.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/09/2026, 13:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    controller.exe
  • Size 31.3MB
  • Sample260914-qrfrdsdk6z
  • SHA256 a289e1661fee6dd7acc4b0876df7dce1b4dd997c5eecda7eabc537f5f9ada024
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionpersistencespywarestealerthemidatrojan

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 4 IoCs
  • Checks BIOS information in registry 2 TTPs 26 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 13 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Themida packer 52 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks whether UAC is enabled 1 TTPs 13 IoCs
    defense_evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:4624
      • C:\Users\Admin\AppData\Local\Temp\controller.exe
        "C:\Users\Admin\AppData\Local\Temp\controller.exe"
        2⤵
        • Downloads MZ/PE file
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4928
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -Milliseconds 2500"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4420
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$g=@((Get-CimInstance Win32_VideoController -EA SilentlyContinue|Select-Object -ExpandProperty Name));$d=[int64]((Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\" -EA SilentlyContinue).Size);$pr=@(Get-Process -EA SilentlyContinue);$w=[bool]($pr|Where-Object {$_.ProcessName -eq 'CExecSvc'});@{g=($g -join '|');d=$d;p=$pr.Count;w=$w;n=(($pr|Select-Object -ExpandProperty ProcessName)-join '|')}|ConvertTo-Json -Compress"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4372
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "net session"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4216
          • C:\Windows\system32\net.exe
            net session
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2800
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 session
              5⤵
                PID:200
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"7fevgw9v5q.exe\""
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4248
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"ystd1t8zj94b.exe\""
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:1200
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"7qyejl4p6.exe\""
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:1568
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"mou7lln8dmc.exe\""
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:4240
          • C:\Users\Admin\AppData\Local\Temp\7fevgw9v5q.exe
            C:\Users\Admin\AppData\Local\Temp\7fevgw9v5q.exe
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Registers new Windows logon scripts automatically executed at logon.
            • Checks whether UAC is enabled
            • Suspicious use of WriteProcessMemory
            PID:5832
            • C:\Users\Admin\AppData\Local\Microsoft\Temp\A059EE23\SoftAgent339820.exe
              "C:\Users\Admin\AppData\Local\Microsoft\Temp\A059EE23\SoftAgent339820.exe"
              4⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Checks whether UAC is enabled
              PID:5824
          • C:\Users\Admin\AppData\Local\Temp\ystd1t8zj94b.exe
            C:\Users\Admin\AppData\Local\Temp\ystd1t8zj94b.exe
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4632
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /create /tn "OptimizeHelper_da22" /tr "C:\Users\Admin\AppData\Roaming\Logs6E48\SoftGuardSvcd1fe5.exe" /sc minute /mo 1 /f
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2228
          • C:\Users\Admin\AppData\Local\Temp\7qyejl4p6.exe
            C:\Users\Admin\AppData\Local\Temp\7qyejl4p6.exe
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of WriteProcessMemory
            PID:3400
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /create /tn "OptimizeService_fb7c" /tr "C:\Users\Admin\AppData\Local\Common\Data\9E3D02D8\NetAgenta1a6e0.exe" /sc minute /mo 1 /f
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4108
            • C:\Users\Admin\AppData\Local\Common\Data\9E3D02D8\NetAgenta1a6e0.exe
              "C:\Users\Admin\AppData\Local\Common\Data\9E3D02D8\NetAgenta1a6e0.exe"
              4⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of WriteProcessMemory
              PID:4048
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /query /tn "OptimizeService_fb7c"
                5⤵
                  PID:2280
            • C:\Users\Admin\AppData\Local\Temp\mou7lln8dmc.exe
              C:\Users\Admin\AppData\Local\Temp\mou7lln8dmc.exe
              3⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious use of WriteProcessMemory
              PID:1736
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" delete "CheckUpdateSvc_a47d"
                4⤵
                • Launches sc.exe
                PID:1500
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" create "CheckUpdateSvc_a47d" binpath= "C:\ProgramData\Common\Microsoft\Temp\AC5F54AB\CoreGuardMgr3586.exe" start= "auto"
                4⤵
                • Launches sc.exe
                PID:2944
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" start "CheckUpdateSvc_a47d"
                4⤵
                • Launches sc.exe
                PID:1140
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$a=New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DesktopWindowManager.exe'; $t=New-ScheduledTaskTrigger -AtStartup; $p=New-ScheduledTaskPrincipal -UserId ([Security.Principal.WindowsIdentity]::GetCurrent().Name) -RunLevel Highest -LogonType S4U; $s=New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable; Register-ScheduledTask -TaskName 'DesktopWindowManager' -Action $a -Trigger $t -Principal $p -Settings $s -Force"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2036
          • C:\Windows\System32\nslookup.exe
            "C:\Windows\System32\nslookup.exe"
            2⤵
              PID:2748
          • C:\Users\Admin\AppData\Local\Common\Data\9E3D02D8\NetAgenta1a6e0.exe
            C:\Users\Admin\AppData\Local\Common\Data\9E3D02D8\NetAgenta1a6e0.exe
            1⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            PID:5072
          • C:\Users\Admin\AppData\Roaming\Logs6E48\SoftGuardSvcd1fe5.exe
            C:\Users\Admin\AppData\Roaming\Logs6E48\SoftGuardSvcd1fe5.exe
            1⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            PID:4900
          • C:\ProgramData\Common\Microsoft\Temp\AC5F54AB\CoreGuardMgr3586.exe
            C:\ProgramData\Common\Microsoft\Temp\AC5F54AB\CoreGuardMgr3586.exe
            1⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2588
          • C:\Users\Admin\AppData\Local\Common\Data\9E3D02D8\NetAgenta1a6e0.exe
            "C:\Users\Admin\AppData\Local\Common\Data\9E3D02D8\NetAgenta1a6e0.exe"
            1⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            PID:1100
          • C:\Users\Admin\AppData\Roaming\Logs6E48\SoftGuardSvcd1fe5.exe
            "C:\Users\Admin\AppData\Roaming\Logs6E48\SoftGuardSvcd1fe5.exe"
            1⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            PID:5544
          • C:\Users\Admin\AppData\Local\Common\Data\9E3D02D8\NetAgenta1a6e0.exe
            "C:\Users\Admin\AppData\Local\Common\Data\9E3D02D8\NetAgenta1a6e0.exe"
            1⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            PID:5860
          • C:\Users\Admin\AppData\Roaming\Logs6E48\SoftGuardSvcd1fe5.exe
            "C:\Users\Admin\AppData\Roaming\Logs6E48\SoftGuardSvcd1fe5.exe"
            1⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            PID:1992

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                2
                T1059

                PowerShell

                1
                T1059.001

                Windows Command Shell

                1
                T1059.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                System Services

                2
                T1569

                Service Execution

                2
                T1569.002

                Persistence

                Boot or Logon Initialization Scripts

                1
                T1037

                Logon Script (Windows)

                1
                T1037.001

                Create or Modify System Process

                2
                T1543

                Windows Service

                2
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Initialization Scripts

                1
                T1037

                Logon Script (Windows)

                1
                T1037.001

                Create or Modify System Process

                2
                T1543

                Windows Service

                2
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Impair Defenses

                1
                T1562

                Virtualization/Sandbox Evasion

                1
                T1497

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                2
                T1552

                Credentials In Files

                2
                T1552.001

                Discovery

                Query Registry

                4
                T1012

                System Information Discovery

                3
                T1082

                Virtualization/Sandbox Evasion

                1
                T1497

                Lateral Movement

                Collection

                Data from Local System

                2
                T1005

                Command and Control

                Exfiltration

                Impact

                Service Stop

                1
                T1489

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 313ef5befe6efded1a8528baac8e30dac0029db1e0736a691d94ae845b0aeb0c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 9eb7e0ba6e4a5fb9456349c31170a710f912455968219d24d87b7f87cf4e8cb2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 287307bc450d600c2d2233396ad78e35ee001205892e0d2fc4efa4360072a1f1
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 dc4ebf4baa7b27ac79e1e8787c84c5adaaaad1ec2f83eaf97b5e28040afcf03b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 d2d207f7e7824030b5ac3d2ef965c63f171a9dc36ee858982fbb0864b8566780
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                7fevgw9v5q.exe
                • Path C:\Users\Admin\AppData\Local\Temp\7fevgw9v5q.exe
                • Size 3.9MB
                • SHA256 5cbb1d7ab165e888e31ed595357a20fd7119f3c70afe066fabafced1b1b28ea0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7qyejl4p6.exe
                • Path C:\Users\Admin\AppData\Local\Temp\7qyejl4p6.exe
                • Size 3.9MB
                • SHA256 99f44a63608b4137b417066d9f001bb455e11366f7889c98d93245335fba9009
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __PSScriptPolicyTest_bj24yrsy.5j2.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bj24yrsy.5j2.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                mou7lln8dmc.exe
                • Path C:\Users\Admin\AppData\Local\Temp\mou7lln8dmc.exe
                • Size 6.0MB
                • SHA256 520356aeba042e45c38895485769d92293ec2072abe8188dee1fb3f995ced3e2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ystd1t8zj94b.exe
                • Path C:\Users\Admin\AppData\Local\Temp\ystd1t8zj94b.exe
                • Size 3.9MB
                • SHA256 a3a01f953e9bfcc90c1fab2358fad6cfccf81d13c4d2640d13af75ca3730ee11
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/1100-142-0x0000000140000000-0x00000001409D6000-memory.dmp
                Download

                memory/1100-143-0x0000000140000000-0x00000001409D6000-memory.dmp
                Download

                memory/1736-86-0x0000000140000000-0x0000000140BE8000-memory.dmp
                Download

                memory/1736-100-0x0000000140000000-0x0000000140BE8000-memory.dmp
                Download

                memory/1736-85-0x0000000140000000-0x0000000140BE8000-memory.dmp
                Download

                memory/1736-92-0x0000000000570000-0x0000000000571000-memory.dmp
                Download

                memory/1736-87-0x0000000140000000-0x0000000140BE8000-memory.dmp
                Download

                memory/1992-169-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/1992-171-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/2036-96-0x0000026025580000-0x0000026025632000-memory.dmp
                Download

                memory/2036-105-0x0000026025AC0000-0x0000026025ADE000-memory.dmp
                Download

                memory/2588-104-0x0000000140000000-0x0000000140BE8000-memory.dmp
                Download

                memory/2588-103-0x0000000140000000-0x0000000140BE8000-memory.dmp
                Download

                memory/2588-113-0x0000000140000000-0x0000000140BE8000-memory.dmp
                Download

                memory/2748-107-0x0000000140000000-0x0000000140232000-memory.dmp
                Download

                memory/3400-80-0x0000000140000000-0x00000001409D6000-memory.dmp
                Download

                memory/3400-74-0x0000000140000000-0x00000001409D6000-memory.dmp
                Download

                memory/3400-72-0x0000000140000000-0x00000001409D6000-memory.dmp
                Download

                memory/4048-81-0x0000000140000000-0x00000001409D6000-memory.dmp
                Download

                memory/4048-117-0x0000000140000000-0x00000001409D6000-memory.dmp
                Download

                memory/4048-123-0x0000000140000000-0x00000001409D6000-memory.dmp
                Download

                memory/4372-28-0x0000018863430000-0x00000188635F2000-memory.dmp
                Download

                memory/4372-29-0x0000018863B30000-0x0000018864058000-memory.dmp
                Download

                memory/4372-23-0x0000018862C30000-0x0000018862C4E000-memory.dmp
                Download

                memory/4372-24-0x0000018862F50000-0x0000018863002000-memory.dmp
                Download

                memory/4372-25-0x0000018862C50000-0x0000018862C5A000-memory.dmp
                Download

                memory/4372-26-0x0000018862CE0000-0x0000018862D0A000-memory.dmp
                Download

                memory/4372-27-0x0000018862CE0000-0x0000018862D04000-memory.dmp
                Download

                memory/4420-13-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
                Download

                memory/4420-11-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
                Download

                memory/4420-5-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
                Download

                memory/4420-7-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
                Download

                memory/4420-2-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
                Download

                memory/4420-8-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
                Download

                memory/4420-9-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
                Download

                memory/4420-10-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
                Download

                memory/4420-1-0x00007FFE6AA5F000-0x00007FFE6AA60000-memory.dmp
                Download

                memory/4420-17-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
                Download

                memory/4420-15-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
                Download

                memory/4420-14-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
                Download

                memory/4420-6-0x0000021F6E1C0000-0x0000021F6E1E2000-memory.dmp
                Download

                memory/4420-12-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
                Download

                memory/4632-174-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4632-120-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4632-115-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4632-68-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4632-119-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4632-156-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4632-66-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4632-159-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4632-153-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4632-162-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4632-150-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4632-146-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4632-126-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4632-129-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4632-132-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4632-170-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4900-118-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4900-124-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4900-125-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/4900-122-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/5072-98-0x0000000140000000-0x00000001409D6000-memory.dmp
                Download

                memory/5072-93-0x0000000140000000-0x00000001409D6000-memory.dmp
                Download

                memory/5544-148-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/5544-145-0x0000000140000000-0x00000001409F7000-memory.dmp
                Download

                memory/5824-116-0x0000000140000000-0x00000001409C7000-memory.dmp
                Download

                memory/5824-76-0x0000000140000000-0x00000001409C7000-memory.dmp
                Download

                memory/5832-60-0x0000000140000000-0x00000001409C7000-memory.dmp
                Download

                memory/5832-75-0x0000000140000000-0x00000001409C7000-memory.dmp
                Download

                memory/5832-62-0x0000000140000000-0x00000001409C7000-memory.dmp
                Download

                memory/5860-166-0x0000000140000000-0x00000001409D6000-memory.dmp
                Download

                memory/5860-167-0x0000000140000000-0x00000001409D6000-memory.dmp
                Download