Overview

overview

8

Static

static

8

support.client.exe

windows10-2004-x64

8

support.client.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/06/2026, 13:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    support.client.exe
  • Size 305KB
  • Sample260623-qmkjsads5w
  • SHA256 0b01016d6117a8a0af97c5a7a1f6e2241f0b2a31240628e8a70f6635e8386d20
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceransomwarerevoked_codesignspywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 7 IoCs
  • Manipulates Digital Signatures 1 TTPs 4 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Signed with revoked ConnectWise certificate 4 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    defense_evasionspywaretrojan
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\support.client.exe
    "C:\Users\Admin\AppData\Local\Temp\support.client.exe"
    1⤵
    • Manipulates Digital Signatures
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:4144
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      2⤵
      • Downloads MZ/PE file
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1500
      • C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\scre..tion_25b0fbb6ef7eb094_0019.0002_848572f0dfcbf17a\ScreenConnect.WindowsClient.exe
        "C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\scre..tion_25b0fbb6ef7eb094_0019.0002_848572f0dfcbf17a\ScreenConnect.WindowsClient.exe"
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        PID:2924
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3196
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:5972
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5944
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5696

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\manifests\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms
        • Size 24KB
        • SHA256 f52fff1f03c3c7ad946c740b24e309ddf388c08afa1462ec5cc4c9dffc8d923f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\manifests\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms
        • Size 3KB
        • SHA256 9acb613a20ae7917b37ef9cfa6b01e411641c25b2cb1c98a7a4e73c60afaefae
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\manifests\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms
        • Size 5KB
        • SHA256 d7ca9f289aa79d2766a1c6697a90192db5f01ec7f551b638ec7236faa0e7c2ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms
        • Size 6KB
        • SHA256 c9543082b561226b06f39d1e7f79ee75f63ffb1a4f48f3a7c00228ec834a3605
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms
        • Size 2KB
        • SHA256 9300ed0de7dbba2424c4013cc24c87a646c34d7f85d0b3ae9c99418c58559515
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\manifests\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms
        • Size 14KB
        • SHA256 af0f798903333111b6bcaa6cf0b044e44de9fcdf77afc9eb7fc245139154f6de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\manifests\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms
        • Size 4KB
        • SHA256 0a552396d13f548923f08dd26d50a075a42d0485bc8e798c7fb447835f60de4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        1jwx1wpa.newcfg
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\scre..tion_25b0fbb6ef7eb094_0019.0002_848572f0dfcbf17a\1jwx1wpa.newcfg
        • Size 563B
        • SHA256 792a7173e0a400cbe1bac6e5ccef4e6d86158470abb6695bc3fb4c31adbd7838
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        4ivqshmf.newcfg
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\scre..tion_25b0fbb6ef7eb094_0019.0002_848572f0dfcbf17a\4ivqshmf.newcfg
        • Size 563B
        • SHA256 3cf5e1d8e02f4a4c243097f9fb08be724ac95dd4106d498d9fccfd02b2c3b80b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        app.config
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\scre..tion_25b0fbb6ef7eb094_0019.0002_848572f0dfcbf17a\app.config
        • Size 508B
        • SHA256 779c074d07a35de132ade25762da935077cf6a7da2c3812cc4f432d5dad73394
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        hfoea4rq.newcfg
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\scre..tion_25b0fbb6ef7eb094_0019.0002_848572f0dfcbf17a\hfoea4rq.newcfg
        • Size 563B
        • SHA256 035ceecd49d4a3a3b1b6e5627cc556f9115fcdcf9675f898d4767dac6d6d4fc5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nsgbcwcq.newcfg
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\scre..tion_25b0fbb6ef7eb094_0019.0002_848572f0dfcbf17a\nsgbcwcq.newcfg
        • Size 563B
        • SHA256 22b4bb33c204d093253b2303d40ad4e1db0592ad0da61b3468aaf1943e443788
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        pwdostel.newcfg
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\scre..tion_25b0fbb6ef7eb094_0019.0002_848572f0dfcbf17a\pwdostel.newcfg
        • Size 563B
        • SHA256 a5b67059c968ebb31c54c62c8c6f6bf0887f8081f975b4f2ed1e597dfa5d8d01
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.config
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\scre..tion_25b0fbb6ef7eb094_0019.0002_848572f0dfcbf17a\user.config
        • Size 563B
        • SHA256 c6bdc3ac63ad1e2af9f12cd4edfe1a8d47ed388efc11cc1387bf53479a01386d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vuzvbq0l.newcfg
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\scre..tion_25b0fbb6ef7eb094_0019.0002_848572f0dfcbf17a\vuzvbq0l.newcfg
        • Size 563B
        • SHA256 a81b493ddcb51a3a710570177da6ddd14d0aaa213fcb65987ef7391ec094aa03
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        yww2qrwr.newcfg
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\VAZDT80Q.KZY\B3L96CHG.7VP\scre..tion_25b0fbb6ef7eb094_0019.0002_848572f0dfcbf17a\yww2qrwr.newcfg
        • Size 563B
        • SHA256 189094bde26f579e239303929f3a00127863d4aa888e1ab15a23a8fde736380d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.Client.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8JAZE657.63M\30LVM5WH.055\ScreenConnect.Client.dll
        • Size 192KB
        • SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Client.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8JAZE657.63M\30LVM5WH.055\ScreenConnect.Client.dll.genman
        • Size 1KB
        • SHA256 948596c07ffcd2ad7c1463894ac108ee05507def70f8a4a97d75a7081266b512
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.ClientService.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8JAZE657.63M\30LVM5WH.055\ScreenConnect.ClientService.dll
        • Size 66KB
        • SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.ClientService.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8JAZE657.63M\30LVM5WH.055\ScreenConnect.ClientService.dll.genman
        • Size 1KB
        • SHA256 7ba2e686afa757becaec5216ddbc0be75d7d30f9af8233e9160d200efec8aa0f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.ClientService.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8JAZE657.63M\30LVM5WH.055\ScreenConnect.ClientService.exe
        • Size 93KB
        • SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8JAZE657.63M\30LVM5WH.055\ScreenConnect.Core.dll
        • Size 538KB
        • SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8JAZE657.63M\30LVM5WH.055\ScreenConnect.Core.dll.genman
        • Size 1KB
        • SHA256 1008e0a6ce99adf165f8e173dcd4bb5e0761673aa9c3150f5e010f03d0f6434b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.Windows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8JAZE657.63M\30LVM5WH.055\ScreenConnect.Windows.dll
        • Size 1.6MB
        • SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Windows.dll.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8JAZE657.63M\30LVM5WH.055\ScreenConnect.Windows.dll.genman
        • Size 1KB
        • SHA256 74bc77d4a907113ee17339077cf42d4919a3d02987325a5fd5608a43f65e60c2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsBackstageShell.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8JAZE657.63M\30LVM5WH.055\ScreenConnect.WindowsBackstageShell.exe
        • Size 59KB
        • SHA256 1404090db3128de503ba4d991a960c7c1bc3b910a62d06ecf7e7081a2fcf11b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8JAZE657.63M\30LVM5WH.055\ScreenConnect.WindowsClient.exe
        • Size 593KB
        • SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.config
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8JAZE657.63M\30LVM5WH.055\ScreenConnect.WindowsClient.exe.config
        • Size 266B
        • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8JAZE657.63M\30LVM5WH.055\ScreenConnect.WindowsClient.exe.genman
        • Size 2KB
        • SHA256 cfe9e06a7fc7a776c704f992b1b80c2938133a4b8c1b53bcabe57cade90d44b9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8JAZE657.63M\30LVM5WH.055\ScreenConnect.WindowsClient.exe.manifest
        • Size 17KB
        • SHA256 d44b7bda547bbbeab6060edd2207e97dbc43c28aa08522b2108866c1ac023dbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsFileManager.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\8JAZE657.63M\30LVM5WH.055\ScreenConnect.WindowsFileManager.exe
        • Size 79KB
        • SHA256 13f8cfe4648b807a0cbddd653c75254b60d1951e11e715f4e5a1a2c9ab29360b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        5CVP2XBB.1GL.application
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\Y4GCPMZ8.EV1\5CVP2XBB.1GL.application
        • Size 116KB
        • SHA256 c5d2e8861aaeaa84d449717bd526a351a0eb38ffc4bb882b5e84b8b866cb5b66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1500-41-0x000002097D7E0000-0x000002097D878000-memory.dmp
        Download

        memory/1500-304-0x00007FFC38A00000-0x00007FFC393A4000-memory.dmp
        Download

        memory/1500-59-0x0000020962F60000-0x0000020962F78000-memory.dmp
        Download

        memory/1500-53-0x000002097B970000-0x000002097B9A6000-memory.dmp
        Download

        memory/1500-47-0x000002097D330000-0x000002097D3BC000-memory.dmp
        Download

        memory/1500-0-0x00007FFC38B8F000-0x00007FFC38B90000-memory.dmp
        Download

        memory/1500-31-0x00007FFC38A00000-0x00007FFC393A4000-memory.dmp
        Download

        memory/1500-30-0x00007FFC38A00000-0x00007FFC393A4000-memory.dmp
        Download

        memory/1500-15-0x00007FFC38A00000-0x00007FFC393A4000-memory.dmp
        Download

        memory/1500-13-0x000002097D2E0000-0x000002097D330000-memory.dmp
        Download

        memory/1500-1-0x0000020961250000-0x0000020961258000-memory.dmp
        Download

        memory/1500-289-0x00007FFC38A00000-0x00007FFC393A4000-memory.dmp
        Download

        memory/1500-2-0x000002097B9C0000-0x000002097BB48000-memory.dmp
        Download

        memory/1500-10-0x00007FFC38A00000-0x00007FFC393A4000-memory.dmp
        Download

        memory/1500-303-0x00007FFC38A00000-0x00007FFC393A4000-memory.dmp
        Download

        memory/1500-65-0x000002097D990000-0x000002097DB3C000-memory.dmp
        Download

        memory/1500-305-0x00007FFC38A00000-0x00007FFC393A4000-memory.dmp
        Download

        memory/1500-9-0x00007FFC38A00000-0x00007FFC393A4000-memory.dmp
        Download

        memory/1500-8-0x00007FFC38A00000-0x00007FFC393A4000-memory.dmp
        Download

        memory/1500-7-0x00007FFC38A00000-0x00007FFC393A4000-memory.dmp
        Download

        memory/1500-6-0x00007FFC38A00000-0x00007FFC393A4000-memory.dmp
        Download

        memory/1500-5-0x00007FFC38A00000-0x00007FFC393A4000-memory.dmp
        Download

        memory/1500-4-0x00007FFC38A00000-0x00007FFC393A4000-memory.dmp
        Download

        memory/1500-3-0x00007FFC38A00000-0x00007FFC393A4000-memory.dmp
        Download

        memory/2924-296-0x00000000010F0000-0x0000000001108000-memory.dmp
        Download

        memory/2924-288-0x00000000007A0000-0x0000000000838000-memory.dmp
        Download

        memory/5944-395-0x000001D481E40000-0x000001D481F40000-memory.dmp
        Download

        memory/5944-384-0x000001D4801E0000-0x000001D4802E0000-memory.dmp
        Download

        memory/5944-407-0x000001D481C20000-0x000001D481C40000-memory.dmp
        Download

        memory/5944-394-0x000001D4819E0000-0x000001D481A00000-memory.dmp
        Download

        memory/5944-382-0x000001D4801E0000-0x000001D4802E0000-memory.dmp
        Download

        memory/5944-428-0x000001D4941E0000-0x000001D494200000-memory.dmp
        Download