Analysis
- max time kernel
26s - max time network
47s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
15/09/2026, 15:44
General
- Target New Text Document mod.exe
- Size 8KB
- Sample260915-s6wghaxtax
- SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 4 IoCs
- Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 8 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Themida packer 30 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Maps connected drives based on registry 3 TTPs 18 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 8 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\file_2f719905826df92a.exe"C:\Users\Admin\AppData\Local\Temp\a\file_2f719905826df92a.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" about:blank --disable-gpu3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcabcfc728,0x7ffcabcfc734,0x7ffcabcfc7404⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1672,i,8001642862169678627,13724894733540805243,262144 --field-trial-handle=2440,i,17236856329762693014,6713475638464273670,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1316,i,13678779699683753247,14282821043803380386,524288 --field-trial-handle=2440,i,17236856329762693014,6713475638464273670,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2040,i,3153720276866713851,14663639986032443125,524288 --field-trial-handle=2440,i,17236856329762693014,6713475638464273670,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:134⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3060,i,8908302925389941436,14442326572486078560,2097152 --field-trial-handle=2440,i,17236856329762693014,6713475638464273670,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3068,i,16344143332241393987,3806660086447740782,2097152 --field-trial-handle=2440,i,17236856329762693014,6713475638464273670,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4460,i,13368599960038413672,1734791981828835816,524288 --field-trial-handle=2440,i,17236856329762693014,6713475638464273670,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:144⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" about:blank --disable-gpu3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffcafa7c188,0x7ffcafa7c194,0x7ffcafa7c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,6389396813020610343,17481218792441430387,524288 --field-trial-handle=2524,i,7753169518710988283,13475078341182477299,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1540,i,4960740493149675979,651303444911263798,262144 --field-trial-handle=2524,i,7753169518710988283,13475078341182477299,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,5025981092487024343,8312713984860240858,524288 --field-trial-handle=2524,i,7753169518710988283,13475078341182477299,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3372,i,7408595440158643806,1866227193249402915,2097152 --field-trial-handle=2524,i,7753169518710988283,13475078341182477299,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3376,i,4454751905170853475,1767787133208106247,2097152 --field-trial-handle=2524,i,7753169518710988283,13475078341182477299,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,10054941175560029122,8855189021676439307,2097152 --field-trial-handle=2524,i,7753169518710988283,13475078341182477299,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,13572816770526066790,4403561716882868974,2097152 --field-trial-handle=2524,i,7753169518710988283,13475078341182477299,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:94⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\contis.exe"C:\Users\Admin\AppData\Local\Temp\a\contis.exe"2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\a\9z7BGnRGpgs8cZv7.exe"C:\Users\Admin\AppData\Local\Temp\a\9z7BGnRGpgs8cZv7.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Temp\A059EE23\SoftAgent339820.exe"C:\Users\Admin\AppData\Local\Microsoft\Temp\A059EE23\SoftAgent339820.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\gM9anpOuZNKX8zHj.exe"C:\Users\Admin\AppData\Local\Temp\a\gM9anpOuZNKX8zHj.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "OptimizeHelper_da22" /tr "C:\Users\Admin\AppData\Roaming\Logs53CA\SoftGuardSvcd1fe5.exe" /sc minute /mo 1 /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\controller.exe"C:\Users\Admin\AppData\Local\Temp\a\controller.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -Milliseconds 2500"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$g=@((Get-CimInstance Win32_VideoController -EA SilentlyContinue|Select-Object -ExpandProperty Name));$d=[int64]((Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\" -EA SilentlyContinue).Size);$pr=@(Get-Process -EA SilentlyContinue);$w=[bool]($pr|Where-Object {$_.ProcessName -eq 'CExecSvc'});@{g=($g -join '|');d=$d;p=$pr.Count;w=$w;n=(($pr|Select-Object -ExpandProperty ProcessName)-join '|')}|ConvertTo-Json -Compress"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet session4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"gurn1v324.exe\""3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"n0r40l5pam.exe\""3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"gu52x84tiw8s.exe\""3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"tkhhuivbr0sw.exe\""3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\gurn1v324.exeC:\Users\Admin\AppData\Local\Temp\gurn1v324.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\n0r40l5pam.exeC:\Users\Admin\AppData\Local\Temp\n0r40l5pam.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\gu52x84tiw8s.exeC:\Users\Admin\AppData\Local\Temp\gu52x84tiw8s.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tkhhuivbr0sw.exeC:\Users\Admin\AppData\Local\Temp\tkhhuivbr0sw.exe3⤵
-
-
-
C:\ProgramData\mfckheqcmmc\oiwgve.exeC:\ProgramData\mfckheqcmmc\oiwgve.exe1⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Logs53CA\SoftGuardSvcd1fe5.exeC:\Users\Admin\AppData\Roaming\Logs53CA\SoftGuardSvcd1fe5.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
SCT Auditing Pending Reports
Local State
settings.dat
settings.dat
Edge Profile.ico
Local State
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_u5pfg1tw.3oq.ps1
9z7BGnRGpgs8cZv7.exe
contis.exe
controller.exe
file_2f719905826df92a.exe
gM9anpOuZNKX8zHj.exe
gu52x84tiw8s.exe
n0r40l5pam.exe
memory/1280-82-0x00000261505D0000-0x00000261505F2000-memory.dmp
memory/2036-85-0x0000000140000000-0x0000000140063000-memory.dmp
memory/2036-126-0x0000000140000000-0x0000000140063000-memory.dmp
memory/2036-127-0x0000000140000000-0x0000000140063000-memory.dmp
memory/2036-129-0x0000000140000000-0x0000000140063000-memory.dmp
memory/2036-24-0x0000000140000000-0x0000000140063000-memory.dmp
memory/2036-23-0x0000000140000000-0x0000000140063000-memory.dmp
memory/2040-110-0x00000249267E0000-0x0000024926D08000-memory.dmp
memory/2040-105-0x0000024925E40000-0x0000024925E6A000-memory.dmp
memory/2040-109-0x00000249260E0000-0x00000249262A2000-memory.dmp
memory/2040-102-0x0000024925BA0000-0x0000024925BBE000-memory.dmp
memory/2040-103-0x0000024925C00000-0x0000024925CB2000-memory.dmp
memory/2040-104-0x0000024925BC0000-0x0000024925BCA000-memory.dmp
memory/2040-106-0x0000024925E40000-0x0000024925E64000-memory.dmp
memory/2892-207-0x0000000140000000-0x00000001409C4000-memory.dmp
memory/2892-213-0x0000000140000000-0x00000001409C4000-memory.dmp
memory/2892-222-0x0000000140000000-0x00000001409C4000-memory.dmp
memory/2964-66-0x0000000140000000-0x0000000140A24000-memory.dmp
memory/2964-63-0x0000000140000000-0x0000000140A24000-memory.dmp
memory/2964-87-0x0000000140000000-0x0000000140A24000-memory.dmp
memory/3492-203-0x0000000140000000-0x0000000140A24000-memory.dmp
memory/3492-56-0x0000000140000000-0x0000000140A24000-memory.dmp
memory/3492-47-0x0000000140000000-0x0000000140A24000-memory.dmp
memory/3492-107-0x0000000140000000-0x0000000140A24000-memory.dmp
memory/3492-58-0x0000000140000000-0x0000000140A24000-memory.dmp
memory/3748-1-0x00000000002F0000-0x00000000002F8000-memory.dmp
memory/3748-2-0x00007FFCB3280000-0x00007FFCB3C24000-memory.dmp
memory/3748-0-0x00007FFCB340F000-0x00007FFCB3410000-memory.dmp
memory/3748-3-0x00007FFCB3280000-0x00007FFCB3C24000-memory.dmp
memory/3748-4-0x00007FFCB3280000-0x00007FFCB3C24000-memory.dmp
memory/3748-6-0x00007FFCB3280000-0x00007FFCB3C24000-memory.dmp
memory/3748-5-0x00007FFCB3280000-0x00007FFCB3C24000-memory.dmp
memory/3748-59-0x00007FFCB3280000-0x00007FFCB3C24000-memory.dmp
memory/4340-76-0x00007FF639B00000-0x00007FF639F4A000-memory.dmp
memory/4340-54-0x00007FF639B00000-0x00007FF639F4A000-memory.dmp
memory/4340-21-0x00007FF639B00000-0x00007FF639F4A000-memory.dmp
memory/4552-212-0x0000000140000000-0x0000000140A24000-memory.dmp
memory/4552-214-0x0000000140000000-0x0000000140A24000-memory.dmp
memory/4736-37-0x0000000140000000-0x00000001409C4000-memory.dmp
memory/4736-57-0x0000000140000000-0x00000001409C4000-memory.dmp
memory/5400-223-0x0000000140000000-0x0000000140984000-memory.dmp
memory/5400-268-0x0000000140000000-0x0000000140984000-memory.dmp
memory/5628-38-0x0000000140000000-0x00000001409C4000-memory.dmp
memory/5628-53-0x0000000140000000-0x00000001409C4000-memory.dmp
memory/5628-35-0x0000000140000000-0x00000001409C4000-memory.dmp
memory/5628-108-0x0000000140000000-0x00000001409C4000-memory.dmp
memory/5904-26-0x00007FF67AF90000-0x00007FF67B3DA000-memory.dmp
memory/5904-73-0x00007FF67AF90000-0x00007FF67B3DA000-memory.dmp
memory/5904-61-0x0000016425280000-0x00000164256B1000-memory.dmp