Overview

overview

10

Static

static

3

2026-10-26...op.exe

windows10-2004-x64

10

2026-10-26...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    60s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 01:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
  • Size 744KB
  • Sample261027-bfbkzazzds
  • SHA256 4a753eba6adc2aaa79a19916519603734a096a370096c0d68e3ce26ceb76c11e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryexecutionsalitypersistencetrojanupx

Malware Config

Extracted

Family

  • sality

C2

  • http://89.119.67.154/testo5/

  • http://kukutrustnet777.info/home.gif

  • http://kukutrustnet888.info/home.gif

  • http://kukutrustnet987.info/home.gif

Signatures

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Modifies firewall policy service 3 TTPs 6 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 12 IoCs
    defense_evasiontrojan
  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 37 IoCs
  • UPX dump on OEP (original entry point) 38 IoCs
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Loads dropped DLL 3 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Windows security modification 2 TTPs 14 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • UPX packed file 37 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 7 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\dwm.exe
    "dwm.exe"
    1⤵
      PID:1160
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
      1⤵
        PID:3060
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
        1⤵
          PID:3092
        • C:\Windows\System32\ShellHost.exe
          "C:\Windows\System32\ShellHost.exe"
          1⤵
            PID:3480
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
            1⤵
              PID:3220
            • C:\Windows\System32\RuntimeBroker.exe
              C:\Windows\System32\RuntimeBroker.exe -Embedding
              1⤵
                PID:4380
              • C:\Windows\System32\RuntimeBroker.exe
                C:\Windows\System32\RuntimeBroker.exe -Embedding
                1⤵
                  PID:4440
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                  1⤵
                    PID:4500
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:4816
                    • C:\Windows\system32\ctfmon.exe
                      /QuitInfo:0000000000000268;000000000000026C;
                      1⤵
                        PID:4936
                      • C:\Windows\system32\DllHost.exe
                        C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                        1⤵
                          PID:5192
                        • C:\Windows\System32\SecurityHealthSystray.exe
                          "C:\Windows\System32\SecurityHealthSystray.exe"
                          1⤵
                            PID:5292
                          • C:\Windows\system32\sihost.exe
                            sihost.exe
                            1⤵
                              PID:4352
                              • C:\Windows\explorer.exe
                                explorer.exe /LOADSAVEDWINDOWS
                                2⤵
                                  PID:5140
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-26_fdb8bc43e9b61e38ac0d848473738014_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
                                    3⤵
                                    • Modifies firewall policy service
                                    • UAC bypass
                                    • Windows security bypass
                                    • Windows security modification
                                    • Checks whether UAC is enabled
                                    • Enumerates connected drives
                                    • Drops autorun.inf file
                                    • Drops file in System32 directory
                                    • Drops file in Program Files directory
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: RenamesItself
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    • System policy modification
                                    PID:4116
                                    • C:\Windows\SysWOW64\Rundll32.exe
                                      Rundll32 C:\Windows\system32\liidahaa.dll Exxcute
                                      4⤵
                                      • Loads dropped DLL
                                      • Drops file in Program Files directory
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:5200
                                      • C:\Windows\SysWOW64\net.exe
                                        net stop WinDefend
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5568
                                        • C:\Windows\System32\Conhost.exe
                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          6⤵
                                            PID:1820
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 stop WinDefend
                                            6⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:2660
                                        • C:\Windows\SysWOW64\net.exe
                                          net stop MpsSvc
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4516
                                          • C:\Windows\System32\Conhost.exe
                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            6⤵
                                              PID:2784
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 stop MpsSvc
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5620
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc config WinDefend start= disabled
                                            5⤵
                                            • Launches sc.exe
                                            • System Location Discovery: System Language Discovery
                                            PID:5824
                                            • C:\Windows\System32\Conhost.exe
                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              6⤵
                                                PID:1244
                                            • C:\Windows\SysWOW64\sc.exe
                                              sc config MpsSvc start= disabled
                                              5⤵
                                              • Launches sc.exe
                                              • System Location Discovery: System Language Discovery
                                              PID:5896
                                              • C:\Windows\System32\Conhost.exe
                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                6⤵
                                                  PID:4904
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc stop ZhuDongFangYu
                                                5⤵
                                                • Launches sc.exe
                                                • System Location Discovery: System Language Discovery
                                                PID:3244
                                                • C:\Windows\System32\Conhost.exe
                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  6⤵
                                                    PID:2164
                                                • C:\Windows\SysWOW64\sc.exe
                                                  sc delete ZhuDongFangYu
                                                  5⤵
                                                  • Launches sc.exe
                                                  • System Location Discovery: System Language Discovery
                                                  PID:6116
                                                  • C:\Windows\System32\Conhost.exe
                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    6⤵
                                                      PID:3828
                                                  • C:\Windows\SysWOW64\sc.exe
                                                    sc stop 360rp
                                                    5⤵
                                                    • Launches sc.exe
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3808
                                                    • C:\Windows\System32\Conhost.exe
                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      6⤵
                                                        PID:4100
                                                    • C:\Windows\SysWOW64\sc.exe
                                                      sc delete 360rp
                                                      5⤵
                                                      • Launches sc.exe
                                                      • System Location Discovery: System Language Discovery
                                                      PID:992
                                                      • C:\Windows\System32\Conhost.exe
                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        6⤵
                                                          PID:2436
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        "C:\Windows\System32\sc.exe" stop PolicyAgent
                                                        5⤵
                                                        • Launches sc.exe
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4416
                                                    • C:\Windows\SysWOW64\Rundll32.exe
                                                      Rundll32 C:\Windows\system32\vluqbhaa.dll Exucute
                                                      4⤵
                                                      • Modifies firewall policy service
                                                      • UAC bypass
                                                      • Windows security bypass
                                                      • Loads dropped DLL
                                                      • Windows security modification
                                                      • Adds Run key to start application
                                                      • Checks whether UAC is enabled
                                                      • Enumerates connected drives
                                                      • Drops file in Windows directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • System policy modification
                                                      PID:3468
                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                1⤵
                                                  PID:5692
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:5668
                                                  • C:\Windows\System32\smartscreen.exe
                                                    C:\Windows\System32\smartscreen.exe -Embedding
                                                    1⤵
                                                      PID:3264

                                                    Network

                                                          MITRE ATT&CK Enterprise v16

                                                          Reconnaissance

                                                          Resource Development

                                                          Initial Access

                                                          Replication Through Removable Media

                                                          1
                                                          T1091

                                                          Execution

                                                          System Services

                                                          2
                                                          T1569

                                                          Service Execution

                                                          2
                                                          T1569.002

                                                          Persistence

                                                          Boot or Logon Autostart Execution

                                                          1
                                                          T1547

                                                          Registry Run Keys / Startup Folder

                                                          1
                                                          T1547.001

                                                          Create or Modify System Process

                                                          3
                                                          T1543

                                                          Windows Service

                                                          3
                                                          T1543.003

                                                          Privilege Escalation

                                                          Abuse Elevation Control Mechanism

                                                          1
                                                          T1548

                                                          Bypass User Account Control

                                                          1
                                                          T1548.002

                                                          Boot or Logon Autostart Execution

                                                          1
                                                          T1547

                                                          Registry Run Keys / Startup Folder

                                                          1
                                                          T1547.001

                                                          Create or Modify System Process

                                                          3
                                                          T1543

                                                          Windows Service

                                                          3
                                                          T1543.003

                                                          Defense Evasion

                                                          Abuse Elevation Control Mechanism

                                                          1
                                                          T1548

                                                          Bypass User Account Control

                                                          1
                                                          T1548.002

                                                          Impair Defenses

                                                          5
                                                          T1562

                                                          Disable or Modify System Firewall

                                                          1
                                                          T1562.004

                                                          Disable or Modify Tools

                                                          3
                                                          T1562.001

                                                          Modify Registry

                                                          6
                                                          T1112

                                                          Credential Access

                                                          Discovery

                                                          Peripheral Device Discovery

                                                          1
                                                          T1120

                                                          Query Registry

                                                          1
                                                          T1012

                                                          System Information Discovery

                                                          3
                                                          T1082

                                                          System Location Discovery

                                                          1
                                                          T1614

                                                          System Language Discovery

                                                          1
                                                          T1614.001

                                                          Lateral Movement

                                                          Replication Through Removable Media

                                                          1
                                                          T1091

                                                          Collection

                                                          Command and Control

                                                          Exfiltration

                                                          Impact

                                                          Service Stop

                                                          2
                                                          T1489

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          MavInject32.exe
                                                          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                                                          • Size 431KB
                                                          • SHA256 56a86d28dd8216993cf99ae9505c288851bbf294ab379767d898d3c02cfdc1be
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          5A4B.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Temp\5A4B.tmp
                                                          • Size 2.1MB
                                                          • SHA256 974e92b2a97436569c49462a80471bbc255a8b493fc90e2456996c09aed7518b
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          burr.exe
                                                          • Path C:\Users\Admin\AppData\Local\Temp\burr.exe
                                                          • Size 65KB
                                                          • SHA256 593f0ae2c3a919c7e50842d65822f879cdf4bd3ddf8cb015c3e50d76b6ceedaa
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          ykrqf.exe
                                                          • Path C:\Users\Admin\AppData\Local\Temp\ykrqf.exe
                                                          • Size 65KB
                                                          • SHA256 874550c67200a3af2e06ad7a4f8861f59811a058448325bd6799d184c511f412
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          SYSTEM.INI
                                                          • Path C:\Windows\SYSTEM.INI
                                                          • Size 257B
                                                          • SHA256 a79d8d10a9be8f42cc77c586a92edecafefcf9f091b3e47854494e3a54fed52e
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          liidahaa.dll
                                                          • Path C:\Windows\SysWOW64\liidahaa.dll
                                                          • Size 75KB
                                                          • SHA256 d487262d60a39473351162bbca85308528c197af0aca6127044e9672efc6d881
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          vluqbhaa.dll
                                                          • Path C:\Windows\SysWOW64\vluqbhaa.dll
                                                          • Size 22KB
                                                          • SHA256 6415356e1598e10aa4cbadae4bddef9d3b66beba7d2fcdadc581e747d7ec5b9b
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          autorun.inf
                                                          • Path C:\autorun.inf
                                                          • Size 268B
                                                          • SHA256 1548d38986bd9438529cea74d49726fc8d5b81ef5824590813f996f9da005338
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          melipm.exe
                                                          • Path C:\melipm.exe
                                                          • Size 97KB
                                                          • SHA256 380c0235c4ce544e9f468eca895bda0e3bb8aac4b0f39775443e71399884fc47
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          autorun.inf
                                                          • Path F:\autorun.inf
                                                          • Size 280B
                                                          • SHA256 3d5ac3f1bcbdd54743c1caa2fb5be2eb4ffd57bb7d17f5586dd6270b73d96c2e
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          memory/992-71-0x0000000000A50000-0x0000000000A52000-memory.dmp
                                                          Download

                                                          memory/992-68-0x0000000000A50000-0x0000000000A52000-memory.dmp
                                                          Download

                                                          memory/992-56-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
                                                          Download

                                                          memory/3244-49-0x00000000006B0000-0x00000000006B1000-memory.dmp
                                                          Download

                                                          memory/3244-76-0x00000000006A0000-0x00000000006A2000-memory.dmp
                                                          Download

                                                          memory/3244-57-0x00000000006A0000-0x00000000006A2000-memory.dmp
                                                          Download

                                                          memory/3468-113-0x0000000004120000-0x0000000004122000-memory.dmp
                                                          Download

                                                          memory/3468-112-0x00000000041B0000-0x00000000041B1000-memory.dmp
                                                          Download

                                                          memory/3808-79-0x0000000000510000-0x0000000000512000-memory.dmp
                                                          Download

                                                          memory/3808-54-0x0000000000690000-0x0000000000691000-memory.dmp
                                                          Download

                                                          memory/3808-61-0x0000000000510000-0x0000000000512000-memory.dmp
                                                          Download

                                                          memory/4116-29-0x00000000047B0000-0x00000000047B1000-memory.dmp
                                                          Download

                                                          memory/4116-139-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-23-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-131-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-0-0x0000000000400000-0x0000000000436000-memory.dmp
                                                          Download

                                                          memory/4116-37-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-38-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-133-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-129-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-69-0x0000000002130000-0x0000000002132000-memory.dmp
                                                          Download

                                                          memory/4116-11-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-21-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-22-0x0000000002130000-0x0000000002132000-memory.dmp
                                                          Download

                                                          memory/4116-128-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-10-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-13-0x0000000002130000-0x0000000002132000-memory.dmp
                                                          Download

                                                          memory/4116-176-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-14-0x0000000002140000-0x0000000002141000-memory.dmp
                                                          Download

                                                          memory/4116-175-0x0000000000400000-0x0000000000436000-memory.dmp
                                                          Download

                                                          memory/4116-20-0x0000000002130000-0x0000000002132000-memory.dmp
                                                          Download

                                                          memory/4116-9-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-141-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-7-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-24-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-50-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-137-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-136-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-6-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-92-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-5-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-96-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-97-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-100-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-101-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-106-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-108-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-110-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-8-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-1-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-114-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-116-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-119-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-121-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-123-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4116-125-0x0000000002360000-0x000000000341A000-memory.dmp
                                                          Download

                                                          memory/4516-85-0x0000000000F80000-0x0000000000F82000-memory.dmp
                                                          Download

                                                          memory/4516-66-0x0000000000F80000-0x0000000000F82000-memory.dmp
                                                          Download

                                                          memory/4516-45-0x0000000000F90000-0x0000000000F91000-memory.dmp
                                                          Download

                                                          memory/5200-27-0x0000000001080000-0x0000000001082000-memory.dmp
                                                          Download

                                                          memory/5200-88-0x0000000001080000-0x0000000001082000-memory.dmp
                                                          Download

                                                          memory/5200-26-0x0000000001080000-0x0000000001082000-memory.dmp
                                                          Download

                                                          memory/5200-16-0x0000000001090000-0x0000000001091000-memory.dmp
                                                          Download

                                                          memory/5568-43-0x0000000000F40000-0x0000000000F41000-memory.dmp
                                                          Download

                                                          memory/5568-59-0x0000000000F30000-0x0000000000F32000-memory.dmp
                                                          Download

                                                          memory/5568-82-0x0000000000F30000-0x0000000000F32000-memory.dmp
                                                          Download

                                                          memory/5896-47-0x0000000001420000-0x0000000001421000-memory.dmp
                                                          Download

                                                          memory/5896-58-0x0000000001410000-0x0000000001412000-memory.dmp
                                                          Download

                                                          memory/5896-63-0x0000000001410000-0x0000000001412000-memory.dmp
                                                          Download

                                                          memory/6116-52-0x0000000000500000-0x0000000000501000-memory.dmp
                                                          Download

                                                          memory/6116-64-0x00000000004F0000-0x00000000004F2000-memory.dmp
                                                          Download

                                                          memory/6116-70-0x00000000004F0000-0x00000000004F2000-memory.dmp
                                                          Download